With the new Case timeline record APIs, you can retrieve timeline records for a specified case with support for filtering, sorting, and pagination, and add new timeline records to capture case-related events and updates.
For implementation details, see:
• Retrieve case timeline records
• Add a case timeline record
The new API endpoint returns Least Privilege Access (LPA) recommendations for an asset based on its existing IAM policies or roles.
The endpoint analyzes the asset's activity during a specified lookback period and recommends the minimum set of existing IAM policies or roles required to preserve all observed actions. Use the returned policy or role configuration snippets to remediate over-privileged identities and implement least privilege access.
The new endpoints enable you to programmatically identify assets that can be added to or removed from an application, apply manual asset overrides, review override history for auditing and asset lineage, and revert changes using an actionId. These APIs help ensure applications accurately reflect their associated assets while providing full traceability, accountability, and rollback support.
- List addable assets
- List removable assets
- Add or remove assets
- List override actions
- Revert asset override action
Accelerate vulnerability remediation across your container fleet with a new smart upgrade intelligence summary on container image asset cards. For every registry container image, Cortex Cloud now automatically identifies the underlying base OS image and evaluates newer, more secure versions already approved within your corporate registry. Cortex Cloud calculates a container image migration score which weighs security posture improvements against potential operational risks, and automatically recommends the optimal upgrade path with the highest security yield and lowest friction.
In addition, for each vulnerability, Cortex Cloud identifies if the vulnerability is derived from the base OS image or if it was added by the developer as part of the application. By clearly isolating the scope, infrastructure and development teams can filter vulnerabilities to determine exact ownership. This ensures the right team can act quickly to upgrade a specific application package or roll out a new base OS image.
| | View container image assets by registry, repository, and tags | For better identification and isolation of specific container image assets, you can now filter by registry, repository, and tags when viewing assets in the asset inventory or exporting lists of assets. You can also query registry, repository, and tag information in the Cortex Data Model (XDM) when you run XQL queries. The new Cortex Data Model fields are xdm.image.container\_registry\_url, xdm.image.repository, and xdm.image.repo\_tag. | | Improved stale asset identification and removal | Cortex Cloud now features enhanced capabilities that optimize how stale or inactive assets are identified and removed across your environment to maintain a highly accurate asset inventory. This minimizes asset noise and reduces management overhead for security teams, ensuring your asset inventory provides precise, up-to-date enterprise visibility. | | Asset hierarchy visibility |Investigate and scope cloud assets the way your organization is structured. The asset inventory now displays the full cloud hierarchy path for assets across Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud Infrastructure, allowing you to use Hierarchy Path to filter, sort, search, or build asset groups and enforce Scope-Based Access Control (SBAC).
Asset hierarchy data is only available if you onboard your cloud environment using organization-wide or root-level onboarding; it does not apply to environments configured with single-account or individual onboarding.
| | Azure resource group visibility in the asset inventory | Filter, search, and audit your multi-cloud inventory by Azure resource group fields natively captured within the asset inventory. This resource metadata allows you to track cloud assets by their precise deployment boundaries, build custom asset groups, and enforce Scope-Based Access Control (SBAC). | ## Attack Surface Management | FEATURE | DESCRIPTION | | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Frontier AI-informed detection coverage | Expand protection with new detections shaped by frontier AI attack research. These detections help identify exploitable weaknesses and exposures across external attack surfaces. | | Asset graph relationships for cloud and ASM data | Understand your security risks clearly by visualizing how your attack surface and cloud assets interact. We mapped external attack surface data to your cloud resources, allowing you to build custom graph searches across AWS EC2 instances, Azure VMs, and Google Compute Engine VMs. | ## Automation | FEATURE | DESCRIPTION | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Search playbooks by content pack | Find playbooks faster by filtering the Playbook Catalog by content pack. The Search by filter in the Playbook Catalog now includes a content pack option to find playbooks that belong to a specific content pack. | | Mark playbook tasks as timeline records | Track investigation milestones seamlessly directly from your case timeline. You can now edit specific playbook tasks to display their actions as case timeline records, matching your exact workflow naming conventions, and tag them as evidence to capture critical discovery details at the case level. | | Compute unit tracking for agentic requests | The Compute Units page now displays the evaluated compute cost for each agentic request to help you plan future resource allocations and understand the full ROI of your AI tools. These entries provide visibility into your AI usage patterns, but are marked as non-billable in the usage table and do not deduct from your current compute unit balance or affect daily limits. | | Improved agentic playbook predictability with LLM structured outputs | Highly reliable, automated workflows are now easier to maintain by enforcing structured responses for AI prompts within