The Cortex XDR agent protects Windows endpoints by preventing known and unknown malware from running on those endpoints and by halting any attempts to leverage software exploits and vulnerabilities. The agent enforces Security policy for your organization as defined in Cortex XDR. When a security event occurs on an endpoint, the agent collects forensic information about that event that you can use to analyze the incident.