Feature Enhancements
These enhancements provide new and improved capabilities.
Access Management
Granular access to datasets
Protect your datasets from accidental, unauthorized, or over-exposed access by controlling exactly who can view, edit, and own each one. You can now share individual user datasets, lookups, dataset views, and correlation datasets with specific users, user groups, or API keys, granting Viewer or Editor access. Datasets are restricted by default, so only people you share with can query or modify them. This brings dataset governance in line with the access control you already use for dashboards, report templates, saved queries, scripts, and playbooks.
Fully restrict credentials access
Enforce a strict least-privilege model by completely revoking access to stored secrets. Administrators can now set the Credentials permission to None, which hides the Credentials page, blocks the related public API endpoints, and stops users from referencing saved credentials in integrations, scripts, and playbooks.
AI Security
Extend AI posture to Amazon S3 Vectors
Gain visibility into your AI vector storage so you can secure your full AI attack surface. Cortex AI Security Posture Management (AI-SPM) now supports Amazon S3 Vectors. You can discover S3 Vectors buckets and indexes. This coverage helps you assess risk of the data that powers your AI applications.
AI Security dashboard
Gain unified visibility into your SaaS AI agents directly from the Cortex Cloud AI Security Dashboard. You can now see SaaS agents alongside cloud AI assets, review their security posture, and act on AI Security Posture Management (AI-SPM) findings from a single view. The AI Security Dashboard surfaces SaaS AI agents from connected services so you can assess and prioritize AI risk without switching tools.
API
Case timeline record APIs
With the new Case timeline record APIs, you can retrieve timeline records for a specified case with support for filtering, sorting, and pagination, and add new timeline records to capture case-related events and updates. For implementation details, see: • Retrieve case timeline records • Add a case timeline record
Least privilege access recommendations for assets API
The new API endpoint returns Least Privilege Access (LPA) recommendations for an asset based on its existing IAM policies or roles. The endpoint analyzes the asset's activity during a specified lookback period and recommends the minimum set of existing IAM policies or roles required to preserve all observed actions. Use the returned policy or role configuration snippets to remediate over-privileged identities and implement least privilege access.
Asset Management APIs for Business Applications
The new endpoints enable you to programmatically identify assets that can be added to or removed from an application, apply manual asset overrides, review override history for auditing and asset lineage, and revert changes using an actionId. These APIs help ensure applications accurately reflect their associated assets while providing full traceability, accountability, and rollback support. - List addable assets - List removable assets - Add or remove assets - List override actions - Revert asset override action
ASPM
Trace lineage per asset
Trace any asset from code to runtime directly on its asset page. The Code to Cloud tab now appears on all supported asset types, including infrastructure as code resources, cloud resources, container and VM images, and running instances. When the traceability path is incomplete, the tab shows which stage is missing and guides you to onboard the source so you can fix risks where they originate.
Package Explorer
You can now discover, evaluate, and govern every open-source and operating system package used across your organization from a single inventory that spans code, build, deploy, and runtime environments. Each package shows an operational risk score grounded in popularity and maintenance data, so you can prioritize remediation by business impact. Open a package side panel to review where it is used, its vulnerabilities, and its operational risk. For high-risk dependencies, request safer alternative package recommendations through Cortex Agentix. Query package intelligence programmatically through a dedicated API to integrate it into your own tools and automation workflows.
Connect Azure DevOps with service principal
Cortex Cloud now supports Azure DevOps onboarding via a Service Principal application identity, in addition to existing user authentication and Personal Access Token (PAT) methods. Because a Service Principal is not tied to an individual user, this extends Azure DevOps support to organizations whose security policies mandate non-personal, application-level identities and to automated workflows that require access without human interaction. Additionally, it eliminates the operational risk of integrations breaking when a person leaves the organization or has their account disabled.
ASPM, Application Security
Onboard GitHub with a customer-owned app
Meet strict security mandates and maximize access control by onboarding GitHub with a customer-owned app. You can now onboard GitHub Cloud (SaaS) using a dedicated GitHub App created and owned by your organization, in addition to the shared, Cortex-managed app. Because the app belongs entirely to your organization, it satisfies security policies that mandate organization-owned applications. It also delivers strict tenant isolation, granular control over permissions, and independent revocation, all while preserving the same scanning and remediation capabilities as the shared app.
