Cortex 7.7.2 Deploy via JAMF

[sharif_khan]

Hi Everyone

I hope this document will help everyone who use Cortex in their environment for mac and manage via JAMF Pro. You can deploy cortex via Jamf. It is pretty simple and straight forward. All you need to follow PaloAlto Networks document: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-.... Here you will find they have already pre-configure MDM profile for Cortex one for M1 and another one for non M1. you will get all those here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-.... After download unsigned one upload to your Jamf pro and make some changes as required and follow the document if needed.

After upload profile scope your machine to have them on endpoint before cortex install to avoid user interaction and also connect cortex console with end points. Once you have profile at the endpoint you can push the cortex policy to the endpoint. For deploy Cortex 7.7.2 you can follow this document: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-.... If you download pre-configured Profile then you can avoid all the steps till step 9 and then go ahead create policy with the package .zip file which you should get from your security team or cortex mgt. console. you can upload .zip file (don't extract it) to your distribution point and add to the policy. Scope your target and then you are done.

[sharif_khan · Accepted solution]

Hi @Shaw69 

Step One: You need upload Cortex Unified Profile to your Jamf

Step Two: Scope target to deploy profile But before that you need to create two different Smart Group One for M1 and another for non M1.

Step Three: Create a policy with .Zip file for cortex deployment

Step Four: Scope the target group and you done.

Detail document is: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

[sharif_khan]

This Topic I post as a Solution for everyone. So please let me know if anyone face any issue to deploy that your environment.

[rfeldtz]

how does this actually install if it is in a compressed zip file? i have the configuration profile created and it deploys correctly.  but i dont see how just putting a zip file on the system will allow the software to install since the pkg for the installer is inside and requires input if ran individually. 

[sharif_khan]

.zip file should work. It is working for me fine. I upload .zip file on my Jamf pro admin tool.

[rfeldtz]

yes, i uploaded to through jamfadmin site but how is it deployed to the user afterwards? or does the physical software not need to be installed?

[sharif_khan]

Yes you need to deploy that .zip file via a policy to mac endpoints. You need to use that .zip file as package.

[sabastaj]

Hi All ,

How do we disable tamper protection for cortex xdr ? any idea

Regards

Ajay

[sharif_khan]

Why you need disable tamper protection. Can you please provide a little more? what you are trying to do. I don't have to do anything for that.

[sabastaj]

I am trying to update the cortex  version 7.8.1  for the all the macs in the estate while executing the policy i am getting this error 

Installation failed. The installer reported: Self Prot state: enabled
installer: Error - Disable agent tampering protection and run this installation package again.

[sharif_khan]

Hi @sabastaj 

You can use following script to disable cortex via Jamf

echo $4 | sudo "/Library/Application Support/PaloAltoNetworks/Traps/bin/cytool" runtime stop all

Here you have to pass Cortex password on $4 variable. If you need help on that you can search how to pass variable via JAMF with policy. Or you can partner with your Cortex admin to get cortex password.

Another thing why you need use Jamf to upgrade cortex. You guys can do upgrade via Cortex console to upgrade and that should work if you have unified profile installed on the endpoint. 

[sabastaj]

thanks for this info this helped will let you know if i need anything 

[sharif_khan]

@sabastaj I just perform upgrade from cortex console that worked great on macOS Monterey and also Ventura. So you should be good if you use unified profile and push upgrade from console. But still you need to package for new version that way your newly Image machine will get new package. Let me know if you have any more question on this.

[kwoodard]

My Cortex guy absolutely HATES updating devices via the console and won't give me access to do it myself. I am hoping that he will give me the password to do this via Jamf. It's maddening when he tells my boss I need to update all the Mac's, but won't give me access or the password.

[sharif_khan]

Unfortunatley if you want to update then you will need the password. You can script out that and pass as variable via Jamf. Otherwise your cortex guy need to update from console,

[Ninyo]

Correct me if I'm wrong, but as long as I'm running macOS 12 and up, all T2, I don't need the Intel version of the profile, right? No point in Kernel Extension approvals, it is all System Extension now.

[sharif_khan]

@Ninyo yes, you will not need Intel profile and Kernel Extension. All you will need only one profile which you can download from palo page.

[macguitarman]

Ok, something is up (as in not working)... I have the profile all set, but I do not have a .zip file, but a PKG, and I think that is at least one issue...I can see CXDR in the menu, but not activated / enabled...

[sharif_khan]

You have to use the .zip file because there has some other related files which required for this deployment.

[macguitarman]

I just re-packaged in Composer to a temp directory with the install pkg command in a postinstall script. The old install the installer and invoke dance. Installs great. Same with Global Protect, but have to include the xml apply choices as well for that…. Lots of security agent software vendors do this for whatever reason: Palo Alto Networks, Fire Eye, Nessus….

[sharif_khan]

@macguitarman .zip works well and didn't need to use composer to package cortex and not any postscript. Only script I used to deactivate installed cortex before run the installer.

[kwoodard]

@sharif_khan , what script do you use for deactivating cortex? That would be a script that I would find useful.

[macguitarman]

There is a tool in the cortex /bin folder, I’ll get that path and script to you in a bit. You have to have the uninstall password. I get some errors in the script when run manually, but the end result is the process is stopped and the app and pieces are removed… I am debugging the script, I’ll get it to you soon….

[sharif_khan]

It is on this thread if you scroll up. But here I paste that again for you.

You can use following script to disable cortex via Jamf

echo $4 | sudo "/Library/Application Support/PaloAltoNetworks/Traps/bin/cytool" runtime stop all

Here you have to pass Cortex password on $4 variable. If you need help on that you can search how to pass variable via JAMF with policy. Or you can partner with your Cortex admin to get cortex password.

Another thing why you need use Jamf to upgrade cortex. You guys can do upgrade via Cortex console to upgrade and that should work if you have unified profile installed on the endpoint. 

[kwoodard]

Thank you! I wish there was a way to do this without the password. Our Cortex admin won't give it out.

[sharif_khan]

For update you have to use password with cytool command. Otherwise, your cortex needs to update them from cortex console.for new install you don't have to use cortex password, I hope that gives your ans.

[a_bautista]

Since Jamf admin has been deprecated, I haven't been able to deploy new cortex agent installs since Jamf sync doesn't appear to support files other than .pkg.   and the agent installs are downloaded as a .zip Per Cortex deployment guide, I'm not supposed to decompress the agent install either.  This wasn't an issue in the past since Jamf admin accepted zip files from what I can recall.  Has anyone been successful at deploying Cortex agents with the new work flows?  If so, would you mind sharing your process ?  I will also reach out to reach out to PaloAlto support.

[kwoodard]

Have you tried uploading the files using the Jamf web access?

[a_bautista]

Do you mean under settings>computer management?  Yes, I tried.  It appears to only accept .pkg files, if thats what you mean by web access?  Please clarify if I misunderstood.

[a_bautista]

This is resolved.  I was able to upload a zip via web and deploy the agent. Thanks for your response.