Feature Enhancements
These enhancements provide new and improved capabilities.
General
Consolidated CaaS resource visibility
Improve security oversight and simplify asset management by viewing CaaS (Containers as a Service) resources within a dedicated section of the Asset Inventory. This update organizes resources from Amazon ECS, Google Cloud Run, and Azure Container Instances into a single, purpose-built view under Compute assets, making it easier to locate, monitor, and assess the security posture of your cross-cloud CaaS deployments.
Enhanced notification forwarding
To help you prioritize and resolve security issues more effectively, issue notifications sent to Amazon S3, Amazon SQS, Webhook, Splunk, and email now provide additional asset and remediation information. Notification fields have been expanded to include the asset name, cloud resource name, asset tags, account name, region, and evidence.
Administrator control for saved views and filters
Keep your workspace clean and relevant. Administrators can now remove unused or outdated saved views and filters, including those created by other users.
Autodetect AWS Web Application Firewall
Gain deeper visibility and insights into your internet-exposed cloud assets with new automatic detection of AWS Web Application Firewall (AWS WAF) instances.
Associate cloud security rules with custom controls
You can now associate out-of-the-box config, identity, and AI cloud security rules with custom compliance controls.
Event-based Asset Ingestion (EAI) parity with Prisma Cloud
Monitor your cloud environment in real-time with improved data processing speeds. Cortex Cloud now has Event-Assisted Ingestion parity with Prisma Cloud.
Access Management
Granular per-object access
Strengthen least-privilege access with granular permissions for user groups across report templates, playbooks, scripts, and saved queries.
Expanding SBAC with Account Name
Scope-Based Access Control (SBAC) has been enhanced to provide more granular control over your access policies. You can now define Asset Groups that include the Account Name attribute for scope-based access control. Continue to use the existing Realm attribute whenever you need to scope based on the Account ID.
AI Security
Expanded AI package inventory
Identify vulnerable AI packages across your entire infrastructure. You can now track AI software packages discovered on compute assets alongside those in your code repositories. We added a "source" attribute to the inventory to help you quickly distinguish between packages found in code or deployed on compute assets.
Locate AI workloads instantly
Locate AI-related workloads instantly. You can now identify compute assets that deploy AI models or contain AI software in their software bill of materials (SBOM). We introduced the "AI associated" insight to help you filter and manage these assets across your environment.
Vertex "Model Garden" discovery
Gain full visibility into your AI model usage. You can now track and manage GCP Vertex AI "Model Garden" models as assets, even when they are used without a specific model endpoint. We enriched these assets with activity data, including usage frequency and last-used dates, so you can optimize your resources and easily identify inactive models.
Enhanced open-source model detection
All types of models from "Hugging Face" when found on virtual machines are now identified as self-managed and open-source models, helping you get a full AI-BOM of your environment.
API
Billing Contributors API
A new public API endpoint is introduced to retrieve a list of unique active contributors factored into your billing. This allows you to gain full transparency into your billable seats.
Application Security, Cloud Workflow Protection, API Security
Enhanced CLI experience
Reduce onboarding friction, standardize scan controls, and deliver structured results across code and image scans.
Install directly from the terminal: Install the Cortex CLI directly from your command line using Homebrew (macOS) or Scoop (Windows)
Consistent scan output: The Cortex CLI now delivers a unified output experience across code and image scans. Results are presented in a standardized structure with a real-time progress indicator, findings grouped by scanner, CVE tables, secrets validation status, and a clear scan summary
Unified global flags (AppSec and CWP): The Cortex CLI introduces new global flags that work across both scan types
Improved error handling: Troubleshoot faster with clear, categorized error messages instead of raw stack traces
ASPM
Enhanced Urgency scoring coverage
Prioritize remediation and eliminate developer noise with context-aware Urgency scoring across a broader set of runtime environments and risk signals.
Expanded runtime coverage: Extend Urgency calculations to active VM images and instances
Compensating control evaluation: Automatically lower scores when compensating controls, such as XDR Agent coverage or manual security controls, are detected
AWS API key identity correlation: Detected AWS API keys are now correlated with their associated identity to improve impact assessment and prioritize urgency
ASPM Command Center
Accelerate cases and issues triage and remediation delegation by drilling down from posture metrics directly into the relevant views.
