> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-11-20.md).

# 2024.11.20

**Release date: 03-December-2024**

| Change type                                                   | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added a new Medium Analytics BIOC                             | <ul><li><a href="/analytics-alerts/alerts-by-name/suspicious-kubernetes-pod-token-access.md">Suspicious Kubernetes pod token access</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Added 3 new Low Analytics BIOCs                               | <ul><li><a href="/analytics-alerts/alerts-by-name/a-process-queried-the-adfs-database-decryption-key-via-ldap.md">A process queried the ADFS database decryption key via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/potential-sccm-credential-harvesting-using-wmi-detected.md">Potential SCCM credential harvesting using WMI detected</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-encrypting-file-system-remote-call-efsrpc-to-domain-controller.md">Unusual Encrypting File System Remote call (EFSRPC) to domain controller</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Added 8 new Informational Analytics BIOCs                     | <ul><li><a href="/analytics-alerts/alerts-by-name/a-service-principal-was-created-in-azure.md">A Service Principal was created in Azure</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-application-removed.md">Azure application removed</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-group-creation-deletion.md">Azure group creation/deletion</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-permission-delegation-granted.md">Azure permission delegation granted</a></li><li><a href="/analytics-alerts/alerts-by-name/data-encryption-was-disabled.md">Data encryption was disabled</a></li><li><a href="/analytics-alerts/alerts-by-name/member-added-to-a-windows-local-security-group.md">Member added to a Windows local security group</a></li><li><a href="/analytics-alerts/alerts-by-name/okta-account-unlock-by-admin.md">Okta account unlock by admin</a></li><li><a href="/analytics-alerts/alerts-by-name/potential-okta-access-limit-breach.md">Potential Okta access limit breach</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Added a new Informational Analytics Alert                     | <ul><li><a href="/analytics-alerts/alerts-by-name/okta-account-unlock.md">Okta account unlock</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of 2 Medium Analytics BIOCs                    | <ul><li><a href="/analytics-alerts/alerts-by-name/executable-moved-to-windows-system-folder.md">Executable moved to Windows system folder</a></li><li><a href="/analytics-alerts/alerts-by-name/parsing-rule-error.md">Parsing Rule Error</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Improved logic of 4 Low Analytics BIOCs                       | <ul><li><a href="/analytics-alerts/alerts-by-name/azure-account-deletion-by-a-non-standard-account.md">Azure account deletion by a non-standard account</a></li><li><a href="/analytics-alerts/alerts-by-name/cloudtrail-logging-deletion.md">Cloud Trail logging deletion</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-remote-monitoring-and-management-tool.md">Uncommon Remote Monitoring and Management Tool</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-ssh-session-was-established.md">Uncommon SSH session was established</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Improved logic of 2 Low Analytics Alerts                      | <ul><li><a href="/analytics-alerts/alerts-by-name/logs-were-not-collected-from-a-data-source-for-an-abnormally-long-time.md">Logs were not collected from a data source for an abnormally long time</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-identity-downloaded-multiple-objects-from-a-bucket.md">Suspicious identity downloaded multiple objects from a bucket</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Improved logic of 16 Informational Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-created-or-modified-a-security-group.md">A cloud identity created or modified a security group</a></li><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-had-escalated-its-permissions.md">A cloud identity had escalated its permissions</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-was-added-to-a-windows-security-group.md">A user was added to a Windows security group</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Activity in a dormant region of a cloud project</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">An identity attached an administrative policy to an IAM user/role</a></li><li><a href="/analytics-alerts/alerts-by-name/an-uncommon-file-added-to-startup-related-registry-keys.md">An uncommon file added to startup-related Registry keys</a></li><li><a href="/analytics-alerts/alerts-by-name/browser-extension-installed.md">Browser Extension Installed</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-compute-serial-console-access.md">Cloud compute serial console access</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-email-service-activity.md">Cloud email service activity</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage.md">Execution of an uncommon process at an early startup stage</a></li><li><a href="/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage.md">Execution of an uncommon process with a local/domain user SID at an early startup stage</a></li><li><a href="/analytics-alerts/alerts-by-name/gcp-set-iam-policy-activity.md">GCP set IAM policy activity</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-cloud-compute-instance-ssh-keys-modification-attempt.md">Suspicious cloud compute instance ssh keys modification attempt</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-aws-systems-manager-activity.md">Unusual AWS systems manager activity</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation.md">Unusual cloud identity impersonation</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Unusual resource modification/creation</a></li></ul> |
| Improved logic of 3 Informational Analytics Alerts            | <ul><li><a href="/analytics-alerts/alerts-by-name/multi-region-enumeration-activity.md">Multi region enumeration activity</a></li><li><a href="/analytics-alerts/alerts-by-name/port-scan.md">Port Scan</a></li><li><a href="/analytics-alerts/alerts-by-name/storage-enumeration-activity.md">Storage enumeration activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Decreased the severity to Low for an Analytics BIOC           | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Editing ld.so.preload for persistence and injection</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Decreased the severity to Informational for 2 Analytics BIOCs | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Abnormal Communication to a Rare IP</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Abnormal Recurring Communications to a Rare IP</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Removed an old Informational BIOC                             | <ul><li>Modification of SSH authorized keys</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-11-20.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.