For the complete documentation index, see llms.txt. This page is also available as Markdown.

Changed Features

These features have been modified or removed in this release.

FEATURE
DESCRIPTION

Access Management

  • Role setting transition: Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries have changed to allow for managing access at the individual custom object level.

  • “Restricted” access: All newly created custom objects are now Restricted by default, meaning only the user who created them can access them. The access can then be changed to Public for those customers who do not require per-object access.

  • Owner-only deletion: Only the object Owner (the user who created them) or an Administrator can delete a custom object; Editors cannot.

Enhanced application logs (EAL) ingestion

Enhanced application logs (EAL) for this release are now moved to a non-billable status. While these logs continue to be ingested to provide full visibility, they no longer consume your Data Collection (GB) license quota. As a result, the following changes are now implemented: - Quota calculation: EAL data volume is now excluded from your daily Data Collection (GB) license consumption totals. - Data Ingestion dashboard: The overall ingestion graph will reflect billable totals only; as a result, EAL data is no longer displayed on this dashboard. - NGFW Ingestion dashboard: To ensure continuity, the EAL category has been removed from the NGFW Ingestion Rate graph to align with its non-billable status.

NGFW Alert Severity Mapping

Following an update to the Detection & Mapping Service (DMS), we have corrected the severity mapping for behavioral alerts generated from Next-Generation Firewall (NGFW) detection data. Previously, some alerts identified as Critical by the detection engine were assigned a lower severity level and displayed as High in Cortex Cloud. These alerts will now correctly display as Critical to ensure accurate prioritization in the incident response workflow. Alerts with High or Medium severity remain unchanged. If you have existing automation rules or notification profiles based on alert severity, ensure you review and adjust them to account for this change.

Last updated

Was this helpful?