When troubleshooting performance or third-party software compatibility issues on an endpoint, administrators use the specialized cytool CLI utility to manage internal agent processes.
The Command Mechanism: Running cytool runtime stop instructs the Cortex XDR agent to temporarily disable or shut down its active real-time protection engines and background services (such as the main supervisor and driver modules).
Security Note: Because the agent is protected against tampering, executing this command from an administrative command prompt typically requires you to first provide the unique uninstallation/protection password generated by the Cortex XDR management console.