> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/8.x/8.8-eol/cortex-xdr-agent-8.8-release-information/features-introduced-in-cortex-xdr-agent-8.8.md).

# Features introduced in Cortex XDR agent 8.8

The following section describes the new features introduced in Cortex XDR agent 8.8 releases according to the supported agent operating systems. The release is divided into three deployments, 27 April 2025, 11 May 2025, and 18 May 2025.

#### General features

The following is added to Cortex XDR agents.

| Feature                                       | Description                                                                                                                                                                                                 |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Performance                                   | General performance improvements for policy calculation.                                                                                                                                                    |
| Enhancements made to improve VDI performance. |                                                                                                                                                                                                             |
| Cipher-Suite for ENS Spain                    | Added support of Cipher-Suite for ENS Spain.                                                                                                                                                                |
| Recommended alert/issue exceptions            | To enable you to refine your BTP alert/issue exceptions, Cortex XDR/XSIAM now automatically generates more rule exception parameters based on alert/issue information and Cortex XDR/XSIAM recommendations. |

#### Linux features

The following is added to Cortex XDR agents running on Linux endpoints.

| Feature                                                     | Description                                                                                                                                                                                  |
| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enhanced ML model for detecting malicious Linux executables | Advanced high-accuracy detection of malicious Linux executables using a local analysis model that leverages big data, ML, and threat analysis across both on-premise and cloud environments. |
| APISec on Agent                                             | Enhancements and improvements are provided for API security functions.                                                                                                                       |

#### Windows features

The following is added to Cortex XDR agents running on Windows endpoints.

| Feature          | Description                                                                                                                                                                                                    |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| VBscript support | Strengthened defense against advanced threats by using an ML-based protection model for the XDR Agent on Windows that can detect and prevent adversary techniques using VBscript files at the execution stage. |

#### Mac features

The following is added to Cortex XDR agents running on Mac endpoints.

| Feature         | Description                                                |
| --------------- | ---------------------------------------------------------- |
| Cytool commands | Additional macOS cytool commands have been made available. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/8.x/8.8-eol/cortex-xdr-agent-8.8-release-information/features-introduced-in-cortex-xdr-agent-8.8.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.