Cortex Cloud playbooks. When configuring an AI prompt, you can optionally choose to use structured output and provide a JSON schema to ensure the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output. | ## Broker VM **Version 32.0.51 (reboot required)** For more information on maintenance releases, see [Maintenance Releases](/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/maintenance-releases.md). | FEATURE | DESCRIPTION | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Upgrade applets independently | Deploy updates faster and with minimum dependences. You can now update individual Broker VM applets independently without upgrading the entire Broker VM. This reduces management overhead and delivers immediate enhancements without system-wide downtime. | | Enforce TLS 1.3 communication | Meet emerging compliance demands and secure your data transmissions against modern threats. Cortex Cloud now supports TLS 1.3 communication between the Broker VM and the server to ensure your environment aligns with strict cybersecurity standards. | | DB collector Windows authentication | We have added Windows Authentication support to the (MSSQL) Database collector applet to enable secure connectivity in domain environments. The new authentication method supports Kerberos, NTLM and the standard SQL internal authentication. | ## Cloud Onboarding | FEATURE | DESCRIPTION | | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved Azure onboarding | Onboard Azure in Cloud Scan mode without depending on a Global Administrator to approve admin consent. We removed the admin consent step, so onboarding is no longer held up waiting for elevated Azure AD approvals. Creating the service principal is now a separate task from onboarding, and you can create it yourself using the method you prefer. Once it exists, enter your Azure tenant ID and Cortex verifies the service principal in the background. This applies to Cloud Scan mode only; in Outpost scan mode, the service principal is created during the outpost creation flow. | | Coverage charts for onboarding | New coverage charts for discovery and permissions give you instant visibility into your cloud onboarding health. By showing successful versus failed scopes relative to your total environment, the new charts ensure that even isolated errors in massive data sets don't get buried. We've also updated discovery statuses to be coverage-based, giving you a truer reflection of overall account and organization health. | | Manual Azure onboarding | Gain full control over Azure onboarding with a manual setup flow. Provision the required resources and Azure RBAC permissions yourself, allowing you to meet strict security, compliance, and infrastructure requirements without dependency on Cortex Cloud templates. | | AWS Control Tower BYOB onboarding | Onboard your AWS Control Tower environments without manual workarounds. We've added custom audit log collection (BYOB) support for audit log buckets hosted in separate Control Tower accounts. | | Agentless Malware Sandboxing | Unknown files found during registry scans can now be uploaded for detonation in Wildfire. This provides enhanced malware detection and helps secure your cloud environments. The feature is supported across AWS, Azure, and GCP cloud platforms. It is enabled by default for new instances and can be manually enabled for existing instances. | ## Code-to-Cloud | FEATURE | DESCRIPTION | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Code-to-cloud coverage dashboard | You can now see how completely your application code maps to running cloud assets, so you can trust your traceability and close security gaps before they reach production. The dashboard shows coverage percentages in both code-to-cloud and cloud-to-code directions across artifacts and infrastructure. Status views and insights highlight specific gaps, such as repositories without pipelines, untraced runtime images, and cloud assets missing tags. Each insight links directly to the affected assets so you can act on the gap. A coverage widget in the Command Center and a coverage API help you monitor traceability across your environment. | | Trace lineage per asset | Trace any asset from code to runtime directly on its asset page. The Code to Cloud tab now appears on all supported asset types, including infrastructure as code resources, cloud resources, container and VM images, and running instances. When the traceability path is incomplete, the tab shows which stage is missing and guides you to onboard the source so you can fix risks where they originate. | ## Compliance | FEATURE | DESCRIPTION | | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved compliance interface | We overhauled the compliance interface, improving the experience of managing standards and compliance assessments. | | Audit log events for compliance management actions | Audit log events are now created for all compliance management actions. | | Compliance metadata for issues and findings | Prioritize remediation by regulatory impact. Cortex Cloud now enriches issues and findings with compliance metadata, so you can see the relevant standards, categories, and controls directly in the issue, finding, and case cards. You can also filter the issues and findings tables by standards, categories, and controls to focus on the frameworks that govern your organization. | ## Cortex Agentic Assistant | FEATURE | DESCRIPTION | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved navigation to Agentic Assistant Hub | A new dedicated Agentic Assistant Hub menu item has been added to the main navigation sidebar to improve administrative efficiency. By providing a direct shortcut to your agent and action configurations, this update reduces operational overhead for security teams by eliminating the need to navigate through the chat interface. | | Frontier AI Native Support |Equip Cortex AgentiX agents with the world’s most powerful frontier AI models, including Anthropic Claude Sonnet 4.6, Claude Opus 4.8, and Gemini 3.5 Flash, and seamlessly switch between them to match specific tasks with the most appropriate model.