Asset Inventory
Smart upgrade intelligence for container images
Accelerate vulnerability remediation across your container fleet with a new smart upgrade intelligence summary on container image asset cards. For every registry container image, Cortex Cloud now automatically identifies the underlying base OS image and evaluates newer, more secure versions already approved within your corporate registry. Cortex Cloud calculates a container image migration score which weighs security posture improvements against potential operational risks, and automatically recommends the optimal upgrade path with the highest security yield and lowest friction.
In addition, for each vulnerability, Cortex Cloud identifies if the vulnerability is derived from the base OS image or if it was added by the developer as part of the application. By clearly isolating the scope, infrastructure and development teams can filter vulnerabilities to determine exact ownership. This ensures the right team can act quickly to upgrade a specific application package or roll out a new base OS image.
View container image assets by registry, repository, and tags
For better identification and isolation of specific container image assets, you can now filter by registry, repository, and tags when viewing assets in the asset inventory or exporting lists of assets. You can also query registry, repository, and tag information in the Cortex Data Model (XDM) when you run XQL queries. The new Cortex Data Model fields are xdm.image.container_registry_url, xdm.image.repository, and xdm.image.repo_tag.
Improved stale asset identification and removal
Cortex Cloud now features enhanced capabilities that optimize how stale or inactive assets are identified and removed across your environment to maintain a highly accurate asset inventory. This minimizes asset noise and reduces management overhead for security teams, ensuring your asset inventory provides precise, up-to-date enterprise visibility.
Asset hierarchy visibility
Investigate and scope cloud assets the way your organization is structured. The asset inventory now displays the full cloud hierarchy path for assets across Amazon Web Services, Google Cloud Platform, Microsoft Azure, and Oracle Cloud Infrastructure, allowing you to use Hierarchy Path to filter, sort, search, or build asset groups and enforce Scope-Based Access Control (SBAC).
Asset hierarchy data is only available if you onboard your cloud environment using organization-wide or root-level onboarding; it does not apply to environments configured with single-account or individual onboarding.
Azure resource group visibility in the asset inventory
Filter, search, and audit your multi-cloud inventory by Azure resource group fields natively captured within the asset inventory. This resource metadata allows you to track cloud assets by their precise deployment boundaries, build custom asset groups, and enforce Scope-Based Access Control (SBAC).
Attack Surface Management
Frontier AI-informed detection coverage
Expand protection with new detections shaped by frontier AI attack research. These detections help identify exploitable weaknesses and exposures across external attack surfaces.
Asset graph relationships for cloud and ASM data
Understand your security risks clearly by visualizing how your attack surface and cloud assets interact. We mapped external attack surface data to your cloud resources, allowing you to build custom graph searches across AWS EC2 instances, Azure VMs, and Google Compute Engine VMs.
Automation
Search playbooks by content pack
Find playbooks faster by filtering the Playbook Catalog by content pack. The Search by filter in the Playbook Catalog now includes a content pack option to find playbooks that belong to a specific content pack.
Improved agentic playbook predictability with LLM structured outputs
Highly reliable, automated workflows are now easier to maintain by enforcing structured responses for AI prompts within Cortex Cloud playbooks. When configuring an AI prompt, you can optionally choose to use structured output and provide a JSON schema to ensure the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output.
Mark playbook tasks as timeline records
Track investigation milestones seamlessly directly from your case timeline. You can now edit specific playbook tasks to display their actions as case timeline records, matching your exact workflow naming conventions, and tag them as evidence to capture critical discovery details at the case level.
Compute unit tracking for agentic requests
The Compute Units page now displays the evaluated compute cost for each agentic request to help you plan future resource allocations and understand the full ROI of your AI tools. These entries provide visibility into your AI usage patterns, but are marked as non-billable in the usage table and do not deduct from your current compute unit balance or affect daily limits.
Broker VM
Version 32.0.51 (reboot required)
For more information on maintenance releases, see Maintenance Releases.
