Cortex XDR Collector

Cortex XDR Collector: what it is

Cortex XDR Collector is Palo Alto Networks’ software for collecting logs and data on a Windows or Linux machine and sending them to Cortex XDR. It does not detect or respond to threats itself: it moves log data from servers, files and network sources into the Cortex XDR tenant, where the detection and analytics run. It is a separate package from the Cortex XDR endpoint agent.

It is commercial software. Palo Alto’s installation pages state that ingesting logs and data requires a Cortex XDR Pro per GB licence, and the installation package is created and downloaded in the Cortex XDR console. This page is a practical summary of the official documentation; we have not tested the collector ourselves (Not tested yet).

Cortex XDR Collector at a glance

XDR Collector requirements

Linux

• 2.3 GHz dual-core CPU, x86 64-bit; kernel 2.6.32 is listed.
• 4 GB RAM (8 GB recommended) and 10 GB of disk space.
• Supported distributions in the documentation: Red Hat Enterprise Linux 6 (6.7 and later), 7, 8, 9 and 10.0; SUSE Linux Enterprise Server 12 and 15; Ubuntu Server 12, 14, 16, 18, 20 and 22; Oracle Linux 6 (6.7 and later), 7, 8 and 9.
• Packages: standard Unix programs, ca-certificates and OpenSSL 1.0.0 or later. If SELinux is enforcing or permissive, extra SELinux packages are needed; the documentation lists them per distribution.

Windows

• Dual-core minimum (Intel Pentium 4 or AMD Opteron/Athlon 64 class with SSE2).
• 2 GB RAM, 200 MB of disk space at minimum and 20 GB recommended.
• The supported Windows versions depend on the collector release. For XDR Collector 1.5.x the documentation lists Windows 10, Windows 11 and Windows Server 2012 (support ends October 2026), 2012 R2, 2016, 2019, 2022 and 2025.

How to install XDR Collector on Linux

1. In the Cortex XDR console, create and download an XDR Collector installation package (RPM, DEB or SH). Palo Alto recommends RPM or DEB.
2. Upload the package to the Linux machine and extract it, for example tar xvf <installation_package_name>.rpm.
3. For RPM or DEB installs, create the configuration folder and copy the configuration file: sudo mkdir -p /etc/panw and sudo cp ./collector.conf /etc/panw/.
4. Install the package: yum install ./<file_name>.rpm or rpm -i ./<file_name>.rpm on RHEL, Oracle Linux and SUSE (zypper install); apt-get install ./<file_name>.deb or dpkg -i ./<file_name>.deb on Ubuntu and Debian. For the SH installer, run chmod +x <file_name>.sh and then run the script as root.
5. Confirm the install with rpm -qa | grep xdr-collector or dpkg -l | grep xdr-collector.

On Windows the documentation describes two routes, the MSI installer and msiexec; follow the matching page in Palo Alto’s documentation for the exact command line. What the collector gathers is set afterwards in an XDR Collector profile in the console, not in the installer.

XDR Collector proxy settings

On Linux, pass --proxy-list "<proxyserver>:<port>" to the installer. Several proxies can be given as a comma-separated list, using either a host name or an IP address. For RPM or DEB installs, put the same parameters in /etc/panw/collector.conf before you install. The documentation states that the collector does not support proxies that require authentication.

Troubleshooting

• The collector will not connect: check the machine’s internet connection and that TCP 443 to the Cortex XDR server is allowed. If it still fails, confirm that the installation package has not been deleted from the Cortex XDR console.
• The SH installer or upgrade fails: the /tmp folder must not be mounted noexec. Run mount -o remount,exec /tmp before installing or upgrading.

FAQ

What are the XDR Collector requirements?

On Linux: a 2.3 GHz dual-core x86 64-bit CPU, 4 GB RAM (8 GB recommended) and 10 GB of disk. On Windows: 2 GB RAM and at least 200 MB of disk (20 GB recommended). Both need TCP 443 to the server by default. The list of supported operating systems depends on the collector version, so check the current documentation.

How do I install the XDR Collector?

Create the installation package in the Cortex XDR console, copy it to the machine and install it with the package manager (RPM, DEB) or the SH script on Linux, or with the MSI or msiexec on Windows. The Linux steps are listed above.

Does the XDR Collector support a proxy?

Yes, through the --proxy-list option on Linux, but not proxies that require authentication.

What is the XDR Collector service name?

On Linux the service is called xdr-collector. The shell installer example in the documentation starts and enables it as a systemd service.

Is the XDR Collector the same as the Cortex XDR agent?

No. The Cortex XDR agent is the endpoint protection component and has its own requirements pages. The collector is a separate package for collecting logs and data from a machine or from other sources.

Is the XDR Collector free?

No. Ingesting logs and data requires a Cortex XDR Pro per GB licence, and the installation package is created in the Cortex XDR console.

Sources

• XDR Collector machine requirements and supported operating systems (Palo Alto Networks)
• Install the XDR Collector installation package for Linux (Palo Alto Networks)
• XDR Collectors 1.5.2 release notes (Palo Alto Networks)