Claude Sonnet 4.6 and Claude Opus 4.8 are available in the US and EU regions. Gemini 3.5 Flash is available in the US, EU, SG, JP, IN and UK regions. Claude Sonnet 5 is available upon request in the US and EU regions.
| | Personalized Agents | Unlock smarter, tailored agents infused with your organization’s unique knowledge. Connect directly to Google Drive, Confluence, or upload your standard operating procedures and documentation to power fully contextual agentic responses. Now available in private preview; contact your Palo Alto Networks representative to participate. | ## Cortex Query Language (XQL) | FEATURE | DESCRIPTION | | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | XQL query macros | The new XQL text-substitution macros and the macro library enable you to save and reuse modular code snippets to simplify query authoring and centralize organizational logic. XQL macros eliminate repetitive manual work through modular expansion and a dedicated management UI, empowering teams to maintain high-quality, standardized logic with ease. | | Reshape data in XQL | Turn raw query results into clear, presentation-ready tables. You can now pivot rows into columns, transpose columns into rows, and replace null values across complex data types such as arrays, JSON, and datetime fields. | | Faster free text search | The new improved free text search enables you to run a single search across many datasets and get results faster and more reliably during investigations. | | Consistent query result access | The Query History view now retains results from investigation flows, simple search, and scheduled queries for a fixed 72-hour period across every tenant. When results expire, Cortex XSIAM marks them as Data Purged and hides the Show Results action so you always know their availability. | | Query asset groups | Simplify security investigations in Cortex Query Language (XQL) with richer context. You can now query asset group information directly in XQL to correlate, filter, and report on your assets more effectively. We added the `asset_groups` system dataset to help you easily retrieve asset group details within your custom queries. For example, join against the new dataset using the asset group ID to get the asset group name. | ## CSP Onboarding | FEATURE | DESCRIPTION | | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Custom outpost deployment - Limited GA | Customize how outposts are deployed across AWS, Azure, and GCP using your own IAM roles, naming conventions, regions, and egress networking so that outposts fit cleanly into your existing infrastructure and security policies. We added a guided custom outpost flow that lets you provide pre-created resources. Contact Palo Alto Networks support to enable this limited GA feature. | | Bring your own App Registration (BYOA) for Azure outposts | Outpost deployment in Azure now allows you to pre-define the needed Entra ID application registration by selecting the "Bring your own app registration" option in the Azure Outpost onboarding wizard. | | Deploy outposts in your network: "Bring your own network" (BYON) - Limited GA | Meet strict network sovereignty requirements for regulated industries by deploying outposts inside your existing networks. You can now bring outposts into your own networks on AWS, Azure, and GCP and route their traffic through your own proxy. The onboarding wizard now supports customer-provided networks, proxies, and certificates. Contact Palo Alto Networks support to enable this limited GA feature. | ## CSPM | FEATURE | DESCRIPTION | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | | Modifying XQL logic of OOTB cloud security rules | You can now duplicate out-of-the-box (OOTB) cloud security rules, adapting them to your needs by adjusting the underlying XQL logic. | | Modifying severity of OOTB cloud security rules | You can now modify the severity of out-of-the-box (OOTB) configuration cloud security rules. | | Renaming of attack path rules | Attack Path cloud security rules have been renamed to Attack Path (Legacy). | ## Data Classification | FEATURE | DESCRIPTION | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Topic classification | Understand what your files contain at a glance. Cortex now automatically assigns a content-based topic label to each file during data classification, so you can group, search, and prioritize sensitive data by subject matter. File topic classification builds on the data classification engine to surface the main subject inside your files alongside existing sensitivity findings. | ## Data Security | FEATURE | DESCRIPTION | | ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Continuous Strata logging authentication | Maintain uninterrupted data logging across commercial and FedRAMP Moderate environments without manual re-authentication prompts every six