Improved application and time filtering: You can now filter the Command Center by one or more applications and a time range to better focus your view and prioritize efforts
Prioritization funnel: You can now drill down into each funnel insight to view supporting evidence, such as blocked findings and prioritized issues
Asset Inventory
Drift detection highlight in Container Instances
Container Instances asset cards in Asset Inventory now include a Security Drift Detected highlight and a dedicated Security Drift tab, making it easy to identify containers that have deviated from their base image. These drifts expose vulnerabilities, misconfigurations, compliance violations, and other security risks introduced at runtime that were not part of the base image.
Base Image Visibility for Container Images
You can now identify the base image for any Build, Registry, or Runtime container image directly from its asset details page. With the new has base reference and is base reference for relationships in Security Graph, you can trace image lineage and assess vulnerability impact in a single query. Define custom Base Image Rules to mark foundational Registry Images, create targeted asset groups and policies, and quickly determine whether vulnerabilities originate from a base image layer. This streamlines your security investigations and accelerates incident response.
Attack Surface Management
Website data in CloudASM
Continuously discover and monitor your website inventory and web technologies, identify your insecure and misconfigured websites, and identify sites failing security best practices and putting users at risk.
Automation
Performance improvements for scripts and playbooks
Enhance the user experience when managing security workflows with modernized interface improvements and optimized memory usage across the Scripts and Playbooks pages to maintain a seamless and cohesive user experience.
Broker VM
Version 31.0.57 (reboot required)
For more information on maintenance releases, see Maintenance Releases.
Legacy server connectivity
You can now easily configure OpenSSL compatibility settings directly from the Broker VM web interface to ensure uninterrupted communication with legacy servers. We added Advanced Settings options to allow legacy SSL renegotiation and accept certificates without an Authority Key Identifier (AKID).
Import Configuration tool enhancements
The Import Configuration tool has been enhanced to streamline the Broker VM migration process to the new Broker VM image. You can now migrate your current Broker VMs to the new Debian 13 based image.
Both source and target brokers should be running the latest Broker VM 31.x version.
Compliance
Compliance Overview Dashboard
The Compliance Overview Dashboard presents a centralized view of your organization's compliance performance against industry standards and your own internal security frameworks.
Updated compliance score calculation
We updated the compliance score calculation to ensure it reflects the status of all assessed controls for all assessed assets.
Cortex Agentic Assistant
Chat with the Agentic Assistant directly in Slack
Access Agentic Assistant more easily across your daily applications. You can now trigger the Agentic Assistant from your Slack, give it tasks, interact with it and get the results on your existing workspace.
Natural language visualizations
Turn questions into charts in seconds, identify security trends, and build custom widgets without writing a line of code using the Cortex Agentic Assistant.
Enhanced AI product support
The upgraded Help Center agent delivers instant how-to support and helps you navigate in-product support cases. It stays aware of your support issues to provide more relevant guidance in context.
CSP Onboarding
Alibaba Cloud support
Secure your Alibaba Cloud environments directly from Cortex Cloud. You can now onboard your Alibaba Cloud accounts and gain unified security visibility alongside your AWS, Azure, GCP, and OCI environments. Cortex Cloud automatically discovers your Alibaba Cloud assets and evaluates your security posture with out-of-the-box policies.
Onboard Microsoft Entra ID only
Connect Microsoft Entra ID independently of tenant-level onboarding to unlock identity-based capabilities, including CIEM, identity posture, and Entra ID sign-in logs. When onboarding Azure subscriptions or Management Groups, you can now enable Entra ID to achieve full identity visibility without requiring tenant-level scope.
OCI audit log normalization
Query Oracle Cloud Infrastructure (OCI) audit logs alongside AWS, Azure, and GCP activity using a unified schema. OCI audit logs collected through the cloud onboarding flow are now normalized into the cloud_audit_logs dataset, enabling consistent cross-cloud investigation and alerting through XQL.
