> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/april-2025/feature-enhancements.md).
# Feature Enhancements
The Cortex XDR 3.14 release includes the following enhancements:
## Detection Rules
| FEATURE | DESCRIPTION |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| New analytics suites | Cortex XDR has introduced the following new advanced Analytics detection suites:
- Webshell Analytics: Detects webshells being installed and executed.
- Microsoft SCCM Analytics: Detects unusual or suspicious activity within Microsoft System Center Configuration Manager (SCCM) environments.
- Active Directory Certificate Services Analytics: Detects anomalous behavior within Active Directory Certificate Services (AD CS).
- Cloud Data Asset Analytics: Detects anomalous behavior involving data assets as public exposure, exfiltration, protection tampering, configuration, and disaster recovery risks.
|
## XDR Collectors
**XDR Collectors 1.5.0**: Windows 1.5.0.1733 and Linux 1.5.0.1695
**XDR Collectors 1.4.3**: Windows 1.4.3.1686
For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md)
| FEATURE | DESCRIPTION |
| ------------------------------ | ------------------------------------------------------------- |
| XDR Collectors 1.5.0 and 1.4.3 | This release includes performance improvements and bug fixes. |
## Broker VM
Version 27.0.47 (reboot required)
For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md)
| FEATURE | DESCRIPTION |
| ----------------- | ------------------------------------------------------------- |
| Broker VM 27.0.47 | This release includes performance improvements and bug fixes. |
## External Data Ingestion and Management
| FEATURE | DESCRIPTION |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Granular data ingestion metrics | New granular metrics offer improved precision in tracing data collection, support breakdown by data source, and provide insight into the data pipeline. The metrics are available for XQL querying and monitoring with correlation rules. These metrics are saved in the metrics\_source dataset and metrics\_view preset, and are reflected on the Ingestion dashboard. |
| New RBAC Dataset Views
(Requires a Cortex XDR Pro license)
| Cortex XDR now supports creating Dataset Views in the Dataset Management page to enhance data efficiency and security. Dataset Views provide a virtual representation of data from one or more datasets, based on the XQL query defined, and provide multiple benefits, such as joining datasets into logical subsets through defined queries, manipulating data without altering underlying datasets, and segregating data for specific user needs or access privileges through the Role-based access control (RBAC) settings. |
## Cortex Query Language (XQL)
| FEATURE | DESCRIPTION |
| --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enhanced XQL time picker
(Requires a Cortex XDR Pro license)
| When building Cortex Query Language (XQL) queries, the time picker now includes:
- Additional time range options, such as last 5 minutes and last 3 hours.
- Recent selections from your previous queries.
|
| XQL auto-suggestion improvements
(Requires a Cortex XDR Pro license)
| When creating a Cortex Query Language (XQL) query, you can now:
- Use the up and down arrow keys to navigate through the auto-suggestion commands and definitions.
- Select an auto-suggestion command by pressing either the Enter or Tab key.
- Press Shift+Enter to add a new line, and easily ignore the auto-suggestion output.
- Close the auto-suggestion output by pressing the Esc key.
|
## Dashboards
| FEATURE | DESCRIPTION |
| ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| New XQL series-based graph results in Widgets
(Requires a Cortex XDR Pro license)
| Custom Cortex Query Language (XQL) widget creation now supports the `Series` parameter in the Chart Editor. This feature allows users to specify a field (column) to group data by and will visualize field value distributions or compare category trends over time. Additionally, the `Series` parameter is now integrated into the view graph type stage for improved functionality. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/april-2025/feature-enhancements.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.