months. Cortex Cloud now automatically manages secure background authentication for the Strata Logging Service, ensuring continuous data flows. | | MongoDB Atlas support for Data Security Posture Management | Cortex Cloud Data Security now supports MongoDB Atlas as a data source for Data Security Posture Management (DSPM). You can onboard your MongoDB Atlas deployments to discover, classify, and assess the security posture of the data they store. After you onboard MongoDB Atlas, Cortex Cloud Data Security extends DSPM coverage to MongoDB Atlas alongside the other supported assets, giving you visibility into sensitive data and data security risks across your MongoDB Atlas environment. | ## External Data Ingestion and Management | FEATURE | DESCRIPTION | | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Secure S3 log collection | Collect logs securely without managing long-lived credentials. You can now authenticate Amazon S3 Log Collection using Workload Identity Federation (WIF), allowing dedicated log collectors to securely connect to AWS without storing long-lived access keys. We’ve updated the onboarding wizard with an authentication selector (supporting Web Identity Federation, Access Key, or STS AssumeRole) and set WIF as the default. You can also update the authentication method on your existing instances at any time. | | Group Marketplace integrations into unified connectors |Connect each vendor through a single unified connector instead of dealing with separate data sources and marketplace integrations. On the Data Sources & Integrations page, Cortex Cloud now groups related Marketplace integrations into one unified connector per vendor. This allows you to discover, add, and manage all of a vendor's capabilities from a single entry in the catalog. This new connector experience includes the following built-in features: • Centralized vault credentials: Authenticate your connectors directly with secret vaults instead of manually entering credentials, extending standard platform credential security across your capabilities. • Selective service onboarding: For multi-service connectors, such as Microsoft 365 or Google Workspace, you can choose to onboard the full suite at once or select individual services. Additional services can be enabled later without disrupting your existing configuration.
NOTE: New tenants will see this updated experience across the entire catalog. Existing tenants will immediately get this new look-and-feel experience for a select number of initial Marketplace integrations.
| ## Identity Security | FEATURE | DESCRIPTION | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Find Azure access paths | Trace exactly which Azure resources an identity can reach, so you can spot risky access before attackers do. The Cortex Graph Search query builder now supports the Can Access relation for Azure, showing the effective permission paths between a source and a target after all allow and deny rules are applied. You can build these queries directly from the query builder and see each allowed path visualized in the graph. | | Right-size GCP access | Reduce your cloud attack surface by removing excessive permissions from Google Cloud Platform (GCP) groups and service accounts. Cortex Cloud now identifies least privileged access recommendations for GCP groups and service accounts, so you can grant only the permissions each identity actually uses. | | Broader effective access coverage | See effective access across your entire cloud estate in one place. The Cortex Cloud security graph now answers "Can this resource reach that one?" for every asset type across AWS, Azure, and GCP — not just a limited set. Each access relationship now includes the specific actions an identity or workload can perform, so you can assess real risk without untangling policy complexity. | | Permissions in Graph Search | The Cortex Graph Search query builder now supports the Can Access relation for Azure and Google Cloud Platform (GCP), allowing you to trace exactly which resources an identity can reach and spot risky access before attackers do. By expanding to answer "Can this resource reach that one?" for asset types across AWS, Azure, and GCP, the Cortex Cloud security graph provides centralized visibility into effective access across your entire cloud estate. This feature maps the complete permission paths between a source and a target after all allow and deny rules are applied, visualizing each allowed path directly in the graph. Furthermore, each access relationship includes the specific actions an identity or workload can perform, enabling you to assess real risk instantly without untangling policy complexity. | | Trusted domains for CIEM | Focus on the entitlement risks that matter by telling Cortex Cloud which identity domains you trust. You can now define trusted domains