---
title: "Plugins: Management"
slug: "manage-plugins"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/manage-plugins"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Plugins

The Linux Endpoint Detection and Response (EDR) sensor is composed of the core daemon (cfsvcd) and plugins. The daemon is responsible for core capabilities, whereas plugins provide specific, targeted capabilities.

Plugins are obtained dynamically from the Zscaler MDR Cloud, once the sensor has been installed and the daemon is running successfully. The daemon utilizes the plugins as needed.

## Supported versions

Zscaler MDR supports plugins v 1.2.0. and higher, which include the following:

- Process Memory Integrity (PMI)
- Behavioral Rootkit Detection
- Response Actions

## Disable plugins globally

1. In the Zscaler MDR portal, click **Integrations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/19757243529239.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A01Z&se=2026-11-09T13%3A08%3A01Z&sr=c&sp=r&sig=fl9Qq%2F90xqfgKkPs%2BCrr2JNMFS7uhVnOMaxBrI%2FYOgo%3D)
2. From the menu select **Canary Forwarder (Linux EDR)**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/forwarder.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A01Z&se=2026-11-09T13%3A08%3A01Z&sr=c&sp=r&sig=fl9Qq%2F90xqfgKkPs%2BCrr2JNMFS7uhVnOMaxBrI%2FYOgo%3D)
3. A new window opens, displaying enabled and disabled plugins. Click to disable the desired plugins.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/plug ins.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A01Z&se=2026-11-09T13%3A08%3A01Z&sr=c&sp=r&sig=fl9Qq%2F90xqfgKkPs%2BCrr2JNMFS7uhVnOMaxBrI%2FYOgo%3D)

## **Turn off a specific plugin**

1. From the navigation menu click **Endpoints**, and select the endpoint you want to change.
2. Click **Disabled** for each plugin you wish to turn off.

## Endpoint management

1. To override Global Plugin Settings, or to enable/disable a plugin for an individual endpoint, click on **Endpoints** from the navigation menu, and then click on a specific endpoint’s page.

![Endpoint_management.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10937998892951.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A01Z&se=2026-11-09T13%3A08%3A01Z&sr=c&sp=r&sig=fl9Qq%2F90xqfgKkPs%2BCrr2JNMFS7uhVnOMaxBrI%2FYOgo%3D)
2. Navigate to the plugins section. Select the option needed for the plugin.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/disable1.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A01Z&se=2026-11-09T13%3A08%3A01Z&sr=c&sp=r&sig=fl9Qq%2F90xqfgKkPs%2BCrr2JNMFS7uhVnOMaxBrI%2FYOgo%3D)

> **Note**: It is not possible to disable plugin updates at this time.