> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information/features-introduced-in-cortex-xdr-agent-8.9.md).
# Features introduced in Cortex XDR agent 8.9
The following tables describe the new features introduced in Cortex XDR agent 8.9, according to the supported agent operating systems. The release will be divided into three deployments, 20 July 2025, 03 August 2025, and 10 August 2025.
#### General features
| **Feature** | **Description** |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Flexible control over automatic agent upgrades | Gain granular control over agent upgrades by setting automatic upgrade schedules for each endpoint profile, creating a safer, more efficient upgrade workflow that minimizes disruption while keeping your security up-to-date. |
| BAS (Breach and Attack simulation) tools | An enhanced handling of BAS tools is incorporated, adding heightened security when detecting malicious processes. |
#### Linux features
The following is added to Cortex XDR agents running on Linux endpoints.
| **Feature** | **Description** |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Kernel module examination in Linux | Detect and prevent malicious kernel modules from being loaded in Linux, stopping sophisticated attacks. |
| Improved Adaptive Policy Mechanism | Cortex XDR agent 8.9 implements an improved, robust and granular Adaptive Policy mechanism that adds an additional safeguard from overconsumption of memory or CPU resources. |
| Linux cloud distribution | Support added for Amazon Linux 2023 (aarch64) |
| Linux operating systems | Support added for Red Hat Enterprise Linux 10 (x86\_64 and aarch64) |
#### Windows features
The following is added to Cortex XDR agents running on Windows endpoints.
| **Feature** | **Description** |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enhanced driver threat prevention for Windows | Strengthen your defense against driver abuse by gaining unique visibility into user-to-kernel interactions to detect and block privilege escalation attempts at the source. |
| VBScript file examination | Added the capability to detect malicious VBScript files being written to disk. |
#### MacOS features
The following is added to Cortex XDR agents running on MacOS endpoints.
| **Feature** | **Description** |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Network Packet Inspection for macOS | Enhance security and enrich EDR telemetry by detecting and preventing malicious network activity directly from macOS endpoints, providing comprehensive visibility and an additional layer of protection against threats. |
#### Changed behavior
| Feature | Description |
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| BAS (Breach and Attack simulation) tools | Changed product behavior, when BAS (Breach and Attack simulation) tools are identified.
Currently, only the simulation itself is terminated, while the BAS tool continues to run.
New Behavior: BAS tools will be treated like any other malicious process, unless the new BAS tool mode in malware profile is switched on.
|
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information/features-introduced-in-cortex-xdr-agent-8.9.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.