Cloud onboarding least-privilege access
Reduce your exposure to cloud threats with least-privilege access. We now provide least-privilege access across all supported cloud providers, helping you minimize unnecessary permissions and tighten your security.
Bring your own Azure EventHub
Reduce cloud audit log collection costs and improve operational efficiency by routing cloud data through your own Azure EventHub. You can now connect your own Azure EventHub for cloud audit log collection, eliminating redundant data transfer overhead and giving you direct control over your data pipeline.
Manual AWS onboarding
Gain full control over AWS onboarding with a manual setup flow. Provision the required resources and IAM permissions yourself, allowing you to meet strict security, compliance, and infrastructure requirements without dependency on vendor templates.
Manual GCP project onboarding
Maintain compliance with your organization's deployment standards when connecting GCP projects. We added a manual onboarding option that lets you use your own Terraform templates to configure service accounts and permissions, so your cloud setup stays aligned with internal governance requirements.
CWP Compliance
Enhanced evidence for findings
Improve remediation efficiency with detailed evidence for every security finding. The update includes visibility into the exact configuration values, such as bind address or file size parameters, that triggered the issue, providing the necessary context to resolve misconfigurations effectively.
Data Classification
Improved classification accuracy for semi-structured data
We have refined our engine’s ability to parse the internal hierarchy and element relationships within JSON and similar formats. By more accurately distinguishing between keys, values, and nested structures, the engine now delivers higher detection precision across complex, modern data formats.
Data Security
Expanded DSPM support for on-premise databases
Expanded DSPM support for on-premise databases enhances visibility into sensitive data stored in enterprise databases, outside of the cloud. Organizations with hybrid infrastructure can now identify data exposure risks and extend DSPM governance across both on-prem and cloud environments.
OCI object storage
Scale your data security as your cloud environment grows. You now have full visibility into OCI Object Storage with automated discovery and classification to prevent data leaks. This update expands our support for Oracle Cloud Infrastructure (OCI) to ensure your storage is always protected.
Expanded DSPM support for Government Cloud environments
Expanded DSPM support for Government Cloud environments enables sensitive data discovery across AWS GovCloud and GCP Government Cloud, allowing federal and state organizations to apply DSPM capabilities across the majority of supported cloud services while maintaining compliance with government cloud requirements.
Data Security Platform
Data Security Command Center (Beta)
Monitor your data security from a centralized command center. We introduced the Data Security Command Center, providing a unified dashboard for monitoring data discovery, classification status, and all security aspects across connected data stores.
Endpoint Security
Advanced prevention for macOS
New macOS Kernel behavioural monitoring identifies and neutralizes privilege escalation attempts in near-real-time.
Shared objects file examination
Secure your Linux environment against hidden threats. You can now automatically block malicious code from executing through non-standard loading methods. We updated the Cortex XDR agent to examine and stop harmful shared object files before they impact your system.
On-write malicious file detection
Stop cross-platform threats from entering your network. You can now detect malicious mach-o files and non-native macOS binaries (such as Windows PEs and Linux ELFs) the moment they are saved to your system. We updated the Cortex XDR agent to provide comprehensive on-write detection for these binary types.
Advanced Java malware protection
Prevent cyberattacks from compromising your applications. You can now automatically detect and block malicious Java-based threats the moment they appear or are saved to your system. We added real-time on-write protection for all Java files.
External Data Ingestion and Management
New Cloud NGFW data source
Gain complete visibility into your cloud-native network security with the new CNGFW (Cloud NGFW) data source. You can now stream traffic and application logs directly to Cortex Cloud with support to cross-region and cross-account connections. We introduced this distinct connector to handle unique cloud-native identifiers, ensuring seamless log ingestion and analysis for your managed security services.
Graph Search
SBAC enforcement in Graph Search
Safely explore your environment in Graph Search with precise permission management. We introduced Scope-Based Access Control (SBAC) to give you granular control over user scope. You can now assign users to User Groups and Asset Groups, ensuring they only see authorized graph nodes and relationships.
