Changed Features

The Cortex XDR 3.9 and Cortex XDR Agent 8.3 releases include the following changes to existing functionality:

Component	Area	Description
APPS column of Broker VMs page	Broker VM	Cortex XDR has replaced the hovering action in the APPS column of the Broker VMs page to a left-click action to display the Broker VM applet settings and to Add a new Broker VM applet.
target stage	XQL	Cortex Query Language (XQL) now supports defining a target stage with a dataset type set to lookup so that the data from the current query is re-created as a new dataset using append=false. Previously, only append=true was supported for this dataset type, which appended the data from the current query to the dataset.
Endpoints table, Last Certificate Enforcement Fallback column Agent Settings profile	Certificate enforcement for Windows and macOS endpoints	To improve security, the Cortex XDR agent is now ensuring the use of a provided certificate, without using the local fallback store (enforcing using provided trusted root CA file). There are three modes of operation, set in the Agent Settings profile. Disabled (Notify) is default for existing tenants; new tenants will have the Enabled configuration by default. Enabled: Enforcement is enabled. Note, If the agent is initially unable to communicate without the local store, enforcement is not enabled and the agent will show as partially protected in the server UI. Disabled (Notify): Enforcement is disabled. Agents with this policy will trigger a visible banner in the UI to notify customers about potential risk and direct them to change the certificate and the setting. The Last Certificate Enforcement Fallback column of the Endpoints table is updated and management audit logs related to the local store fallback are received by the server. Disabled: Enforcement is disabled. Agents with this policy will trigger a visible banner in the UI to notify customers about potential risk. With this mode, the Last Certificate Enforcement Fallback column in the Endpoints table is not updated, and there are no management audit logs related to the local store fallback.