Changed Features

These features have been modified or removed in this release.

FEATURE	DESCRIPTION
Secure administrator role changes	Previously, non-admin users with Access Management permissions could grant an effective Instance Administrator role to users and user groups, modify access for these entities, or delete associated API keys. Now, they are restricted from doing so.
XQL queries for cases and issues	Cortex Query Language (XQL) queries now strictly enforce domain-based access controls for Cases and Issues, bringing search results into closer alignment with the data visible on your user interface dashboards.
Enhanced issue descriptions	Malware issues from the Cortex XDR agent now include a comprehensive description of the detected threat as follows: The file [name], located at [path], was identified as malicious by [component] and was [action] by the Cortex XDR agent.
Endpoint table field name change	In the Endpoint table, the field name Cloud Provider Account ID has been changed to Account ID.
AI Detection and Response (AIDR) is now a part of Cloud Detection and Response (CDR)	• Cortex AIDR is now a part of CDR and is available to all customers with a Cloud Runtime Security license. • AIDR detections are activated by default following cloud onboarding and cloud log ingestion as part of cloud detections, and are tagged as Cloud AI Infrastructure Analytics. • The AIDR dedicated dashboard has been deprecated and its main widgets are now part of the AI Security dashboard.
Unified support case creation via the Help Center Agent	To maximize operational efficiency and reduce resolution times, clicking Initiate Support Request from the Help button now routes you directly to the Help Center Agent. This single path ensures a cohesive support experience as the agent gathers essential context and automatically attaches the chat history and conversation ID to your final support case. If the Cortex AgentiX Assistant is not enabled for your account or available in your region, you will automatically route through the standard case creation flow.
Deprecation of some operators defining cloud security rule logic	To streamline cloud security rule creation, we deprecated a few logical operators in the Simple Mode rule builder wizard that are not applicable to object matching in cloud security rules. The following operators are longer be available when creating new custom cloud security rules: • contains / does not contain • equals / does not equal • equal ignore case / does not equal ignore case • starts with / does not start with • ends with / does not end with • length equals / length does not equal • length greater than / length less than Existing cloud security rules utilizing these operators are not affected. You can continue to use. and edit these rules.