> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-2026/feature-enhancements.md). # Feature Enhancements These enhancements provide new and improved capabilities. ## General | FEATURE | DESCRIPTION | | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | New forwarding integrations for cases and issues | Streamline issue and case management workflows by forwarding cases and issues to new destinations such as Splunk, Amazon SQS, Amazon S3, and Webhook, allowing you to manage investigations in external systems or meet strict data retention requirements. | | Asset-level rule configuration | Support for asset-based rules allows Exclusion, Starring, Scoring, and Playbook rules to be configured for specific asset objects, enabling tailored automation and notifications per account or asset group. | ## Analytics rules | FEATURE | DESCRIPTION | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Process Anomaly Analytics | Detect malicious processes by identifying abnormal behavior patterns in your Windows environment. We added a new analytics suite that monitors process history to expose hidden threats. | | Enhanced RDP Analytics | Protect your network from unauthorized access by automatically flagging unusual remote desktop (RDP) activity. We introduced new alerts that combine session data with behavior analysis to create actionable incidents. | | EDR macOS Generic Persistence | Keep your endpoints clean by detecting the subtle methods hackers use to remain hidden after an initial breach. We expanded our coverage to identify new techniques used by infostealers and advanced threats. | | Webshell Analytics | Protect both managed and unmanaged servers from unauthorized web-based control. We expanded our detection capabilities and integrated network protocol inspection to cover more server types. | ## Broker VM **Version 30.0.52 (reboot required)** For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-5.x-rn/release-information/maintenance-releases.md). | FEATURE | DESCRIPTION | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | New Broker VM image | Experience improved security and system stability with our new Broker VM image. New Broker VM deployments now run on a modern operating system (Debian 13) to ensure long-term support. While currently available for new setups, we are finalizing a migration path for existing brokers in a future update. **Note**: This feature will be available in your tenant starting February 22, 2026. | ## Cortex Agentic Assistant | FEATURE | DESCRIPTION | | ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cortex Agentic Assistant supported regions |

The Cortex Agentic Assistant is currently available for tenants in the following regions:

| | Native agent interoperability via MCP | Cortex Agentic Assistant now supports native interaction with external environments via the Model Context Protocol (MCP). Cortex AI Agents can seamlessly communicate with third-party MCP servers to discover available tools and automatically generate agentic actions, enabling you to automate more complex security tasks and accelerate incident response. | | Automation Engineer Agent | Accelerate script creation through an intuitive, conversational chat experience. Use natural language prompts to build and refine secure, high-quality Python scripts. The agent applies security best practices and uses the Agentix Automation SDK to ensure high-quality results. | ## Cortex Query Language (XQL) | FEATURE | DESCRIPTION | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Secure, personalized queries | Protect sensitive investigation data and ensure users only see their own query syntax and results, preventing unauthorized access to private data. We added a restriction setting for administrators to streamline the Query Center for non-admin users. | | Clearer query accountability | Audit your searches accurately. Instantly see if a query was run by a person, a system, or an API key to speed up troubleshooting and security reviews. We standardized field labels and updated the "Issued by" field to clearly distinguish between who owns a query and who ran it. | ## Email Security | FEATURE | DESCRIPTION | | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | New command center and updated remediation engine in the Advanced Email Security module |

Assess and manage security posture by watching email threats and response actions unfold in real time from the new, interactive Email Security Command Center.
Available with the Advanced Email Security add-on.

