> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/february-2024/feature-enhancements.md).
# Feature Enhancements
The Cortex XDR 3.9 and Cortex XDR Agent 8.3 releases include the following enhancements:
## General
| Feature | Description |
| --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Augmenting VA insights in Host Card | The Host Card under Asset Scores now includes additional Vulnerability Assessment (VA) insights.This enhancement provides a detailed and high-level view of the Common Vulnerabilities and Exposures (CVE) sorted by severity, enabling you to quickly understand and prioritize security threats on each endpoint. The CVE breakdown is included only when Host Insights and Identity Threat Module licenses are activated. |
| New cloud-related attributes for security events and agent status | Cortex XDR has integrated cloud-related attributes to security events and agent status to convey essential information. |
| New Widgets in the Identity Threat Module
(Requires the Identity Threat Module add-on)
| The User Risk View in the Identity Threat Module now contains two new widgets that provide more insight into the provenance of the user.
- Common Locations - displays the countries from which the user connected most in the past few weeks.
- Common OSs - displays the operating systems the user used most in the past few weeks.
|
| Analytics Tags Highlights | Cortex XDR has updated the detectors inventory, introducing new analytics into both new and existing tags.
- Direct Syscall Analytics (New) - Advanced real-time detection of direct syscall activities, distinguishing between benign and malicious events.
- DLL Hijacking Analytics (New) - Improved analytics for identifying DLL Hijacking techniques, focusing on evasion and privilege escalation tactics.
- Global Analytics (Updated) - Enhanced detection of complex attacks, including supply chain threats and zero-day exploits, using machine learning on cross-customer references.
- Injection Analytics Improvement - Refined detection of process injection anomalies, improving identification of malicious activities.
- Impacket Analytics - Analytics for detecting Impacket-related lateral movement behaviors with high accuracy.
|
## XDR Collectors
Windows 1.4.1.1100 and Linux 1.4.1.1089
For more information on maintenance releases, see Maintenance Releases.
| Feature | Description |
| -------------------- | ------------------------------------------------------------- |
| XDR Collectors 1.4.1 | This release includes performance improvements and bug fixes. |
## Broker VM
Version 22.0.32
For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md)
| Feature | Description |
| ----------------- | ------------------------------------------------------------- |
| Broker VM 22.0.32 | This release includes performance improvements and bug fixes. |
## External Data Ingestion and Management
| Feature | Description |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Retention licenses support 31-day period | Cortex XDR retention license add-ons now support a 31-day period per license SKU purchased, instead of 30 days provided previously. This ensures a full 365-day coverage. |
## Cortex Query Language (XQL)
| Feature | Description |
| ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| New field added to xdr\_process preset
(Requires a Cortex XDR Pro license)
| Cortex XDR now includes a new field called `action_process_instance_ID` in the `xdr_process` preset. This field provides the Cortex instance ID of the process. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/february-2024/feature-enhancements.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.