> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/june-2024/changed-features.md). # Changed Features The Cortex XDR 3.11 and Cortex XDR Agent 8.5 release includes the following changes to existing functionality: | COMPONENT | AREA | DESCRIPTION | | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

Syslog server configured with for Event Notification Forwarding

(Requires a Cortex XDR Pro license and Event Forwarding add-on license)

| External data ingestion and data management |

Cortex XDR infrastructure is now upgraded. As a result, OpenSSL versions past end-of-life prior to 1.1.1 are no longer supported. This change relates specifically to the Syslog server configured in your environment for Event Notification Forwarding.

Going forward, the OpenSSL 1.1.1 version and later are supported. If your Syslog server is running an older OpenSSL version, you should upgrade the Open SSL version immediately to avoid disruptions.

| |

filter stage

(Requires a Cortex XDR Pro license)

| XQL | Cortex XDR has changed the behavior of using triple double quotes in a Cortex Query Language (XQL) `filter` stage with (or without) wildcards, such as `\| filter = """*"""` or `\| filter in ("""*""", "", "*")`. Currently, when using triple double quotes, the query results only include results that exactly match the prefix `` results, as opposed to previously when the results would display results containing the prefix `` results. Using single double quotes with the filter stage, now returns the results that contain the `` specified. Therefore, this change will impact any saved queries, so ensure any queries using this syntax are updated to reflect this behavior change. | | Email structure of forwarded alerts | Forwarded Alert Emails |

When an alert is forwarded in an email, the full alert JSON file is now attached to the email and not embedded inside the email body.The email body now includes the following fields:

  • Source
  • Category
  • Action
  • Host
  • Username
  • Starred Alert
  • Excluded Alert
  • Alert ID
  • Incident ID

The attached JSON file’s content includes, with no changes, the rest of the alert information.

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/june-2024/changed-features.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.