Feature Enhancements
These enhancements provide new and improved capabilities.
General
New forwarding integrations for cases and issues
Streamline issue and case management workflows by forwarding cases and issues to new destinations such as Splunk, Amazon SQS, Amazon S3, and Webhook, allowing you to manage investigations in external systems or meet strict data retention requirements.
Asset-level rule configuration
Support for asset-based rules allows Exclusion, Starring, Scoring, and Playbook rules to be configured for specific asset objects, enabling tailored automation and notifications per account or asset group.
Analytics rules
Process Anomaly Analytics
Detect malicious processes by identifying abnormal behavior patterns in your Windows environment. We added a new analytics suite that monitors process history to expose hidden threats.
Enhanced RDP Analytics
Protect your network from unauthorized access by automatically flagging unusual remote desktop (RDP) activity. We introduced new alerts that combine session data with behavior analysis to create actionable incidents.
EDR macOS Generic Persistence
Keep your endpoints clean by detecting the subtle methods hackers use to remain hidden after an initial breach. We expanded our coverage to identify new techniques used by infostealers and advanced threats.
Webshell Analytics
Protect both managed and unmanaged servers from unauthorized web-based control. We expanded our detection capabilities and integrated network protocol inspection to cover more server types.
Broker VM
Version 30.0.52 (reboot required)
For more information on maintenance releases, see Maintenance Releases.
New Broker VM image
Experience improved security and system stability with our new Broker VM image. New Broker VM deployments now run on a modern operating system (Debian 13) to ensure long-term support. While currently available for new setups, we are finalizing a migration path for existing brokers in a future update. Note: This feature will be available in your tenant starting February 22, 2026.
Cortex Agentic Assistant
Cortex Agentic Assistant supported regions
The Cortex Agentic Assistant is currently available for tenants in the following regions:
United States (US) - Europe (EU)
Canada (CA)
United Kingdom (UK)
South Korea (KR)
Singapore (SG)
Australia (AU)
Japan (JP)
India (IN)
Germany (DE)
France (FR)
Native agent interoperability via MCP
Cortex Agentic Assistant now supports native interaction with external environments via the Model Context Protocol (MCP). Cortex AI Agents can seamlessly communicate with third-party MCP servers to discover available tools and automatically generate agentic actions, enabling you to automate more complex security tasks and accelerate incident response.
Automation Engineer Agent
Accelerate script creation through an intuitive, conversational chat experience. Use natural language prompts to build and refine secure, high-quality Python scripts. The agent applies security best practices and uses the Agentix Automation SDK to ensure high-quality results.
Cortex Query Language (XQL)
Secure, personalized queries
Protect sensitive investigation data and ensure users only see their own query syntax and results, preventing unauthorized access to private data. We added a restriction setting for administrators to streamline the Query Center for non-admin users.
Clearer query accountability
Audit your searches accurately. Instantly see if a query was run by a person, a system, or an API key to speed up troubleshooting and security reviews. We standardized field labels and updated the "Issued by" field to clearly distinguish between who owns a query and who ran it.
Email Security
New command center and updated remediation engine in the Advanced Email Security module
Assess and manage security posture by watching email threats and response actions unfold in real time from the new, interactive Email Security Command Center. Available with the Advanced Email Security add-on.
Endpoint
Secure Linux workloads with broader protection coverage
Prevent malicious activity on more Linux systems without requiring kernel-level access. We expanded Child Process Protection to support User Mode, ensuring your workloads stay secure even when kernel modules aren't available. This update provides broader coverage and simpler deployment for diverse Linux environments.
Block malicious USB device attacks on macOS
Protect your macOS systems from unauthorized hardware attacks and malicious USB devices. We launched the Malicious Device Prevention module to identify and block tools like the "USB Rubber Ducky" that exploit device trust to inject unauthorized keystrokes and similar actions. This update reduces your physical attack surface and prevents hardware-based social engineering threats from compromising your data.
Isolate compromised supervised iOS devices from the console
Stop potential threats from spreading by instantly cutting off network access for compromised supervised iOS devices with Network Shield enabled. You can now isolate supervised iPhones and iPads directly from the management console to block all unauthorized traffic. Your users will see clear notifications upon isolation activation, and on their lock and home screens while the device is in this secure state.
Amazon ECS EC2 agent installer
Expanded runtime protection for AWS ECS EC2 workloads improves real-time defense against malware, exploits, and behavioral threats using the XDR agent to help teams stop attackers.
Simplify endpoint tag management using API
Organize your environment more efficiently. Using API, you can now maintain the available tag list by permanently removing unused endpoint tags from your system.
External Data Ingestion and Management
Accurate Authentication Story logic
Identify threats more accurately with refined logic that ensures only high-quality, fully contextualized data generates authentication stories. We updated the mandatory field requirements, including making the outcome reason field optional, to focus on the most relevant data.
Unified data onboarding experience
Save time and reduce complexity by managing all data sources and Marketplace integrations from a single, streamlined location. We renamed the Data Sources page to Data Sources & Integrations to eliminate the need for multiple portals when configuring content like correlation rules, dashboards, and playbooks. This unified workflow creates a more efficient experience for managing all your ingestion and automation needs. Note: This change merges the functional scope of existing permissions. Users, user groups, and API keys with View/Edit permissions for either Data Sources or Integrations now have full access to manage both on the unified page. Review your administrative assignments to ensure they align with this expanded access.
Playbooks
Conflict-free playbook editing
Prevent concurrent playbook editing to ensure your team can build and modify automation workflows without conflicts. The system now locks a playbook during edits and automatically releases the lock when you log out or your session expires. Additionally, a new permission allows designated users to manually unlock playbooks directly from the Playbooks page or editor.
Playbooks and Scripts
Improved Playbooks and Scripts access control
Improve access control granularity for Playbooks and Scripts by enabling administrators to set Playbooks or Scripts permissions to None in certain scenarios.
RBAC and SBAC permissions
Manage access to objects
Enforce least privileged access by managing individual instances of dashboards. New, optional object-based permissions provide granular control over specific items. This unified Objects approach allows you to decide exactly who can view or edit each specific dashboard by sharing it with others as Viewer or Editor.
Enhanced Asset SBAC logs
Gain a more complete and transparent record of your environment configurations with expanded tracking. We updated Management Audit Logs to include all changes related to asset-led Scope-Based Access Control (SBAC).
SBAC for cases and issues without inventory assets or endpoints
Secure your data visibility with stricter default access for cases and issues without specific asset or endpoint references. You can now separately configure which users have access to issues and cases that lack an asset reference or where the referenced asset is not in All Assets and All Endpoints inventories. We added a new optional setting to ensure authorized users can still view all relevant data.
Note: This change affects users who previously had visibility into these items by default. To restore access, administrators must manually enable the new setting in the user's role configuration. For detailed instructions, see Manage User Scope.
Secure issue exclusion access
Keep sensitive data private while managing Issues effectively. When defining user roles, you can now restrict access to the Issue Exclusions page, so only authorized users can view and manage Issue exclusion rules, protecting the associated data.
XDR Collectors
XDR Collectors 1.5.1: Windows 1.5.1.2048 and Linux 1.5.1.1950
XDR Collectors 1.4.3: Windows 1.4.3.1686
Enhanced visibility and auditing of XDR Collectors
Cortex XSIAM now provides enhanced error visibility and auditing for XDR Collectors. This enables you to quickly identify and resolve application, connectivity, and processing errors, simplifying troubleshooting and ensuring your critical workflows remain uninterrupted.
Last updated
Was this helpful?