Feature Enhancements
These enhancements provide new and improved capabilities.
API
Manage Broker VMs programmatically
You can now manage and configure your Broker VMs programmatically. Use the Public API to retrieve broker details and health status, manage applets, and perform broker actions such as register, remove, reboot, upgrade, and download logs.
Broker VM
Version 32.0.51 (reboot required)
For more information on maintenance releases, see Maintenance Releases.
Upgrade applets independently
Deploy updates faster and with minimum dependences. You can now update individual Broker VM applets independently without upgrading the entire Broker VM. This reduces management overhead and delivers immediate enhancements without system-wide downtime.
Enforce TLS 1.3 communication
Meet emerging compliance demands and secure your data transmissions against modern threats. Cortex XDR now supports TLS 1.3 communication between the Broker VM and the server to ensure your environment aligns with strict cybersecurity standards.
DB collector Windows authentication
We have added Windows Authentication support to the (MSSQL) Database collector applet to enable secure connectivity in domain environments. The new authentication method supports Kerberos, NTLM and the standard SQL internal authentication.
Extended Analytics Detection Coverage
LOLBIN Execution Analytics
Catch hidden threats by detecting adversaries abusing Living-Off-The-Land-Binaries (LOLBin) system tools for proxy execution of malicious code and evade signature-based defenses. The suite leverages behavioral baselines and anomaly scoring to surface uncommon command-line patterns, unusual child processes, and rare network connections originating from LOLBins.
NDR Unmanaged Subnet Analytics
Detects malicious activity instantly from blind spots created by new or unmanaged devices. We added NDR Unmanaged Subnet Analytics to analyze the collective behavior of the subnets, eliminating the need for a historical baseline and detecting attacks on unmanaged hosts.
EDR Linux Sensitive Information Theft Analytics
A novel analytics-based detection tailored to the Linux domain, designed to identify anomalous or uncommon attempts by processes to access and extract data from sensitive system files and configuration directories. By profiling behavioral baselines, it automatically filters out standard administrative noise while exposing sophisticated adversaries, Webshells, and malicious scripts seeking to gather system-level intelligence, discover credentials, and uncover pathways for lateral movement.
SSM Remote Management Analytics
Detects suspicious activity involving AWS Systems Manager (SSM), including command execution, session access, parameter store operations, and SSM agent behavior on endpoints.
Cloud Log Tampering Analytics
Detects adversaries attempting to disable, delete, or modify cloud audit and activity logs to cover their tracks across AWS, Azure, and GCP. The suite leverages behavioral baselines and anomaly scoring to surface uncommon log-configuration changes, rare API calls targeting logging services, and unusual identities interacting with cloud telemetry pipelines.
OCI Analytics
Detects malicious activity in Oracle Cloud Infrastructure (OCI) tenants by extending Cortex cloud analytics to OCI, giving customers a unified detection layer across all four major cloud providers.
Extended EDR macOS AppleScript Analytics
The upgraded analytics detection suite uncovers adversaries abusing AppleScript to proxy malicious behavior on macOS, a technique increasingly leveraged by macOS infostealers and other threats. The suite surfaces uncommon command-line patterns and high-risk script intent across the attack lifecycle, including data exfiltration, credential and credential-file theft, cryptocurrency wallet access, sensitive application data collection, screen and clipboard capture, system information discovery (including VM/sandbox evasion checks), persistence via Launch Agents/Daemons, defense evasion and Gatekeeper bypass, and command-line obfuscation.
External Data Ingestion and Management
Device Security data collector
Introducing a new data collector called Device Security, which collects alerts and device data from Strata Device Security using a new Strata Cloud Manager authentication method. Existing IoT Security data collectors will continue to operate using the legacy authentication method, now labeled IoT Security (Deprecated).
Legacy IoT Security data collectors will be discontinued in the near future. We recommend migrating to the new Device Security data collector to ensure uninterrupted data collection.
Continuous data parsing
Avoid data gaps and keep collecting critical logs when datasets grow unexpectedly. When a dataset reaches its 2,000-field limit, you can now add a parsing rule stage to explicitly select the fields you need, which resumes the parsing. The updated error messages provide exact steps to resume data flow.
Investigation and response
Enhanced security and simplified access with ITDR Conditional Access
The new Conditional Access Policy for ITDR introduces a dynamic, context-driven security model to protect your organization's most sensitive assets. By creating granular "if-then" rules, you can now manage and control who can access systems based on real-time conditions like user identity, device status, and authentication risk. This policy balances security with user convenience, enabling you to enforce Multi-Factor Authentication (MFA) or block access for anomalous logins, significantly reducing the risk of identity-based attacks. Requires the ITDR add-on.
XDR Collectors
XDR Collectors 1.5.3: Windows 1.5.3.2503 and Linux 1.5.3.2371
XDR Collectors 1.4.3: Windows 1.4.3.1686
XDR Collectors 1.5.3 upgrade
Protect your environment with the latest security enhancements and system stability. Cortex XDR now supports XDR Collectors version 1.5.3.2503 for Windows and version 1.5.3.2371 for Linux.
Upgraded Winlogbeat
Cortex XDR now supports version 9.3.2 Winlogbeat for 64-bit XDR Collectors. Live 64-bit XDR Collectors receive this update automatically, while 32-bit XDR Collectors remain unaffected, as this independent update is not tied to any specific XDR Collectors version.
Last updated
Was this helpful?