Traps and Cortex co-existence

[Balaraju]

Thanks in advance for help 

We have few Linux Servers and they have Traps 4.x installed , Traps as you know is previous product of Palo and now its replaced with Cortex XDR .

We wanted to remove Traps and install Cortex XDR 7.x . We wanted to know if we can install Cortex without removing Traps ? as in case of some issues in installation of Cortex , Traps would left undisturbed ? so once Cortex is tested we can remove Traps after that ?

[neelrohit]

Hi @Balaraju ,

Cortex XDR is designed with the same fundamentals carried forward and modernised to next generation of detection and prevention solution. Hence both cannot coexist in any circumstance. Practice recommended steps to follow:

1. Uninstall traps
2. Reboot the endpoint
3. Install Cortex XDR
4. Perform reboot.

Hope this answers your question.

Regards,

@neelrohit 

[Balaraju]

Thanks for your reply . Its very useful . Just one question , is reboot mandatory given its Linux ?

Thanks again 

[neelrohit · Accepted solution]

@Balaraju ,

Traps and cortex both perform kernel level injections on the endpoints for credential theft protection. In order to release/perform the kernel injections,endpoints need to drive into kernel loading which happens only during OS boot time. Hence the reboot requirement.

Hope that answers your question.

[Balaraju]

Thanks lot again .