Install Cortex Defender

Already installed? skip to sign-in.

Before you begin

Install Defender

Get the installer in one of these ways:

• Install the package supplied by IT.
• Open the download link your Cortex admin shared and select Download for macOS or Download for Windows. If the page shows A download link is required, ask your admin for the current link.
• As an admin, open Fleet and select Get installer. In Install Defender, choose the Device platform, download the package and verify its checksum; see Obtain the deployment package. To share it, select Generate download link under Share the installer, then Copy link, and send the link to employees.

Run the installer, then sign in below. Linux hosts use managed deployment. IT can deploy Defender across managed devices.

Open Cortex and sign in

1. Open Cortex. On Welcome to Defender, select Get started.
2. On Connect this Mac to your workspace (Connect this PC on Windows), enter your Organization domain, the part after @ in your work email.
3. Select Continue with your company's identity provider, or Sign in with email. If no Continue with button appears for your domain, select Sign in with email.
4. Complete sign-in in the browser. With Sign in with email, select Continue with Google, or enter your work email, select Continue, then Email me a code and enter the code. Select Connect on Connect the Cortex app. Return to Defender. An enrolled device may go directly to Choose your connections.
5. If Defender does not connect, the browser page shows a token. In Defender, select Have a token? Paste it, paste the token and select Connect with token.

If sign-in fails, share the domain, sign-in provider and approximate attempt time with your Cortex admin. If you are the admin, send them to support@chaoslabs.xyz.

Connect your AI tools

1. On Choose your connections, select your apps, including Browser connections if needed, then Review setup.
2. Review the changes. Select Set up connections when browser sync is included, or Connect 1 for one app. The button reflects the selected count. Wait for the setup result and follow any recovery or restart instruction.
3. Send a new prompt and select Check activity. Activity captured confirms recent activity on the device. For No activity yet or Couldn't check activity, review setup and select Check again.
4. Select Continue, then Open dashboard on You're set up or Some connections need attention. Inspect unresolved connections on Home.

Skip setup finishes onboarding without connecting sources. Add them later through Manage app connections.

Set up browser sync

Follow the routing and certificate actions offered during setup, including Check status, Trust certificate, Replace certificate or Turn on browser sync. Approve system prompts only when permitted by device policy. Select Do this later to defer setup; return through Home → Browser sync → Browser connections. See Set up browser sync for health checks and recovery.

Verify capture and sync

1. On Home, open the configured app. Read Sync status and Health, select Check health. Wait for a successful health-check result before continuing; follow any recovery action and repeat the check.
2. Test each source separately. Send a new prompt, finish a completed conversation in Cursor IDE, or run a configured local MCP tool. Record the tool and test time. Restart only the apps or browsers Defender names; configure local MCP with your Cortex team.
3. Review Last seen or Synced activity for local observation. Recent activity confirms observation on this device. In Cortex Atlas, find the matching person's prompt, conversation or tool activity.

The matching record in Atlas confirms workspace delivery and attribution. A Connected state or successful configuration check alone does not identify that record. For missing delivery, check workspace identity and Troubleshooting.