in Cloud Infrastructure Entitlement Management, so Cortex Cloud suppresses findings and false-positive alerts for identities that belong to those domains. Fewer noisy findings means your team spends time on the access risks that need real attention. | | More cloud secrets in CIEM | Cortex Cloud now discovers more types of non-human identity secrets across your Azure and Google Cloud environments, so you can find and secure credentials that were previously invisible. Cloud Infrastructure Entitlement Management (CIEM) ingests and normalizes additional secret asset types, including Azure Entra ID client secrets, Azure storage account keys, Azure Key Vault secrets, Azure and Google Cloud SSH key pairs, and Google Cloud Secret Manager secrets. Each new secret appears in your asset inventory with full overview and identity details, such as first seen, last seen, expiration date, and whether the secret is publicly accessible. You can also see which identities and resources each secret can access or be managed by, so you can investigate exposure and rotate unrotated credentials faster. | ## Investigation and Response | FEATURE | DESCRIPTION | | ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Attack path discovery with the new graph engine | Detect and prioritize potential attack paths with Cortex Cloud’s new graph detection engine. By continuously analyzing relationships across identities, code, data, workloads, and cloud resources, the graph uncovers how seemingly isolated risks can combine into exploitable attack paths to critical assets. | | Filter issues by resolution SLA and resolution timer in XQL | Query and filter issues by their resolution service-level agreement (SLA) and resolution timer values using Cortex Query Language (XQL). We now expose the Resolution SLA and Resolution Timer as filterable XQL fields. The Resolution SLA and Resolution Timer XQL schemas also include derived fields, so you can build queries, correlation rules, and dashboards that track whether issues are resolved within their defined SLA goals. | | Cortex Cloud Consumption dashboard | Track your cloud usage at a glance. You can now monitor your cloud consumption over the last 90 days with a detailed breakdown by workload type and usage details across all your cloud accounts. The new Cortex Cloud Consumption dashboard shows usage trends over 7, 30, and 90-day windows. It enables filtering by date range, cloud provider, account, and asset type, with the past 365 days of data available for custom date ranges. | ## Kubernetes Security | FEATURE | DESCRIPTION | | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Streamline onboarding for Kubernetes real-time protection |• See your XDR agent version instantly. The K8s Connector now displays your agent version alongside the bundle version.
• Skip manual platform selection. The connector automatically detects your node platform type: Standard, Bottlerocket OS, Google Container-Optimized OS, or OpenShift.
Protect Kubernetes Pods from misconfigurations. Kubernetes Pods deployed directly, or modified by other webhooks after their controller was approved, previously bypassed all compliance and image-trust checks. We now provide complete Kubernetes Pod support across inventory tracking, detailed asset visibility, compliance scanning, admission control prevention, and comprehensive container inspection. This closes critical security gaps identified by customers running workloads directly as pods instead of through controllers.
• Pods in Cortex Cloud inventory: Cortex Cloud now provides a dedicated asset page for Kubernetes Pods in the inventory. The Kubernetes Pods page includes a relationship graph that shows how a pod connects to related Kubernetes resources. Pods are now available on Search Graph as well for discovery and investigation.
• Containers table: Added a new Containers tab for Kubernetes Pod Group assets in Cortex Cloud Inventory, providing complete visibility into pod composition and container details. Use the Kubernetes Pod to investigate the security posture of individual pods and the containers that run in each pod.
• Collection & Modeling: Implemented pod collection in the inventory with performance optimization for large clusters and pod-to-runtime-image relationships for complete asset tracking. This supports both K8s Connector agent and K8s Agentless deployments.
• Compliance & Rules: Added Kubernetes Pod support to the compliance views, including system-rule validation for pod-scoped rego rules. This enables compliance checks on pods alongside traditional workload controllers. Custom compliance rules now support pods.
• Prevention & Admission Control: Kubernetes Pods are now supported as part of CWP rules and policies, enabling the admission controller to block non-compliant pods and prevent misconfigurations at creation time.
