Cortex XDR along with Defender for endpoint Compatibility

[bridgetlitt]

Does anyone have a list of guidelines to follow when running cortex xdr (Report mode) in parallel with defender (active mode) for workstations as well as servers? Do i need to do any exclusions/whitelisting? Do I need to disable any features in XDR to prevent issues?

In xdr compatibility matrix https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Compatibility-Matrix/Cortex-XDR-age... you can see it mentions defender and emet separately but if emet like features are present in defender (exploit protection features), running exploit protection in both xdr and defender for endpoint should not work as well correct?

[jmazzeo · Accepted solution]

Hi @bridgetlitt, usually when running two security products in the same endpoint you need to disable the exploit prevention in one of them. In this case, as the XDR is the "passive" product, should be done with the Cortex console.

There is no official support for XDR in report mode and Defender in active mode, the only supported mode is stated in the URL that you shared in the post.

If this post answers your question, please mark it as the solution.