Upgrade applets independently
Deploy updates faster and with minimum dependences. You can now update individual Broker VM applets independently without upgrading the entire Broker VM. This reduces management overhead and delivers immediate enhancements without system-wide downtime.
Enforce TLS 1.3 communication
Meet emerging compliance demands and secure your data transmissions against modern threats. Cortex Cloud now supports TLS 1.3 communication between the Broker VM and the server to ensure your environment aligns with strict cybersecurity standards.
DB collector Windows authentication
We have added Windows Authentication support to the (MSSQL) Database collector applet to enable secure connectivity in domain environments. The new authentication method supports Kerberos, NTLM and the standard SQL internal authentication.
CDR
Complete cloud attack investigation
Investigate cloud attacks faster with entity context directly in the Causality Card. The card now displays: • IP and network intelligence: Critical data regarding the attack's network origin, scope, and reputation. • Identity information: Comprehensive insights into the user's profile, authentication behavior, and access privileges. • Target asset details: Connected cloud asset information mapped directly to your inventory with seamless asset card access. You are getting a picture of who acted, how they authenticated, what they accessed, and where the attack originated.
Cloud Onboarding
Improved Azure onboarding
Onboard Azure in Cloud Scan mode without depending on a Global Administrator to approve admin consent. We removed the admin consent step, so onboarding is no longer held up waiting for elevated Azure AD approvals. Creating the service principal is now a separate task from onboarding, and you can create it yourself using the method you prefer. Once it exists, enter your Azure tenant ID and Cortex verifies the service principal in the background. This applies to Cloud Scan mode only; in Outpost scan mode, the service principal is created during the outpost creation flow.
Manual Azure onboarding
Gain full control over Azure onboarding with a manual setup flow. Provision the required resources and Azure RBAC permissions yourself, allowing you to meet strict security, compliance, and infrastructure requirements without dependency on Cortex Cloud templates.
AWS Control Tower BYOB onboarding
Onboard your AWS Control Tower environments without manual workarounds. We've added custom audit log collection (BYOB) support for audit log buckets hosted in separate Control Tower accounts.
Coverage charts for onboarding
New coverage charts for discovery and permissions give you instant visibility into your cloud onboarding health. By showing successful versus failed scopes relative to your total environment, the new charts ensure that even isolated errors in massive data sets don't get buried. We've also updated discovery statuses to be coverage-based, giving you a truer reflection of overall account and organization health.
Agentless Malware Sandboxing
Unknown files found during registry scans can now be uploaded for detonation in Wildfire. This provides enhanced malware detection and helps secure your cloud environments. The feature is supported across AWS, Azure, and GCP cloud platforms. It is enabled by default for new instances and can be manually enabled for existing instances.
Code-to-Cloud
Code-to-cloud coverage dashboard
You can now see how completely your application code maps to running cloud assets, so you can trust your traceability and close security gaps before they reach production. The dashboard shows coverage percentages in both code-to-cloud and cloud-to-code directions across artifacts and infrastructure. Status views and insights highlight specific gaps, such as repositories without pipelines, untraced runtime images, and cloud assets missing tags. Each insight links directly to the affected assets so you can act on the gap. A coverage widget in the Command Center and a coverage API help you monitor traceability across your environment.
Trace lineage per asset
Trace any asset from code to runtime directly on its asset page. The Code to Cloud tab now appears on all supported asset types, including infrastructure as code resources, cloud resources, container and VM images, and running instances. When the traceability path is incomplete, the tab shows which stage is missing and guides you to onboard the source so you can fix risks where they originate.
Compliance
Improved compliance interface
We overhauled the compliance interface, improving the experience of managing standards and compliance assessments.
Audit log events for compliance management actions
Audit log events are now created for all compliance management actions.
Compliance metadata for issues and findings
Prioritize remediation by regulatory impact. Cortex Cloud now enriches issues and findings with compliance metadata, so you can see the relevant standards, categories, and controls directly in the issue, finding, and case cards. You can also filter the issues and findings tables by standards, categories, and controls to focus on the frameworks that govern your organization.
