Cortex XDR files modified

[efasoformoso]

We have some systems that are locked-down with software that prevents modifications to files/directories, and I'm wondering what are the paths that Cortex needs to be able to modify? For example, when it downloads the latest definitions, what does it need to modify? Is there any data stored in the registry as well?

[gjenkins]

---

@efasoformoso wrote:

We have some systems that are locked-down with software that prevents modifications to files/directories, and I'm wondering what are the paths that Cortex needs to be able to modify? For example, when it downloads the latest definitions, what does it need to modify? Is there any data stored in the registry as well?

---

Hi @efasoformoso,

• For Windows, the Cortex XDR agent installs in the "C:\Program Files (x86)\Palo Alto Networks\Traps" folder. Source: Use Cortex XDR Agent for Windows 
• For Linux, The Cortex XDR agent installs in the "/opt/traps" directory. Source: Use Cortex XDR Agent for Windows 
• For MacOS, there are a number of locations to consider. Please see this document for more information. 

Edit: As for the registry, here are the main locations to note:
"HKLM\SOFTWARE\Palo Alto Networks\Traps"
"HKLM\SOFTWARE\Cyvera"