Release Highlights

The Cortex XDR 3.8 and Agent 8.2 releases include the following highlights:

Feature	Description
Security modules	Cortex XDR introduces new prevention modules that provide more detection and protection coverage capabilities. Container-escaping protection (Linux): Prevention against malicious attempts at escaping a container to gain access to the Linux host or to other container. Ransomware Protection (macOS): Enhancement of the defense module to improve the protection against ransomware attacks on macOS endpoints.
Dynamic dashboards (Requires a Cortex XDR Pro license)	Cortex XDR provides new capabilities for refining the scope of data on a dashboard. You can easily adapt dashboard data to fit a specific investigation, and filter data across all dashboard widgets. These capabilities include: Defining fixed dashboard filters based on static or dynamic inputs. Dashboard users can select single or multiple values by which to filter the data. These filters affect all of the dashboard widgets that use the configured parameter in their query. Defining in-dashboard drilldowns that trigger contextual changes on the dashboard. Defining drilldowns that map parameters to target dashboards.
Flexible hot storage retention license	To help accommodate varying storage requirements for different retention periods and datasets, Cortex XDR now includes a new additional Hot Storage license. This license enables you to set the amount of flexible Hot Storage based retention designated for a dataset and the priority for the dataset’s Hot Storage. You can purchase this storage-based license instead of our current period-based retention licenses, which is managed from the Dataset Management page. Read more in License Retention and Dataset Management.
New cloud security agent (Beta)	To ease the protection and visibility efforts in your cloud environment, customers using both Cortex and Prisma Cloud Compute solutions can use a single agent providing end to end prevention and vulnerability coverage on Linux cloud platforms. Reach out to your Palo Alto Networks representative to activate the full beta capabilities.
New Broker VM image	Cortex XDR now includes a new Broker VM image with enhanced capabilities, as well as an updated operating system (Ubuntu 20.04). Going forward, upgrading Broker VMs to a new version will only be supported by brokers installed with this new image. Instructions for migrating your brokers to the new image are explained here.
New XQL incidents and alerts datasets (Requires a Cortex XDR Pro license)	To help you query data related to the Incidents and Alerts tables, Cortex XDR now includes new datasets called incidents and alerts.
MBR Protection Module	Cortex XDR introduces an improved detection engine on the Cortex XDR agent to enhance its protection against malicious Master Boot Record (MBR) manipulations.