Cortex Agentic Assistant
Improved navigation to Agentic Assistant Hub
A new dedicated Agentic Assistant Hub menu item has been added to the main navigation sidebar to improve administrative efficiency. By providing a direct shortcut to your agent and action configurations, this update reduces operational overhead for security teams by eliminating the need to navigate through the chat interface.
Frontier AI Native Support
Equip Cortex AgentiX agents with the world’s most powerful frontier AI models, including Anthropic Claude Sonnet 4.6, Claude Opus 4.8, and Gemini 3.5 Flash, and seamlessly switch between them to match specific tasks with the most appropriate model.
Claude Sonnet 4.6 and Claude Opus 4.8 are available in the US and EU regions. Gemini 3.5 Flash is available in the US, EU, SG, JP, IN and UK regions. Claude Sonnet 5 is available upon request in the US and EU regions.
Personalized Agents
Unlock smarter, tailored agents infused with your organization’s unique knowledge. Connect directly to Google Drive, Confluence, or upload your standard operating procedures and documentation to power fully contextual agentic responses. Now available in private preview; contact your Palo Alto Networks representative to participate.
Cortex Query Language (XQL)
XQL query macros
The new XQL text-substitution macros and the macro library enable you to save and reuse modular code snippets to simplify query authoring and centralize organizational logic. XQL macros eliminate repetitive manual work through modular expansion and a dedicated management UI, empowering teams to maintain high-quality, standardized logic with ease.
Reshape data in XQL
Turn raw query results into clear, presentation-ready tables. You can now pivot rows into columns, transpose columns into rows, and replace null values across complex data types such as arrays, JSON, and datetime fields.
Faster free text search
The new improved free text search enables you to run a single search across many datasets and get results faster and more reliably during investigations.
Consistent query result access
The Query History view now retains results from investigation flows, simple search, and scheduled queries for a fixed 72-hour period across every tenant. When results expire, Cortex XSIAM marks them as Data Purged and hides the Show Results action so you always know their availability.
Query asset groups
Simplify security investigations in Cortex Query Language (XQL) with richer context. You can now query asset group information directly in XQL to correlate, filter, and report on your assets more effectively. We added the asset_groups system dataset to help you easily retrieve asset group details within your custom queries. For example, join against the new dataset using the asset group ID to get the asset group name.
CSP Onboarding
Bring your own App Registration (BYOA) for Azure outposts
Outpost deployment in Azure now allows you to pre-define the needed Entra ID application registration by selecting the "Bring your own app registration" option in the Azure Outpost onboarding wizard.
Deploy outposts in your network: "Bring your own network" (BYON) - Limited GA
Meet strict network sovereignty requirements for regulated industries by deploying outposts inside your existing networks. You can now bring outposts into your own networks on AWS, Azure, and GCP and route their traffic through your own proxy. The onboarding wizard now supports customer-provided networks, proxies, and certificates. Contact Palo Alto Networks support to enable this limited GA feature.
CSPM
Modifying XQL logic of OOTB cloud security rules
You can now duplicate out-of-the-box cloud security rules, adapting them to your needs by adjusting the underlying XQL logic.
Modifying severity of OOTB cloud security rules
You can now modify the severity of out-of-the-box configuration cloud security rules.
Data Classification
Topic classification
Understand what your files contain at a glance. Cortex now automatically assigns a content-based topic label to each file during data classification, so you can group, search, and prioritize sensitive data by subject matter. File topic classification builds on the data classification engine to surface the main subject inside your files alongside existing sensitivity findings.
Data Security
Continuous Strata logging authentication
Maintain uninterrupted data logging across commercial and FedRAMP Moderate environments without manual re-authentication prompts every six months. Cortex Cloud now automatically manages secure background authentication for the Strata Logging Service, ensuring continuous data flows.
MongoDB Atlas support for Data Security Posture Management
Cortex Cloud Data Security now supports MongoDB Atlas as a data source for Data Security Posture Management (DSPM). You can onboard your MongoDB Atlas deployments to discover, classify, and assess the security posture of the data they store. After you onboard MongoDB Atlas, Cortex Cloud Data Security extends DSPM coverage to MongoDB Atlas alongside the other supported assets, giving you visibility into sensitive data and data security risks across your MongoDB Atlas environment.
