Feature Enhancements

The Cortex XDR 3.13 release includes the following enhancements:

General

FEATURE	DESCRIPTION
Fields added to forwarded alert email body	Cortex XDR has added the following alert fields to the body of the email sent for alert notification: Name, Description, Severity, File path, and Timestamp.
Adding installation tags during package creation	Streamline the deployment process by defining Endpoint tags during the creation of an agent installation package. Any tags you define will be automatically applied to all new agents deployed using the installer.

Detection rules

FEATURE	DESCRIPTION
Analytics tags highlights	Cortex XDR has introduced new advanced Analytics detection suites for emerging threats on MacOS: Credentials grabbing: Detects anomalous activities associated with credential grabbing. Sensitive information stealing: Detects anomalous activities associated with stealing sensitive personal and organizational information. AppleScript: Detects anomalous AppleScript operations carried out by malicious threat actors. Cortex XDR now includes new analytics detections over a new data source for Microsoft Graph Activity logs: Microsoft Graph Activity logs: Detects anomalous activities in utilizing Microsoft Graph activity logs.
New rule tag in alerts	Enhanced visibility into new content updates. Content version tags are added to new alerts that were generated as a result of new BTP rules introduced in a content update.

Endpoint security

FEATURE	DESCRIPTION
Protection against malicious ASP and ASPX files	For Windows-based endpoints, you can now configure Cortex XDR to analyze ASP and ASPX files, and prevent malicious ones from being written to your endpoints’ file system.
Visibility of CVEs without a CVSS score	Cortex XDR now includes CVEs identified by the Enhanced Vulnerability Assessment (VA) scanner that have not yet received an official CVSS score. This enhancement provides better visibility into emerging threats, enabling proactive security measures.

XDR Collectors

Windows 1.4.2.1373 and Linux 1.4.2.1302

For more information on maintenance releases, see Maintenance Releases

FEATURE	DESCRIPTION
XDR Collectors 1.4.2	This release includes performance improvements and bug fixes.

Broker VM

Version 26.0.116 (reboot required)

For more information on maintenance releases, see Maintenance Releases

FEATURE	DESCRIPTION
Broker VM 26.0.116	This release includes performance improvements and bug fixes.

API

FEATURE	DESCRIPTION
New API capabilities	Significantly enhance the management and configuration experience for syslog and authentication settings by adding new APIs. Facilitate easier management of syslog servers at scale. Configure IdP and SSO, enabling administrators greater control and efficiency in enforcing and managing access control.
Delete Cortex XDR agent installation packages	Cortex XDR has expanded our public API to include a new endpoint for deleting specific Cortex XDR agent installation packages.