Feature Enhancements
These enhancements provide new and improved capabilities.
Analytics Rules
Scheduled Tasks Analytics
This new suite identifies malicious persistence by tracking the installation and execution of scheduled tasks, providing deep context and generating high-fidelity alerts.
NDR Insights Analytics
Our new network detection suite automatically correlates between low-fidelity network signals and existing alerts, transforming them into high-confidence security incidents.
Active Directory Federation Services Analytics
This new suite identifies suspicious and irregular behavior within your Active Directory Federation Services.
Google Workspace Analytics
This advanced suite detects attack attempts within Google Workspace, including through brute force, phishing, account manipulation, unauthorized policy modification, suspicious browser extension installations, credentials harvesting, and data collection.
Linux Discovery Analytics
This novel suite, tailored to the Linux domain, identifies reconnaissance and host environment mapping activities. The suite detects adversaries and malicious scripts seeking to gather system-level intelligence, discover user credentials, and uncover pathways for lateral movement during the discovery phase of an attack.
Kubernetes Credentials Analytics
This detection suite analyzes Kubernetes activity to identify credential harvesting techniques, including host file access from containers, kubelet credential file retrieval, and kubelet impersonation.
Broker VM
Version 31.0.57 (reboot required)
For more information on maintenance releases, see Maintenance Releases.
Legacy server connectivity
You can now easily configure OpenSSL compatibility settings directly from the Broker VM web interface to ensure uninterrupted communication with legacy servers. We added Advanced Settings options to allow legacy SSL renegotiation and accept certificates without an Authority Key Identifier (AKID).
Import Configuration tool enhancements
The Import Configuration tool has been enhanced to streamline the Broker VM migration process to the new Broker VM image. You can now migrate your current Broker VMs to the new Debian 13 based image. Note: Both source and target brokers should be running the latest Broker VM 31.x version.
Endpoint Security
Shared objects file examination
Secure your Linux environment against hidden threats. You can now automatically block malicious code from executing through non-standard loading methods. We updated the Cortex XDR agent to examine and stop harmful shared object files before they impact your system.
Investigation and Response
Centralized Identity Security for Domain Controllers
Simplify your security management with the new Identity Profile to streamline the configuration and enforcement of identity security policies across Windows Domain Controllers. Monitor LDAP protection and Active Directory (AD) misconfiguration using the purpose-built unified hub. Requires the ITDR add-on.
XDR Collectors
XDR Collectors 1.5.2: Windows 1.5.2.2326 and Linux 1.5.2.2173
XDR Collectors 1.4.3: Windows 1.4.3.1686
XDR Collectors 1.5.2 and 1.4.3
This release includes performance improvements and bug fixes.
Last updated
Was this helpful?