thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Cortex XDR Agent

The Palo Alto Networks endpoint agent that provides prevention, detection and response capabilities for Cortex XDR.

Definition

The agent enforces security profiles for malware protection (including WildFire analysis and local analysis), exploit protection, behavioral threat protection, restrictions and device control. It collects EDR telemetry when the Pro license is used. Policies are assigned through endpoint groups and policy rules.

Example

An exploit protection profile blocking a heap spray attempt against a browser process.

Exam tip

Profiles (malware, exploit, restrictions, agent settings) are attached to policies that target endpoint groups.

Related terms