> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/july-2026/feature-enhancements.md). # Feature Enhancements These enhancements provide new and improved capabilities. ## Access Management | FEATURE | DESCRIPTION | | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Granular Jobs permissions | Reduce the risk of over-privileged users across your tenant. Administrators can now grant access permissions for Automation Jobs via custom roles instead of full administrator privileges. | | Fully restrict credentials access | Enforce a strict least-privilege model by completely revoking access to stored secrets. Administrators can now set the **Credentials** permission to **None**, which hides the **Credentials** page, blocks the related public API endpoints, and stops users from referencing saved credentials in integrations, scripts, and playbooks. | ## Automation | FEATURE | DESCRIPTION | | -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved agentic playbook predictability with LLM structured outputs | Highly reliable, automated workflows are now easier to maintain by enforcing structured responses for AI prompts within Cortex AgentiX playbooks. When configuring an AI prompt, you can optionally choose to use structured output and provide a JSON schema to ensure the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output. | | Search playbooks by content pack | Find playbooks faster by filtering the Playbook Catalog by content pack. The Search by filter in the Playbook Catalog now includes a content pack option to find playbooks that belong to a specific content pack. | | Compute unit tracking for agentic requests | The Compute Units page now displays the evaluated compute cost for each agentic request to help you plan future resource allocations and understand the full ROI of your AI tools. These entries provide visibility into your AI usage patterns, but are marked as non-billable in the usage table and do not deduct from your current compute unit balance or affect daily limits. | | Mark playbook tasks as timeline records | Track investigation milestones seamlessly directly from your case timeline. You can now edit specific playbook tasks to display their actions as case timeline records, matching your exact workflow naming conventions, and tag them as evidence to capture critical discovery details at the case level. | ## Cortex Agentic Assistant | FEATURE | DESCRIPTION | | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved navigation to Agentic Assistant Hub | A new dedicated Agentic Assistant Hub menu item has been added to the main navigation sidebar to improve administrative efficiency. By providing a direct shortcut to your agent and action configurations, this update reduces operational overhead for security teams by eliminating the need to navigate through the chat interface. | | Personalized Agents | Make AI agents experts in your environment. Connect Google Drive, Confluence, or upload SOPs and documentation so agents understand your organization's workflows and provide organization-specific guidance for threat hunting, investigation, and response. Now available in private preview; contact your Palo Alto Networks representative to participate. | ## Cortex Query Language (XQL) | FEATURE | DESCRIPTION | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | XQL query macros | The new XQL text-substitution macros and the macro library enable you to save and reuse modular code snippets to simplify query authoring and centralize organizational logic. XQL macros eliminate repetitive manual work through modular expansion and a dedicated management UI, empowering teams to maintain high-quality, standardized logic with ease. | | Reshape data in XQL | Turn raw query results into clear, presentation-ready tables. You can now pivot rows into columns, transpose columns into rows, and replace null values across complex data types such as arrays, JSON, and datetime fields. | | Faster free text search | The new improved free text search enables you to run a single search across many datasets and get results faster and more reliably during investigations. | | Consistent query result access | The Query History view now retains results from investigation flows, simple search, and scheduled queries for a fixed 72-hour period across every tenant. When results expire, Cortex XSIAM marks them as Data Purged and hides the Show Results action so you always know their availability. | ## Dashboards and reports | FEATURE | DESCRIPTION | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AI-driven dashboard builder | Turn natural language prompts into data visualizations in seconds. A streamlined workflow for setup, access control, reporting, and live previews helps your team build executive-ready dashboards and reports faster, with fewer manual steps. | ## Data Security | FEATURE | DESCRIPTION | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Continuous Strata logging authentication | Maintain uninterrupted data logging across commercial and FedRAMP Moderate environments without manual re-authentication prompts every six months. Cortex AgentiX now automatically manages secure background authentication for the Strata Logging Service, ensuring continuous data flows. | ## External Data Ingestion and Management | FEATURE | DESCRIPTION | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Group Marketplace integrations into unified connectors |

Connect each vendor through a single unified connector instead of dealing with separate data sources and marketplace integrations. On the Data Sources & Integrations page, Cortex Agentix now groups related Marketplace integrations into one unified connector per vendor. This allows you to discover, add, and manage all of a vendor's capabilities from a single entry in the catalog. This new connector experience includes the following built-in features: • Centralized vault credentials: Authenticate your connectors directly with secret vaults instead of manually entering credentials, extending standard platform credential security across your capabilities. • Selective service onboarding: For multi-service connectors, such as Microsoft 365 or Google Workspace, you can choose to onboard the full suite at once or select individual services. Additional services can be enabled later without disrupting your existing configuration.

New tenants will see this updated experience across the entire catalog. Existing tenants will immediately get this new look-and-feel experience for a select number of initial Marketplace integrations.

| ## Investigation and Response | FEATURE | DESCRIPTION | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Manage case team members and access | Gain clear visibility into who is actively working on an investigation and enforce strict access controls for cases containing sensitive context. Security investigations require cross-functional collaboration across multiple teams and users. With this update, you can now capture all participating individuals and user groups while ensuring sensitive context is accessible only to designated team members. | | Enhanced case SLA tracking and reporting | Elevate your compliance reporting and case prioritization with fully integrated Case SLAs and advanced XQL querying capabilities. You can now track real-time SLA metrics directly from the case header and table views, while utilizing custom fields and out-of-the-box resolution timers to ensure organizational KPIs are met. Additionally, new XQL support allows you to search, filter, and report on SLA data, such as breach status and remaining time, to quickly surface at-risk cases. | | Case experience improvements | Work cases faster and more effectively with usability enhancements designed to streamline your everyday investigation workflow. You can now expand the grouping graph to full screen, navigate between issues in the issue feed the same way as the issue table, and group issues in the issue feed by data source. Additionally, asset group names and asset tags are now natively exposed for use in cases and XQL searches, while the resolution center automatically opens to the first tab containing tasks to help you jump straight into remediation. | | Issue export optimization | To ensure fast, reliable downloads, the issues TSV export is now capped at a maximum of 50k issues per export. | ## Marketplace Content Changes | FEATURE | DESCRIPTION | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Built-in Cortex automation commands | Execute essential playbook commands instantly without manual setup overhead. Built-in commands replace the older **Core Investigation and Response** and **Cortex Platform - Core** integrations while maintaining full functionality and improving performance. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/july-2026/feature-enhancements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.