Endpoint security
CaaS Workloads
Alpine Linux and other musl-based distributions are now supported for container-embedded deployments.
Enhanced issue descriptions
Malware issues from the Cortex XDR agent now include a comprehensive description of the detected threat.
Improved Linux Agent Resource Management
The Cortex XDR Linux agent now enforces per-component resource limits (CPU and memory) using Linux control groups. This ensures the agent and its subprocesses operate within predictable resource boundaries. Requires Cortex XDR Linux agent 9.3.0 or later.
External Data Ingestion and Management
Secure S3 log collection
Collect logs securely without managing long-lived credentials. You can now authenticate Amazon S3 Log Collection using Workload Identity Federation (WIF), allowing dedicated log collectors to securely connect to AWS without storing long-lived access keys. We’ve updated the onboarding wizard with an authentication selector (supporting Web Identity Federation, Access Key, or STS AssumeRole) and set WIF as the default. You can also update the authentication method on your existing instances at any time.
Group Marketplace integrations into unified connectors
Connect each vendor through a single unified connector instead of dealing with separate data sources and marketplace integrations. On the Data Sources & Integrations page, Cortex Cloud now groups related Marketplace integrations into one unified connector per vendor. This allows you to discover, add, and manage all of a vendor's capabilities from a single entry in the catalog. This new connector experience includes the following built-in features: • Centralized vault credentials: Authenticate your connectors directly with secret vaults instead of manually entering credentials, extending standard platform credential security across your capabilities. • Selective service onboarding: For multi-service connectors, such as Microsoft 365 or Google Workspace, you can choose to onboard the full suite at once or select individual services. Additional services can be enabled later without disrupting your existing configuration.
New tenants will see this updated experience across the entire catalog. Existing tenants will immediately get this new look-and-feel experience for a select number of initial Marketplace integrations.
Device Security data collector
Introducing a new data collector called Device Security, which collects alerts and device data from Strata Device Security using a new Strata Cloud Manager authentication method. Existing IoT Security data collectors will continue to operate using the legacy authentication method, now labeled IoT Security (Deprecated).
Legacy IoT Security data collectors will be discontinued in the near future. We recommend migrating to the new Device Security data collector to ensure uninterrupted data collection.
Identity Security
Find Azure access paths
Trace exactly which Azure resources an identity can reach, so you can spot risky access before attackers do. The Cortex Graph Search query builder now supports the Can Access relation for Azure, showing the effective permission paths between a source and a target after all allow and deny rules are applied. You can build these queries directly from the query builder and see each allowed path visualized in the graph.
Right-size GCP access
Reduce your cloud attack surface by removing excessive permissions from Google Cloud Platform (GCP) groups and service accounts. Cortex Cloud now identifies least privileged access recommendations for GCP groups and service accounts, so you can grant only the permissions each identity actually uses.
Broader effective access coverage
See effective access across your entire cloud estate in one place. The Cortex Cloud security graph now answers "Can this resource reach that one?" for every asset type across AWS, Azure, and GCP — not just a limited set. Each access relationship now includes the specific actions an identity or workload can perform, so you can assess real risk without untangling policy complexity.
Permissions in Graph Search
The Cortex Graph Search query builder now supports the Can Access relation for Azure and Google Cloud Platform (GCP), allowing you to trace exactly which resources an identity can reach and spot risky access before attackers do. By expanding to answer "Can this resource reach that one?" for asset types across AWS, Azure, and GCP, the Cortex Cloud security graph provides centralized visibility into effective access across your entire cloud estate. This feature maps the complete permission paths between a source and a target after all allow and deny rules are applied, visualizing each allowed path directly in the graph. Furthermore, each access relationship includes the specific actions an identity or workload can perform, enabling you to assess real risk instantly without untangling policy complexity.
Trusted domains for CIEM
Focus on the entitlement risks that matter by telling Cortex Cloud which identity domains you trust. You can now define trusted domains in Cloud Infrastructure Entitlement Management, so Cortex Cloud suppresses findings and false-positive alerts for identities that belong to those domains. Fewer noisy findings means your team spends time on the access risks that need real attention.
