Changed Features

The Cortex XDR 3.11 and Cortex XDR Agent 8.5 release includes the following changes to existing functionality:

COMPONENT	AREA	DESCRIPTION
Syslog server configured with for Event Notification Forwarding (Requires a Cortex XDR Pro license and Event Forwarding add-on license)	External data ingestion and data management	Cortex XDR infrastructure is now upgraded. As a result, OpenSSL versions past end-of-life prior to 1.1.1 are no longer supported. This change relates specifically to the Syslog server configured in your environment for Event Notification Forwarding. Going forward, the OpenSSL 1.1.1 version and later are supported. If your Syslog server is running an older OpenSSL version, you should upgrade the Open SSL version immediately to avoid disruptions.
filter stage (Requires a Cortex XDR Pro license)	XQL	Cortex XDR has changed the behavior of using triple double quotes in a Cortex Query Language (XQL) filter stage with (or without) wildcards, such as | filter <field> = """<text>*""" or | filter <field> in ("""<text>*""", "<text>", "<text>*"). Currently, when using triple double quotes, the query results only include results that exactly match the prefix <text> results, as opposed to previously when the results would display results containing the prefix <text> results. Using single double quotes with the filter stage, now returns the results that contain the <text> specified. Therefore, this change will impact any saved queries, so ensure any queries using this syntax are updated to reflect this behavior change.
Email structure of forwarded alerts	Forwarded Alert Emails	When an alert is forwarded in an email, the full alert JSON file is now attached to the email and not embedded inside the email body.The email body now includes the following fields: Source Category Action Host Username Starred Alert Excluded Alert Alert ID Incident ID The attached JSON file’s content includes, with no changes, the rest of the alert information.