To perform malware analysis
of ELF files, and collect data for EDR and behavioral threat analysis,
the Cortex XDR agent for Linux requires a supported kernel version of
3.4 or later, as listed in Latest Kernel Module Version
Support.
If you deploy the Cortex XDR agent on a Linux
server that is not running one of the kernel versions required for
these additional protection capabilities, the agent will operate
in asynchronous mode: the agent will obtain a verdict for the executed
ELF file in parallel to its execution and terminate it if a malware
verdict is obtained. In addition, data collection for EDR and behavioral
threat protection will not be supported.
For Cortex XDR agents 7.1 and later releases
deployed on endpoints running kernels RHEL, CentOS, Oracle 8, or
SUSE 15, you must disable UEFI Secure Boot on the machine to enable
synchronous protection. Otherwise, the Cortex XDR agent will operate
in asynchronous mode as explained above.
Software packages
ca-certificates
openssl 1.0.0 or a later release
Distributions with SELinux in enforcing or permissive mode:
Red Hat Enterprise Linux 6, CentOS 6, and Oracle Linux 6—policycoreutils-python
Red Hat Enterprise Linux 7, CentOS 7, and Oracle Linux 7—policycoreutils-python
and selinux-policy-devel
SUSE—policycoreutils-python and selinux-policy-devel
Debian and Ubuntu—policycoreutils and selinux-policy-dev
glibc—Required for exploit protection of containerized processes
using the ROP Mitigation and Brute Force Protection modules. If
glibc is not installed, the modules are disabled but all other exploit
and malware protection functionality work as expected.
CentOS 6.10—Enable the dynamic CA instead of the legacy CA:
