Cortex XDR agent's CE versions missing from the list & version downgrading

[tmeksik]

Hi team

2 questions but related here:

1) We need to downgrade from 8.4.x to 8.3 CE. Is this possible to just installer a CE over the existing 8.4.x? Or an uninstall is required...?
2) Is there any reason why I can't see a CE version listed (screenshot attached)? Expected there to be 8.3.100.52566 [CE]...

Thanks

Tum

[tmeksik]

So... answering my own question here: the CE just wasn't enabled in the settings.

Leaving just one question whether or not we can install this over an existing newer standard version...

[neelrohit · Accepted solution]

Hi Tum,

Thank you for writing to live community!

A CE version is a classified maintenance version from a standard agent release. The common schema to detect is that standard release generally go A.0.XXXXX. A.1.YYYYY, A.2.....so on.. In this stance you can always upgrade to another maintenace release from a lower release version.

Similarly, the CE versions have A.100.XXXXX, A.101.YYYYY so on on top of the standard lineups and hence the standard agent versions can be upgraded to CE versions provided the CE version release itself is not lower than major standard release. Eg is that you can upgrade 8.3.x version to 8.3CE, but not 7.9CE. However, if you have 8.4 already installed, you cannot upgrade to either of the CE releases as they are one release lower than 8.4

Hope this answers your query.

Feel free to mark the response as "Accept as Solution" if it answers your question

[tmeksik]

Thanks Neel.... Was just impatient and saw the error with my own eyes on my test bed also... Mass uninstallation it is.

While we're at it, what exactly do we miss on using CE versions? Feature-wise, will it be comparable to its standard peer of the same major version? E.g. 8.3 CE will have all analytic alerts of the standard 8.3 ? Saw warning and stuff about incomplete content update on the CE version - would be good to have a more complete list of "missing things".

[neelrohit]

Hi Tum,

While there are some articles already available on live community, which I will append in this thread, I would give you one liner verbiage for the same.

"Technically with no major difference, CE version is a low touch agent and while it is supported for long term for sensitive environments to support least compliance and operational changes, the CE version may lose out on capabilities, functionalities and some aspects of security features introduced in the future release. "

Additionally, as I mentioned that CE versions are low touch, it would essentially mean that CE versions do not receive the content updates in their entirety as a standard lineup does. This implies, that only high and critical impact coverages and fixes are incorported in the CE releases and not the ones which might be mediums or lows.

References: 

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/difference-between-critical-environment-...

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/how-to-convert-cortex-xdr-agent-to-criti...

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/query-on-the-difference-in-cortex-xdr-ag...

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/agent-v-7-9-removed/m-p/557455#M5122

Hope this helps and please feel free to share some love to the efforts our our CSAs' responses in the articles appended if you think these are good references.