Cytool for Windows
To manage Traps functions from the command line on Windows
endpoints, use Cytool.
Cytool is a command-line interface (CLI) that is integrated
into the Cortex XDR agent and enables you to query and manage both
basic and advanced functions of the agent. Any changes you make using
Cytool are active until the agent receives the next heartbeat communication
from Cortex XDR.
On Windows endpoints, you can access Cytool using a Microsoft
MS-DOS command prompt that you run as an administrator. Cytool is
located in the
C:\Program Files\Palo Alto Networks\Traps
folder
on the endpoint.The following table displays the Cytool options available on
Windows endpoints.
Starting with the Cortex XDR agent 7.6 release
for Windows, the new
cyserver.exe
process
includes and replaces the previous CyveraService.exe
, tlaservice.exe
,
and twdservice.exe
high-privileged
processes.Command Option | Password Required | Description |
|---|---|---|
enum | 
| Enumerate protected processes. Usage: cytool enum For
example:
If you change the action
mode for protected processes in the Exploit Security Profile in
Cortex XDR, you must restart the protected processes for the security
policy to be enforced on the processes and its forked processes,
and only then you will see them on this list. |
protect |
| Enable or disable a protection feature. Usage: cytoolprotect <action> <feature> where:
For
example:
|
startup |
| Enable, disable, or query the startup state
of the Cortex XDR agent components. Usage: cytool startup <action> <component> where:
For example:
|
runtime |
| Stop or start product components. Usage: cytool runtime <action> <component> where:
For
example:
|
policy |
| Query or compare the applied policy for
a process. Usage: cytool policy <action> <process> where:
For example,
to query the policy for future executions of notepad.exe:
For example, to compare the policy for future executions
of notepad.exe to the default policy:
|
trace |
| Operate product trace sessions. Usage:
|
quarantine |
| View and restore quarantined files. Usage:
|
stat | — | Query Cortex XDR agent statistics from a running
process. Usage: cytoolstat <pid> where <pid> For example, to display statistics about
the Chrome process identified by PID 4080:
|
tla |
| View the history of the agent local analysis
module. Usage: cytool tla query For
example:
|
info | — | Display general Cortex XDR agent information. Usage: cytool info [query] To
display the agent version, run the cytool info command
without any additional arguments. To display additional details
about the agent, such as the version of the default policy and the
specific build number, add the query argument. For example:
|
wf | — | Local verdicts cache operations. Usage: cytool wf query [<hash>]
|
image | — | Display information about a PE file (executable
or DLL). Usage: cytool image <filename> For
example:
|
imageprep |
| Prepare a golden image by submitting files
for cloud analysis and generate a threats report. Usage: cytool imageprep [scan] [timeout <scan timeout> ][upload <upload timeout> ] [path <full path> ]where:
For
example:
|
scan | — | Scan operations. Usage: cytool scan <action> where <action>
For example:
|
persist |
| The Cortex XDR agent stores policy and security
event information, such as the list of trusted signers, local verdicts,
and one-time actions in local databases on the endpoint. To troubleshoot policy
issues and security events, you can use cytool persist operations to
import, export, and view information stored in the local database. Usage: cytoolpersist <action> where <action>
To view
a list of all local databases, use the cytool persist list command.
|
log | — | Set log level for the desired process. Usage: cytool log set_level <log_level> <components> where:
Then
use the cytool log collect command to generate
a support file archive of all logs in a TGZ file. |
checkin | — | Initiate check-in to the server. Usage: cytool checkin To
verify the checkin, view the check-in time on the agent console. |
last_checkin | — | Display the time of the last successful check-in. Usage: cytool last_checkin For
example:
|
edr | — | EDR operations. Usage:
|
payload_execution |
| Stop or query payload execution status. Relates
to Live Terminal and script execution. Usage:
|
websocket | — | Display current websocket connection status. Usage: cytool websocket query For
example:
|
reconnect |
| Try reconnecting to the server if communication
has been disabled, or force registration with a new distribution_id .Usage:
|
vdi |
| Perform VDI operations. Usage: cytool vdi <operation> where <operation>
For
example: |
proxy |
| Set or query cloud-defined proxies for the
agent. Usage:
|
event_collection |
| Start or stop event collection (EDR/DSE). Usage: cytool event_collection <operation>
|
isolate |
| Release endpoint from network isolation. Usage: cytool isolate stop |