More cloud secrets in CIEM
Cortex Cloud now discovers more types of non-human identity secrets across your Azure and Google Cloud environments, so you can find and secure credentials that were previously invisible. Cloud Infrastructure Entitlement Management (CIEM) ingests and normalizes additional secret asset types, including Azure Entra ID client secrets, Azure storage account keys, Azure Key Vault secrets, Azure and Google Cloud SSH key pairs, and Google Cloud Secret Manager secrets. Each new secret appears in your asset inventory with full overview and identity details, such as first seen, last seen, expiration date, and whether the secret is publicly accessible. You can also see which identities and resources each secret can access or be managed by, so you can investigate exposure and rotate unrotated credentials faster.
Investigation and Response
Attack path discovery with the new graph engine
Detect and prioritize potential attack paths with Cortex Cloud’s new graph detection engine. By continuously analyzing relationships across identities, code, data, workloads, and cloud resources, the graph uncovers how seemingly isolated risks can combine into exploitable attack paths to critical assets.
Filter issues by resolution SLA and resolution timer in XQL
Query and filter issues by their resolution service-level agreement (SLA) and resolution timer values using Cortex Query Language (XQL). We now expose the Resolution SLA and Resolution Timer as filterable XQL fields. The Resolution SLA and Resolution Timer XQL schemas also include derived fields, so you can build queries, correlation rules, and dashboards that track whether issues are resolved within their defined SLA goals.
Cortex Cloud Consumption dashboard
Track your cloud usage at a glance. You can now monitor your cloud consumption over the last 90 days with a detailed breakdown by workload type and usage details across all your cloud accounts. The new Cortex Cloud Consumption dashboard shows usage trends over 7, 30, and 90-day windows. It enables filtering by date range, cloud provider, account, and asset type, with the past 365 days of data available for custom date ranges.
Kubernetes Security
Streamline onboarding for Kubernetes real-time protection
• See your XDR agent version instantly. The K8s Connector now displays your agent version alongside the bundle version. • Skip manual platform selection. The connector automatically detects your node platform type: Standard, Bottlerocket OS, Google Container-Optimized OS, or OpenShift.
Introducing Kubernetes Pods in Cortex Cloud
Protect Kubernetes Pods from misconfigurations. Kubernetes Pods deployed directly, or modified by other webhooks after their controller was approved, previously bypassed all compliance and image-trust checks. We now provide complete Kubernetes Pod support across inventory tracking, detailed asset visibility, compliance scanning, admission control prevention, and comprehensive container inspection. This closes critical security gaps identified by customers running workloads directly as pods instead of through controllers. • Pods in Cortex Cloud inventory: Cortex Cloud now provides a dedicated asset page for Kubernetes Pods in the inventory. The Kubernetes Pods page includes a relationship graph that shows how a pod connects to related Kubernetes resources. Pods are now available on Search Graph as well for discovery and investigation. • Containers table: Added a new Containers tab for Kubernetes Pod Group assets in Cortex Cloud Inventory, providing complete visibility into pod composition and container details. Use the Kubernetes Pod to investigate the security posture of individual pods and the containers that run in each pod. • Collection & Modeling: Implemented pod collection in the inventory with performance optimization for large clusters and pod-to-runtime-image relationships for complete asset tracking. This supports both K8s Connector agent and K8s Agentless deployments. • Compliance & Rules: Added Kubernetes Pod support to the compliance views, including system-rule validation for pod-scoped rego rules. This enables compliance checks on pods alongside traditional workload controllers. Custom compliance rules now support pods. • Prevention & Admission Control: Kubernetes Pods are now supported as part of CWP rules and policies, enabling the admission controller to block non-compliant pods and prevent misconfigurations at creation time.
A Kubernetes Pod Group asset represents all the identical pod replicas of a Kubernetes workload in a single unique inventory asset. The uniqueness is derived by the Kubernetes workload owner unique identifier.
Cluster deployment method visibility
Understand how your clusters are being connected and scanned by Cortex Cloud. The cluster inventory now displays the deployment method (Agentless, Connector or None) for each cluster, along with connectivity status. This gives you immediate visibility into your scanning infrastructure and helps you identify which clusters are using agentless scanning versus connector-based approaches and which clusters are not connected at all.
