Cortex XDR Agent & MDE

[L.Hedding]

I am trying to install Cortex Agent and MS Defender for Endpoint on a Windows Server. We have managed to get them to run in parallel on Windows 10, but are failing to get it work properly on Windows. The bit that is not working is pulling down the AV settings from the MDE console. I have been told to add exclusions into Cortex, and I have added some in there, but it is still not working. Does anyone have some secret sauce that will get them to work happily together?

[jamy456harden]

Getting Cortex XDR Agent and Microsoft Defender for Endpoint (MDE) to coexist on Windows Server is possible, but it is significantly more fragile than on Windows 10. On Server SKUs, Defender’s behavior is much more sensitive to real-time antivirus contention and platform mode mismatches. When another EDR or AV product takes partial control of real-time protection, Defender may silently fall out of its expected operating mode. A common side effect of this condition is that Defender stops pulling or applying AV policies from MDE, even though the MDE sensor itself remains onboarded and healthy. This issue is well-known in environments running dual EDR solutions on Windows Server and typically requires careful coor   transunion credit