NOTE: A Kubernetes Pod Group asset represents all the identical pod replicas of a Kubernetes workload in a single unique inventory asset. The uniqueness is derived by the Kubernetes workload owner unique identifier.
| | Cluster deployment method visibility | Understand how your clusters are being connected and scanned by Cortex Cloud. The cluster inventory now displays the deployment method (Agentless, Connector or None) for each cluster, along with connectivity status. This gives you immediate visibility into your scanning infrastructure and helps you identify which clusters are using agentless scanning versus connector-based approaches and which clusters are not connected at all. | | Agentless Kubernetes security for GCP and Azure | Automatically onboard and secure all Kubernetes clusters across your GCP and Azure accounts without manual deployment. Monitor cluster inventory, vulnerabilities, malware, secrets, and misconfigurations, automatically discovering new clusters as they are added to your account. | ## Marketplace Content Changes | FEATURE | DESCRIPTION | | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Built-in Cortex automation commands | Execute essential playbook commands instantly without manual setup overhead. Built-in commands replace the older **Core Investigation and Response** and **Cortex Platform - Core** integrations while maintaining full functionality and improving performance. | | Unified AWS cloud security automation | Consolidate your AWS cloud security management into a single comprehensive content pack to streamline operations. The updated AWS cloud pack now includes coverage for security services, eliminating the need to deploy multiple separate packs for AWS CloudWatch Logs, Systems Manager, and Network Firewall. | ## Serverless | FEATURE | DESCRIPTION | | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enhance security visibility for serverless layers | Secure your serverless architecture by gaining full visibility into vulnerabilities hidden within your shared code dependencies. The Vulnerabilities tab in your Lambda function now includes a Layers view, which breaks down security issues present in your reusable component packages. This allows you to quickly identify and update vulnerable Layers, instantly securing all associated functions. | ## Vulnerability Management | FEATURE | DESCRIPTION | | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Active Vulnerability Findings Over Time widget | Track active vulnerability findings over the last 6 months in the new Active Vulnerability Findings Over Time widget on the Vulnerability Management dashboard. | | AI-powered Remediation Guidance | Enhancements to Vulnerability Management now include AI-driven remediation insights, providing precise, step-by-step instructions to resolve security flaws efficiently. When viewing a vulnerability finding, the Remediation Guidance section provides you with actionable application-level commands required to patch or remediate the vulnerability on your impacted systems. Also included, are verified vendor download links to the specific software updates or patches required to resolve the issue, reducing the need for manual research. Workarounds are also provided in some cases, to help reduce the risk of vulnerability when patching is not immediately possible. | | Streamlined Resolution Actions | We’ve updated the Vulnerability Issues side-panel to introduce Resolution Actions, providing a unified and consistent remediation experience across both individual issues and broader cases. When an immediate patch isn’t viable, the side-panel now surfaces approved compensating controls as a valid Resolution Action to help you mitigate risk safely. Speed up your incident response with clear, prescriptive guidance—whether that means launching a dedicated automation playbook or following step-by-step manual instructions. Recommendations are also provided at the case level, giving you access to full operational context without needing to pivot between screens. | | Remediate Zero Day threats faster | Enhancements to the Vulnerability Management list view help you isolate and triage global attack surface events and major zero-day events, with greater speed. You can now easily filter vulnerabilities to focus exclusively on high-priority, newly identified emerging threats. For security events associated with multiple vulnerabilities, you can drill down to filter by a single, specific vulnerability, giving you granular visibility. | | Improved Kubernetes context for Vulnerability Findings | Vulnerability findings for Kubernetes Resource asset types now include dedicated Kubernetes metadata, providing you deeper visibility into containerized environments. You can view and filter by fields such as, Cluster, Namespace, Namespace Label across the UI, XQL, and the Public API (PAPI). This enhancement provides the granular context needed to quickly isolate vulnerabilities by specific environments or microservices. | | Redesigned Vulnerability Findings side panel |We have redesigned the Vulnerability Findings side-panel to put critical context right at your fingertips. Evidence fields are now front and center, giving you insight into exactly why a vulnerability was detected including additional extraction, normalization, and display of detection evidence from all Cortex scan sources.
Surfacing the detection logic, allows you to reduce the time spent investigating false positives or searching for root causes. The revamped interface allows you to assess the risk and context of a findings at a glance, accelerating your mean time to remediation (MTTR).
| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/july-2026/feature-enhancements.md?ask=