Agentless Kubernetes security for GCP and Azure
Automatically onboard and secure all Kubernetes clusters across your GCP and Azure accounts without manual deployment. Monitor cluster inventory, vulnerabilities, malware, secrets, and misconfigurations, automatically discovering new clusters as they are added to your account.
Marketplace Content Changes
Built-in Cortex automation commands
Execute essential playbook commands instantly without manual setup overhead. Built-in commands replace the older Core Investigation and Response and Cortex Platform - Core integrations while maintaining full functionality and improving performance.
Unified AWS cloud security automation
Consolidate your AWS cloud security management into a single comprehensive content pack to streamline operations. The updated AWS cloud pack now includes coverage for security services, eliminating the need to deploy multiple separate packs for AWS CloudWatch Logs, Systems Manager, and Network Firewall.
Serverless
Enhance security visibility for serverless layers
Secure your serverless architecture by gaining full visibility into vulnerabilities hidden within your shared code dependencies. The Vulnerabilities tab in your Lambda function now includes a Layers view, which breaks down security issues present in your reusable component packages. This allows you to quickly identify and update vulnerable Layers, instantly securing all associated functions.
Vulnerability Management
Active Vulnerability Findings Over Time widget
Track active vulnerability findings over the last 6 months in the new Active Vulnerability Findings Over Time widget on the Vulnerability Management dashboard.
AI-powered Remediation Guidance
Turn vulnerability findings into actionable commands with AI-driven, step-by-step guidance. See recommended fixes, verified vendor patch links, and risk-reducing workarounds, so your team can act faster with less manual research.
Streamlined Resolution Actions
We’ve updated the Vulnerability Issues side-panel to introduce Resolution Actions, providing a unified and consistent remediation experience across both individual issues and broader cases. When an immediate patch isn’t viable, the side-panel now surfaces approved compensating controls as a valid Resolution Action to help you mitigate risk safely. Speed up your incident response with clear, prescriptive guidance—whether that means launching a dedicated automation playbook or following step-by-step manual instructions. Recommendations are also provided at the case level, giving you access to full operational context without needing to pivot between screens.
Remediate Zero Day threats faster
Enhancements to the Vulnerability Management list view help you isolate and triage global attack surface events and major zero-day events, with greater speed. You can now easily filter vulnerabilities to focus exclusively on high-priority, newly identified emerging threats. For security events associated with multiple vulnerabilities, you can drill down to filter by a single, specific vulnerability, giving you granular visibility.
Improved Kubernetes context for Vulnerability Findings
Vulnerability findings for Kubernetes Resource asset types now include dedicated Kubernetes metadata, providing you deeper visibility into containerized environments. You can view and filter by fields such as, Cluster, Namespace, Namespace Label across the UI, XQL, and the Public API (PAPI). This enhancement provides the granular context needed to quickly isolate vulnerabilities by specific environments or microservices.
Redesigned Vulnerability Findings side panel
We have redesigned the Vulnerability Findings side-panel to put critical context right at your fingertips. Evidence fields are now front and center, giving you insight into exactly why a vulnerability was detected including additional extraction, normalization, and display of detection evidence from all Cortex scan sources.
Surfacing the detection logic, allows you to reduce the time spent investigating false positives or searching for root causes. The revamped interface allows you to assess the risk and context of a findings at a glance, accelerating your mean time to remediation (MTTR).
XDR Collectors
XDR Collectors 1.5.3: Windows 1.5.3.2503 and Linux 1.5.3.2371
XDR Collectors 1.4.3: Windows 1.4.3.1686
XDR Collectors 1.5.3 upgrade
Protect your environment with the latest security enhancements and system stability. Cortex Cloud now supports XDR Collectors version 1.5.3.2503 for Windows and version 1.5.3.2371 for Linux.
Upgraded Winlogbeat
Cortex Cloud now supports version 9.3.2 Winlogbeat for 64-bit XDR Collectors. Live 64-bit XDR Collectors receive this update automatically, while 32-bit XDR Collectors remain unaffected, as this independent update is not tied to any specific XDR Collectors version.
Last updated
Was this helpful?