What is the difference in function between the Global Protect Content Filter and the Cortex XDR content filter

[MMoerman]

On Mac (but I assume something similar exists on PC), both Cortex XDR and Global Protect install a content filter agent. What is the differnce in function between these 2 agents? If I remove the Global Protect agent do I still benefit from the same level of protection solely with the Cortex XDR agent?

[JayGolf]

Hi @MMoerman ,

The GP content filter agent is when you enable "Enforce Global Protect Connections for Network Access". So the content filtering is based on the capabilities that you set via the firewall. On the other hand, Cortex XDR agent provides endpoint protection. 

[MMoerman]

Does that mean Global Protect content filter protects from an outgoing connection perspective and Cortex XDR from an incoming perspective? "Enrpoint Protection" is a rather all encompassing term and doesn't tell me what the Cortex Content filter really does as opposed to the GP one.