Identity Security
Unified human identities
Unified Human Identities help teams understand true access relationships, prioritize identity risk, and detect excessive or risky privileges at the human level by creating a single virtual identity that links a person's accounts across directories, cloud IdPs, and SaaS applications.
OCI effective permissions
Strengthen your Oracle Cloud identity security with expanded permission analysis. We enhanced OCI effective permission calculations, adding Identity Domain support, additional dynamic group sources, and pseudo-resource handling for comprehensive OCI identity governance.
Identity Security navigation and inventories
Navigate identity security faster with a redesigned menu and improved inventories. We reshaped the Identity Security navigation and inventory views, providing a more intuitive layout that aligns with how security teams investigate and manage cloud identities.
GCP inactive identity detection
Identify dormant GCP identities that increase your attack surface. We added inactive identity detection for Google Cloud Platform users, so security teams can revoke unnecessary access and reduce risk.
Investigation and Response
Case Timeline view
Streamline the entire investigation lifecycle with an automatically generated, end-to-end case timeline that captures every action, artifact, and piece of evidence in one place, saving time and eliminating manual work.
Centralized issue resolution
Simplified issue-level remediation by centralizing all remediation actions in one place. From the Resolution tab, you can access recommended and pending actions, run playbooks, and complete manual playbook tasks, with seamless sync to the case's Resolution Center.
Integrated asset context for investigations
Provides richer investigation context by connecting asset data directly to cases and issues.
Service Level Agreements (SLAs) for issue resolution
Reduce security risk and ensure accountability with SLAs for issue resolution. These SLAs ensure teams resolve critical issues within a consistent, predictable timeframe.
Issue exceptions
Formalize risk deferrals and align security alerts with operational constraints using issue exceptions. This feature allows you to "snooze" or exempt specific issues while maintaining oversight through documented justifications and an approval workflow.
Kubernetes Security
Unified Kubernetes cluster management
Manage your infrastructure from a single, streamlined interface. You can now access all controls directly from the Kubernetes Clusters page instead of navigating legacy connectivity screens. We consolidated these tools into a unified view to simplify your workflow and remove unnecessary navigation steps.
Enhanced security and deployment for Kubernetes Connectors
Minimize your attack surface by applying stricter security controls to your Kubernetes connectors. Recent updates include:
Private registry support: You can now pull images directly from private container registries.
GitOps integration: The standalone installer now fully supports GitOps workflows.
Least privilege enforcement: Restrict connector management to specific namespaces rather than the entire cluster. We have narrowed the access scope and removed unnecessary secret creation permissions to better protect your environment.
Tag Kubernetes endpoints instantly
Automate your security deployment. Our new tag support for Kubernetes lets you seamlessly associate XDR security profiles with specific connectors during configuration.
Enhanced KSPM Graph
We've introduced several design improvements to the KSPM Graph focused on streamlining your user experience. You can now more intuitively explore the relationships between your workloads, nodes, and cloud resources to seamlessly map and manage your cluster topology and security posture.
Maintain system availability
Maintain system availability during unexpected disruptions. You can now choose whether to allow or block requests if the admission controller is unreachable. We added a Failure Policy setting to give you full control over your environment's stability.
On-demand Kubernetes cluster scans
Secure your environment instantly. You no longer have to wait for scheduled cycles to evaluate newly deployed resources, including your inventory, containers, and nodes. We added a Request Scan button and API support so you can trigger on-demand cluster scans and see results in minutes.
Optimized resource usage
Optimize system performance by eliminating redundant security scans. Your devices run more efficiently because the XDR agent automatically disables Adaptive Vulnerability Assessment (AVA) when a KSPM connector is deployed. The KSPM posture module now handles the AVA scan directly to save local resources.
XDR Collectors
XDR Collectors 1.5.2: Windows 1.5.2.2326 and Linux 1.5.2.2173
XDR Collectors 1.4.3: Windows 1.4.3.1686
XDR Collectors 1.5.2 and 1.4.3
This release includes performance improvements and bug fixes.
Last updated
Was this helpful?