new feature in the Cortex XDR agent 8.3, Agent Certificates

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

new feature in the Cortex XDR agent 8.3, Agent Certificates

L0 Member

hi

i have cortex xdr on several endpoints, can you explain me more about the new feature Agent Certificates and its implication and how to work? i want to set enabled this function because is disabled for old tenants

6 REPLIES 6

L3 Networker

Dear @sebasnova , 

 

Hope you are doing well and thank you for reaching out to the live community. From the above query I understand that you have a query around our new changes to the Agent Certificates. 

 

Please note to improve security, the Cortex XDR agent 8.3 is now ensuring the use of a provided certificate without using the local fallback store (trusted root CA file). In order to graduate the adoption of this requirement, Disabled (Notify) is default for existing tenants; new tenants will have the Enabled configuration by default.

 

This means that for the new tenants Palo alto networks will be providing the certificate and we will not be relying on the fallback store anymore. For tenants who has not enabled this will be notified by the banner when they login to the portal. More information can be found in the link provided below, thank you: 

 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.3/Cortex-XDR-Agent-Release-Notes/Changes-to-...

 

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Hi,thanks, but

one cuestion more, What was the local certificate used for?

L1 Bithead

Hi @abdrahman ,

Can you explain what is the use of Local certificate.

Does it uses during agent installation on Windows for authenticity or something else...?

If yes, then PA certificate going to be installed via Agent on windows machine. Please provide some more detailed information.

Hello @Lakshminarayan  @sebasnova ,

 

Previously the agent does not validate which certificate is used to sign the traffic, as long as it is validly signed. Hence Validating the signer, using Root CA Local certificate store makes the agent vulnerable to Man In The Middle attacks.

 

This feature is created as a security effort to mitigate Man In The Middle attacks.By enabling the feature, customers can decide not to use the Local Root CA certificate Store anymore and use only the pinned roots.pem certificate file, this way protecting from Man In The Middle (MITM) attacks.

 

In case due to any reason, agent is not able to use roots.pem, it will fall back to local CA and will make the agents Partially protected.

 

If this post answers your question, please mark it as the solution. 

Ashutosh Patil

Hi Ashutosh,

Thanks for the detailed explanation. In short if my understanding is correct then agent will push roots.pem certificate to windows machine which will be used to validate the traffic.  

 

Hello @Lakshminarayan ,

 

You can find certificate in the below location:

Windows "C:\Program Files\Palo Alto Networks\Traps\config\roots.pem”

macOS “/Library/Application Support/PaloAltoNetworks/Traps/config”

 

If this post answers your question, please mark it as the solution. 

Ashutosh Patil
  • 2746 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!