New and improved widgets help you measure the operational efficiency of incident and alert handling, and identify issues in the incident response process. The widgets identify peaks in incident and alert creation, provide visibility into the incident lifecycle, and help balance workloads by identifying the incidents assigned to each analyst:
XDR collectors upgraded Filebeat and Winlogbeat versions
(Requires a Cortex XDR Pro per GB license)
| Cortex XDR now supports using Filebeat and Winlogbeat version 8.8.1 when using XDR collectors on Windows and Linux machines. | |Updated XDR Collectors for Linux and Windows Python versions
(Requires a Cortex XDR Pro per GB license)
| Cortex XDR has upgraded the XDR Collectors to use Linux Python 3.9.17 and Windows Python 3.7.17 on 32-bit or 64-bit. | ## Broker VM Version 21.1.12 For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md) | Feature | Description | | ----------------- | ------------------------------------------------------------- | | Broker VM 21.1.12 | This release includes performance improvements and bug fixes. | ## External Data Ingestion and Management | Feature | Description | | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Lookup management enhancements |New XQL convert\_to\_base\_64 function
(Requires a Cortex XDR Pro license)
| Corex XDR now supports a new function called `convert_to_base_64`, which converts the base64-decoded input to the encoded string format. See more in [convert\_to\_base\_64](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/convert_to_base_64). | |New XQL datasets subset of xdr\_data
(Requires a Cortex XDR Pro license)
|To provide faster query results, instead of querying the entire xdr\_data dataset, Cortex XDR added the following three datasets:
vpn\_logs: VPN logs, such as GlobalProtect.auth\_logs: Authentication logs, such as Okta.login\_logs: Login logs, such as WEC.The fields contained in any of these datasets are a subset of the fields in the xdr\_data dataset.
New system field added to XDR Collectors datasets
(Requires a Cortex XDR Pro per GB license)
| A new system field called `_collector_internal_ip_address` was added to all XDR Collector datasets including Filebeat and Winlogbeat data. This system field provides the internal IP of the endpoint. | ## General | Feature | Description | | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | New Cortex In-App documentation |Cortex XDR now includes in-product documentation that helps you find information about new and existing features, reference material, and common workflows. While you're working with Cortex products (XDR/XSIAM/XSOAR), the documentation will launch relative to your current location from within the product.
Stay tuned for the Help Chat (which will gradually be rolled out), as part of the Cortex XDR Help Center. With the AI driven Help Chat, you will be able to asks questions about features and tasks and immediately receive a response.
| | Enabling automatic backup in Cortex XDR | To better secure your machines against ransomware attacks, a new solution based on native operating system backup mechanisms (Time Machine from MacOS and Shadow Copy from Windows) allows customers to turn on automatic backups from Cortex XDR. | | Cortex SSO improvements | For SSO configuration of Cortex XDR, you now have the option to enter a metadata URL, rather than manually providing the IdP SSO URL, issuer ID and x.509 certificate. | | Refresh all dashboard widgets | Dashboards now include a refresh icon that updates the data for all dashboard widgets with a single click. | | Analytics Detector Tags | A new tag type, Detector Tags, has been added to Alerts, Incidents, and Analytics BIOC Rules. This tag enables you to filter for specific detectors such as Identity Threat, Identity Analytics, Alert Analytics. The addition of Detector Tags enables more efficient data analysis and threat management. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2023-xdr/october-2023/feature-enhancements.md?ask=