| ## Endpoint | FEATURE | DESCRIPTION | | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Secure Linux workloads with broader protection coverage | Prevent malicious activity on more Linux systems without requiring kernel-level access. We expanded Child Process Protection to support User Mode, ensuring your workloads stay secure even when kernel modules aren't available. This update provides broader coverage and simpler deployment for diverse Linux environments. | | Block malicious USB device attacks on macOS | Protect your macOS systems from unauthorized hardware attacks and malicious USB devices. We launched the Malicious Device Prevention module to identify and block tools like the "USB Rubber Ducky" that exploit device trust to inject unauthorized keystrokes and similar actions. This update reduces your physical attack surface and prevents hardware-based social engineering threats from compromising your data. | | Isolate compromised supervised iOS devices from the console | Stop potential threats from spreading by instantly cutting off network access for compromised supervised iOS devices with Network Shield enabled. You can now isolate supervised iPhones and iPads directly from the management console to block all unauthorized traffic. Your users will see clear notifications upon isolation activation, and on their lock and home screens while the device is in this secure state. | | Amazon ECS EC2 agent installer | Expanded runtime protection for AWS ECS EC2 workloads improves real-time defense against malware, exploits, and behavioral threats using the XDR agent to help teams stop attackers. | | Simplify endpoint tag management using API | Organize your environment more efficiently. Using API, you can now maintain the available tag list by permanently removing unused endpoint tags from your system. | ## External Data Ingestion and Management | FEATURE | DESCRIPTION | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Accurate Authentication Story logic | Identify threats more accurately with refined logic that ensures only high-quality, fully contextualized data generates authentication stories. We updated the mandatory field requirements, including making the outcome reason field optional, to focus on the most relevant data. | | Unified data onboarding experience | Save time and reduce complexity by managing all data sources and Marketplace integrations from a single, streamlined location. We renamed the **Data Sources** page to **Data Sources & Integrations** to eliminate the need for multiple portals when configuring content like correlation rules, dashboards, and playbooks. This unified workflow creates a more efficient experience for managing all your ingestion and automation needs. **Note**: This change merges the functional scope of existing permissions. Users, user groups, and API keys with **View/Edit** permissions for either **Data Sources** or **Integrations** now have full access to manage both on the unified page. Review your administrative assignments to ensure they align with this expanded access. | ## Playbooks | FEATURE | DESCRIPTION | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Conflict-free playbook editing | Prevent concurrent playbook editing to ensure your team can build and modify automation workflows without conflicts. The system now locks a playbook during edits and automatically releases the lock when you log out or your session expires. Additionally, a new permission allows designated users to manually unlock playbooks directly from the Playbooks page or editor. | ## Playbooks and Scripts | FEATURE | DESCRIPTION | | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved Playbooks and Scripts access control | Improve access control granularity for Playbooks and Scripts by enabling administrators to set Playbooks or Scripts permissions to **None** in certain scenarios. | ## RBAC and SBAC permissions | FEATURE | DESCRIPTION | | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Manage access to objects | Enforce least privileged access by managing individual instances of dashboards. New, optional object-based permissions provide granular control over specific items. This unified **Objects** approach allows you to decide exactly who can view or edit each specific dashboard by sharing it with others as **Viewer** or **Editor**. | | Enhanced Asset SBAC logs | Gain a more complete and transparent record of your environment configurations with expanded tracking. We updated Management Audit Logs to include all changes related to asset-led Scope-Based Access Control (SBAC). | | SBAC for cases and issues without inventory assets or endpoints |

Secure your data visibility with stricter default access for cases and issues without specific asset or endpoint references. You can now separately configure which users have access to issues and cases that lack an asset reference or where the referenced asset is not in All Assets and All Endpoints inventories. We added a new optional setting to ensure authorized users can still view all relevant data.

Note: This change affects users who previously had visibility into these items by default. To restore access, administrators must manually enable the new setting in the user's role configuration. For detailed instructions, see Manage User Scope.

| | Secure issue exclusion access | Keep sensitive data private while managing Issues effectively. When defining user roles, you can now restrict access to the Issue Exclusions page, so only authorized users can view and manage Issue exclusion rules, protecting the associated data. | ## XDR Collectors **XDR Collectors 1.5.1:** Windows 1.5.1.2048 and Linux 1.5.1.1950 **XDR Collectors 1.4.3:** Windows 1.4.3.1686 | FEATURE | DESCRIPTION | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Enhanced visibility and auditing of XDR Collectors | Cortex XSIAM now provides enhanced error visibility and auditing for XDR Collectors. This enables you to quickly identify and resolve application, connectivity, and processing errors, simplifying troubleshooting and ensuring your critical workflows remain uninterrupted. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-2026/feature-enhancements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.