Deploy Cortex
Choose the deployment path, prepare your organization, deploy managed devices and verify a pilot before rollout.
Choose your deployment
| Where Cortex runs | Next action |
|---|---|
| Managed macOS or Windows device | Follow the managed-device instructions below with your IT owner. |
| Headless Linux host | Install Defender locally. It captures configured CLI tools on that host; enroll for managed upload if required. |
| Shared Kubernetes gateway | Deploy Egress Gateway with the platform owner and supplied operating procedure. |
If a gateway is already deployed, connect your AI client with the issued endpoint and personal credential. That client does not need Defender installed. Device placement is separate from data storage and access.
Deploy to managed devices
Your first admin creates the organization, or Chaos Labs creates it and designates that admin. Your admin handles Cortex access; IT controls device distribution and operating-system permissions. Employees sign in and verify their enabled sources. One person may hold both admin and IT roles, but Cortex roles do not grant operating-system or MDM access.
Before you begin
Required
- Organization and admin
Create your organization yourself, or ask Chaos Labs to create it and designate your first admin. See Create your organization.
- Employee notice or consent
Complete any required notice or consent process for monitored AI activity. Contact Chaos Labs if you need a description of what Cortex captures.
- IT owner and deployment procedure
Identify the IT owner. Obtain the approved package, install command, permissions, restart requirements, upgrade procedure, and removal procedure for your organization's device-management system from IT and Chaos Labs.
Get the installer
Sign in at cortex.chaoslabs.xyz with your admin account. Complete organization setup and confirm organization/identity settings. If access fails, contact Chaos Labs before distributing an installer or creating another organization.
Obtain the deployment package
On Fleet, select Get installer. The Install Defender dialog provides the approved installer and its SHA-256 checksum for each operating system. Download the package for the target operating system and architecture; do not assume a filename or package type from an example.
- Download the approved package from Install Defender.
- Compute its SHA-256 checksum with your operating system's checksum tool, using the actual downloaded filename.
- Compare the result with the checksum shown in the dialog. If they differ, discard the download and obtain the package again.
Share a download link with employees
Employees who install Defender themselves can use your organization's download link instead of a package from IT.
- On Fleet, select Get installer.
- Under Share the installer, select Generate download link, then Copy link.
- Send the link through your approved internal channel.
Anyone with the link can download the installers. The page offers macOS (Apple Silicon, macOS 12+) and Windows (Windows 10/11, x64) installers, each with a Verify download checksum. Linux packages are for managed deployments; see Defender on a headless Linux host. After installing, employees open Cortex and sign in with their work account.
Your organization has one active download link. To retire a shared link, select Replace link…, then Replace link. Previously shared links stop working; share the new link with anyone who still needs Defender. Generating a link when one already exists also replaces it.
| The download page shows | Meaning | Action |
|---|---|---|
| A download link is required | The link is missing, invalid, or has been replaced. | Share the current link. |
| Installers are temporarily unavailable | The installers could not be loaded. | Ask the employee to select Try again. If it continues, contact Chaos Labs. |
| Temporarily unavailable for one platform | No installer is offered for that operating system right now. | Select Check availability later, or distribute the package through IT. |
| This installer is no longer available. | The installer changed after the page loaded. | Choose an available platform or try again later. |
Coordinate managed distribution
Follow the approved IT procedure for Jamf, Intune, or your organization's managed distribution system.
After IT deploys the package to a pilot group, give employees their organization domain and Set up Cortex Defender. Choose each capture path from the supported AI tools catalog; platform support does not mean that every source uses the same setup.
Validate a pilot device
Use at least one representative managed device for each target platform:
- Confirm the approved deployment installed Cortex Defender and an employee can open it.
- Complete Set up Cortex Defender, including verification of every source in the rollout.
- Confirm the synced activity appears for an authorized Cortex user.
- Restart any applications named by Cortex, then confirm their capture paths become active.
- Quit and restart Cortex Defender, then verify capture and sync recover.
Expand the rollout only after these checks pass. Installation and On status alone do not prove capture works.
Enrollment issues
If Cortex finds no identity providers, confirm that the employee entered the correct organization domain. The organization admin should verify the identity settings.
If sign-in does not complete, send the organization domain, identity provider, work account, and approximate attempt time to the Chaos Labs team.
