> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026/feature-enhancements.md). # Feature Enhancements These enhancements provide new and improved capabilities. ## Analytics Rules | FEATURE | DESCRIPTION | | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Scheduled Tasks Analytics | This new suite identifies malicious persistence by tracking the installation and execution of scheduled tasks, providing deep context and generating high-fidelity alerts. | | NDR Insights Analytics | Our new network detection suite automatically correlates between low-fidelity network signals and existing alerts, transforming them into high-confidence security incidents. | | Active Directory Federation Services Analytics | This new suite identifies suspicious and irregular behavior within your Active Directory Federation Services. | | Google Workspace Analytics | This advanced suite detects attack attempts within Google Workspace, including through brute force, phishing, account manipulation, unauthorized policy modification, suspicious browser extension installations, credentials harvesting, and data collection. | | Linux Discovery Analytics | This novel suite, tailored to the Linux domain, identifies reconnaissance and host environment mapping activities. The suite detects adversaries and malicious scripts seeking to gather system-level intelligence, discover user credentials, and uncover pathways for lateral movement during the discovery phase of an attack. | | Kubernetes Credentials Analytics | This detection suite analyzes Kubernetes activity to identify credential harvesting techniques, including host file access from containers, kubelet credential file retrieval, and kubelet impersonation. | ## Broker VM **Version 31.0.57 (reboot required)** For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md). | FEATURE | DESCRIPTION | | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Legacy server connectivity | You can now easily configure OpenSSL compatibility settings directly from the Broker VM web interface to ensure uninterrupted communication with legacy servers. We added **Advanced Settings** options to allow legacy SSL renegotiation and accept certificates without an Authority Key Identifier (AKID). | | Import Configuration tool enhancements | The **Import Configuration** tool has been enhanced to streamline the Broker VM migration process to the new Broker VM image. You can now migrate your current Broker VMs to the new Debian 13 based image. **Note**: Both source and target brokers should be running the latest Broker VM 31.x version. | ## Endpoint Security | FEATURE | DESCRIPTION | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Shared objects file examination | Secure your Linux environment against hidden threats. You can now automatically block malicious code from executing through non-standard loading methods. We updated the Cortex XDR agent to examine and stop harmful shared object files before they impact your system. | ## Investigation and Response | FEATURE | DESCRIPTION | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Centralized Identity Security for Domain Controllers | Simplify your security management with the new Identity Profile to streamline the configuration and enforcement of identity security policies across Windows Domain Controllers. Monitor LDAP protection and Active Directory (AD) misconfiguration using the purpose-built unified hub. Requires the ITDR add-on. | ## XDR Collectors **XDR Collectors 1.5.2:** Windows 1.5.2.2326 and Linux 1.5.2.2173 **XDR Collectors 1.4.3:** Windows 1.4.3.1686 | FEATURE | DESCRIPTION | | ------------------------------ | ------------------------------------------------------------- | | XDR Collectors 1.5.2 and 1.4.3 | This release includes performance improvements and bug fixes. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026/feature-enhancements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.