Pop-up message for "Cortex XDR" program


MacOS 10.13 and later versions
  Allow Cortex XDR to install system extensions:

  • In the System Extension Blocked warning, select Open Security Preferences


    When you are installing the Cortex XDR agent on an endpoint, this warning displays twice: first for the System Extension and then for the Network Extension. However, in both warnings, the operating system displays System Extension Blocked. In both pop-ups, select Open Security Preferences
  • Go to System Preferences>Security & Privacy>General and select Allow


  • After the installation completes, verify your connection.
    • To open the Cortex XDR agent console, click the agent icon in the menu bar, and select Open Console
    • Check In Now to initiate a connection with your tenant of Cortex XDR. If successful, the Last Check-In field updates to display the recent check-in date and time.


      If the Cortex XDR agent does not connect to Cortex XDR, verify your internet connection and perform a check-in on the endpoint. If the agent still does not connect, verify the installation package has not been removed from the Cortex XDR management console. 

  • Grant full disk access.
    • Due to changes in the security settings of macOS 10.15, you must allow the Cortex XDR agent full disk access on your endpoint to enable full protection. If you do not authorize the agent full disk access on your endpoint, the agent provides only partial protection of files in the /Applications
      • Go to System Preferences>Security & Privacy> tab, and select Full Disk Access
      • To make changes, click lock icon ( mac-settings-lock-icon.png ) on the bottom left, enter your credentials, and Unlock
      • mac-full-disk-access.png


Article ID: 108430
Tue 5/26/20 6:57 AM
Wed 5/4/22 8:43 AM