Managed-device issues
Browser capture may require permission to change routing or certificate trust. Organization Admin access cannot override keychain, certificate-store, endpoint-security, or device-management policy.
If a Defender error names a local port or process, include those details when contacting the Chaos Labs team. Developers running local services can use Fix Cortex Defender port conflicts.
Rollout and fleet operations
Fleet is limited to organization admins. Use it to:
- Filter endpoints by All endpoints, Capturing, No recent capture, Inactive, Unknown, or Needs attention.
- Check Last contact and Last captured for stale endpoints, then inspect Diagnostics and State for supporting evidence and the current verdict.
- Select Get installer to reopen the organization installer flow.
- Refresh the view after a deployment or repair.
Enrollment and revocation happen outside Fleet. Contact the Chaos Labs team for revocation or other device-lifecycle actions that are not available in Cortex.
Offboard or replace a device
For organization offboarding or service termination:
- Export your organization's Cortex data during the service term or within 30 days after termination.
- Resolve any unsynced local backlog before removing Cortex Defender.
- On each device, open Home → Browser sync → Browser connections and select Turn off routing. Complete any approval or browser restart requested, check the health results, and test direct browser access.
- Select Remove certificate separately and complete any operating-system approval. Confirm that trust has been removed. If the control is disabled or the change fails, ask IT to complete the removal procedure.
- Open Settings → Danger zone, select Stop Defender, review the confirmation, then confirm the stop. Wait for Off, follow any affected-app restart instruction, and test direct provider access before removal.
- Remove Cortex Defender through MDM or the approved device-management path.
Quitting the app is not a substitute for disconnecting it. Confirm direct connections and remove certificate trust before uninstalling.
See Pause and stop capture for capture controls.
Contact the Chaos Labs team before removing a device that has an unsynced backlog or cannot be disconnected normally.
Organization setup
Create your organization
You can set up your organization in either of two ways:
- Create it yourself. Sign in with a Google Workspace account or with your work email address. Personal email addresses cannot create an organization. You also need permission to add a TXT record at your company's DNS provider, or a colleague who can add it.
- Ask Chaos Labs to create it. Chaos Labs creates the organization and designates your first admin.
To create it yourself:
- Open cortex.chaoslabs.xyz and sign in with your work account in one of two ways:
- Select Continue with Google and choose your Google Workspace account.
- Enter your work email in Work email or domain and select Continue. Select Email me a code, enter the 6-digit code from the email and select Verify. The code expires in 10 minutes.
- If your company is not on Cortex yet, continue to Create your organization.
- Check that the account shown is yours, or select Not you? to start again. Enter the Company name, review the URL name and choose Defender or Egress. Select Continue.
- At your DNS provider, add the TXT record shown. Use the copy buttons for the Name and Value. The name is
_cortex-verification.followed by your domain. Publish the record before the time shown next to Publish before. - Select Check DNS and create organization. You become the organization's first admin.
| Message | Action |
|---|---|
| The TXT record has not appeared yet. Try again after DNS updates. | Wait for your DNS provider to publish the record, then select Check DNS and create organization again. |
| The TXT value does not match. Check the published record and try again. | Correct the published value so it matches the value shown, then check again. |
| DNS aliases are unsupported. Publish the TXT record directly at the full name above. | Add the TXT record at the full name shown, not through an alias. |
| Your company is already on Cortex. Sign in with your work account. | Select Back to sign-in and sign in. |
If you stop before the record is published, sign in later with the same account. Cortex restores your company details. If the time shown next to Publish before passes, Cortex shows a new TXT value; replace the earlier value at your DNS provider.
After the organization is created, Cortex opens Fleet for Defender or Connect for Egress. For Egress, an admin first adds the company's provider key. Members then send a first request with a personal token; Egress needs no Defender installation or Atlas.
People at your company then sign in with their work account: with Google, with your company's single sign-on, or with a code sent to their work email.
Review your organization
After the organization and its first admin exist, review the organization name/logo, workspace domain and identity settings, and imported people. Then authorize the first workplace app and coordinate the device pilot with IT.
This 3:08 recording follows those steps. Its app count and installer wording are outdated; use the current app guides and organization-issued package instructions above.