> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/february-2025/feature-enhancements.md).
# Feature Enhancements
The Cortex XDR 3.13 release includes the following enhancements:
## General
| FEATURE | DESCRIPTION |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Fields added to forwarded alert email body | Cortex XDR has added the following alert fields to the body of the email sent for alert notification: Name, Description, Severity, File path, and Timestamp. |
| Adding installation tags during package creation | Streamline the deployment process by defining Endpoint tags during the creation of an agent installation package. Any tags you define will be automatically applied to all new agents deployed using the installer. |
## Detection rules
| FEATURE | DESCRIPTION |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Analytics tags highlights | Cortex XDR has introduced new advanced Analytics detection suites for emerging threats on MacOS:
- Credentials grabbing: Detects anomalous activities associated with credential grabbing.
- Sensitive information stealing: Detects anomalous activities associated with stealing sensitive personal and organizational information.
- AppleScript: Detects anomalous AppleScript operations carried out by malicious threat actors.
Cortex XDR now includes new analytics detections over a new data source for Microsoft Graph Activity logs:
- Microsoft Graph Activity logs: Detects anomalous activities in utilizing Microsoft Graph activity logs.
|
| New rule tag in alerts | Enhanced visibility into new content updates. Content version tags are added to new alerts that were generated as a result of new BTP rules introduced in a content update. |
## Endpoint security
| FEATURE | DESCRIPTION |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Protection against malicious ASP and ASPX files | For Windows-based endpoints, you can now configure Cortex XDR to analyze ASP and ASPX files, and prevent malicious ones from being written to your endpoints’ file system. |
| Visibility of CVEs without a CVSS score | Cortex XDR now includes CVEs identified by the Enhanced Vulnerability Assessment (VA) scanner that have not yet received an official CVSS score. This enhancement provides better visibility into emerging threats, enabling proactive security measures. |
## XDR Collectors
Windows 1.4.2.1373 and Linux 1.4.2.1302
For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md)
| FEATURE | DESCRIPTION |
| -------------------- | ------------------------------------------------------------- |
| XDR Collectors 1.4.2 | This release includes performance improvements and bug fixes. |
## Broker VM
Version 26.0.116 (reboot required)
For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md)
| FEATURE | DESCRIPTION |
| ------------------ | ------------------------------------------------------------- |
| Broker VM 26.0.116 | This release includes performance improvements and bug fixes. |
## API
| FEATURE | DESCRIPTION |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| New API capabilities | Significantly enhance the management and configuration experience for syslog and authentication settings by adding new APIs.
- Facilitate easier management of syslog servers at scale.
- Configure IdP and SSO, enabling administrators greater control and efficiency in enforcing and managing access control.
|
| Delete Cortex XDR agent installation packages | Cortex XDR has expanded our public API to include a new endpoint for deleting specific Cortex XDR agent installation packages. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/february-2025/feature-enhancements.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.