Feature Enhancements

The Cortex XDR 3.9 and Cortex XDR Agent 8.3 releases include the following enhancements:

General

Feature	Description
Augmenting VA insights in Host Card	The Host Card under Asset Scores now includes additional Vulnerability Assessment (VA) insights.This enhancement provides a detailed and high-level view of the Common Vulnerabilities and Exposures (CVE) sorted by severity, enabling you to quickly understand and prioritize security threats on each endpoint. The CVE breakdown is included only when Host Insights and Identity Threat Module licenses are activated.
New cloud-related attributes for security events and agent status	Cortex XDR has integrated cloud-related attributes to security events and agent status to convey essential information.
New Widgets in the Identity Threat Module (Requires the Identity Threat Module add-on)	The User Risk View in the Identity Threat Module now contains two new widgets that provide more insight into the provenance of the user. Common Locations - displays the countries from which the user connected most in the past few weeks. Common OSs - displays the operating systems the user used most in the past few weeks.
Analytics Tags Highlights	Cortex XDR has updated the detectors inventory, introducing new analytics into both new and existing tags. Direct Syscall Analytics (New) - Advanced real-time detection of direct syscall activities, distinguishing between benign and malicious events. DLL Hijacking Analytics (New) - Improved analytics for identifying DLL Hijacking techniques, focusing on evasion and privilege escalation tactics. Global Analytics (Updated) - Enhanced detection of complex attacks, including supply chain threats and zero-day exploits, using machine learning on cross-customer references. Injection Analytics Improvement - Refined detection of process injection anomalies, improving identification of malicious activities. Impacket Analytics - Analytics for detecting Impacket-related lateral movement behaviors with high accuracy.

XDR Collectors

Windows 1.4.1.1100 and Linux 1.4.1.1089

For more information on maintenance releases, see Maintenance Releases.

Feature	Description
XDR Collectors 1.4.1	This release includes performance improvements and bug fixes.

Broker VM

Version 22.0.32

For more information on maintenance releases, see Maintenance Releases

Feature	Description
Broker VM 22.0.32	This release includes performance improvements and bug fixes.

External Data Ingestion and Management

Feature	Description
Retention licenses support 31-day period	Cortex XDR retention license add-ons now support a 31-day period per license SKU purchased, instead of 30 days provided previously. This ensures a full 365-day coverage.

Cortex Query Language (XQL)

Feature	Description
New field added to xdr_process preset (Requires a Cortex XDR Pro license)	Cortex XDR now includes a new field called action_process_instance_ID in the xdr_process preset. This field provides the Cortex instance ID of the process.