> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/feature-enhancements.md). # Feature Enhancements These enhancements provide new and improved capabilities. ## Access Management | FEATURE | DESCRIPTION | | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Fully restrict credentials access | Enforce a strict least-privilege model by completely revoking access to stored secrets. Administrators can now set the **Credentials** permission to **None**, which hides the **Credentials** page, blocks the related public API endpoints, and stops users from referencing saved credentials in integrations, scripts, and playbooks. | ## API | FEATURE | DESCRIPTION | | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Export forensics data programmatically | Bring your forensics data directly into the tools your team already uses. We have added a new set of Forensics public APIs that let you list investigations and their collections, retrieve hunt and triage results, page through artifact and host-timeline data, and download collected files. Requires the Forensics add-on. | | Manage Broker VMs programmatically | You can now manage and configure your Broker VMs programmatically. Use the Public API to retrieve broker details and health status, manage applets, and perform broker actions such as register, remove, reboot, upgrade, and download logs. | | Case timeline record APIs |

With the new Case timeline record APIs, you can retrieve timeline records for a specified case with support for filtering, sorting, and pagination, and add new timeline records to capture case-related events and updates.
For implementation details, see:
• Retrieve case timeline records
• Add a case timeline record

| | Least privilege access recommendations for assets API |

The new API endpoint returns Least Privilege Access (LPA) recommendations for an asset based on its existing IAM policies or roles.
The endpoint analyzes the asset's activity during a specified lookback period and recommends the minimum set of existing IAM policies or roles required to preserve all observed actions. Use the returned policy or role configuration snippets to remediate over-privileged identities and implement least privilege access.

| ## Attack Surface Management | FEATURE | DESCRIPTION | | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Asset graph relationships for cloud and ASM data | Understand your security risks clearly by visualizing how your attack surface and cloud assets interact. We mapped external attack surface data to your cloud resources, allowing you to build custom graph searches across AWS EC2 instances, Azure VMs, and Google Compute Engine VMs. Requires the ASM add-on. | | Frontier AI-informed detection coverage | Expand protection with new detections shaped by frontier AI attack research. These detections help identify exploitable weaknesses and exposures across external attack surfaces. Requires the ASM add-on. | ## Automation | FEATURE | DESCRIPTION | | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Mark playbook tasks as timeline records | Track investigation milestones seamlessly directly from your case timeline. You can now edit specific playbook tasks to display their actions as case timeline records, matching your exact workflow naming conventions, and tag them as evidence to capture critical discovery details at the case level. | | Compute unit tracking for agentic requests | The Compute Units page now displays the evaluated compute cost for each agentic request to help you plan future resource allocations and understand the full ROI of your AI tools. These entries provide visibility into your AI usage patterns, but are marked as non-billable in the usage table and do not deduct from your current compute unit balance or affect daily limits. | | Improved agentic playbook predictability with LLM structured outputs | Highly reliable, automated workflows are now easier to maintain by enforcing structured responses for AI prompts within Cortex XDR playbooks. When configuring an AI prompt, you can optionally choose to use structured output and provide a JSON schema to ensure the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output. | | Search playbooks by content pack | Find playbooks faster by filtering the Playbook Catalog by content pack. The Search by filter in the Playbook Catalog now includes a content pack option to find playbooks that belong to a specific content pack. | ## Broker VM **Version 32.0.51 (reboot required)** For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-5.x-rn/release-information/maintenance-releases.md). | FEATURE | DESCRIPTION | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Upgrade applets independently | Deploy updates faster and with minimum dependences. You can now update individual Broker VM applets independently without upgrading the entire Broker VM. This reduces management overhead and delivers immediate enhancements without system-wide downtime. | | Enforce TLS 1.3 communication | Meet emerging compliance demands and secure your data transmissions against modern threats. Cortex XDR now supports TLS 1.3 communication between the Broker VM and the server to ensure your environment aligns with strict cybersecurity standards. | | DB collector Windows authentication | We have added Windows Authentication support to the (MSSQL) Database collector applet to enable secure connectivity in domain environments. The new authentication method supports Kerberos, NTLM and the standard SQL internal authentication. | ## Cortex Agentic Assistant | FEATURE | DESCRIPTION | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved navigation to Agentic Assistant Hub | A new dedicated Agentic Assistant Hub menu item has been added to the main navigation sidebar to improve administrative efficiency. By providing a direct shortcut to your agent and action configurations, this update reduces operational overhead for security teams by eliminating the need to navigate through the chat interface. | | Native support for leading frontier AI models |

Equip Cortex AgentiX agents with the world’s most powerful frontier AI models, including Anthropic Claude Sonnet 4.6, Claude Opus 4.8, and Gemini 3.5 Flash, and seamlessly switch between them to match specific tasks with the most appropriate model.

Claude Sonnet 4.6 and Claude Opus 4.8 are available in the US and EU regions. Gemini 3.5 Flash is available in the US, EU, SG, JP, IN and UK regions. Claude Sonnet 5 is available upon request in the US and EU regions.

| | Personalized Agents | Unlock smarter, tailored agents infused with your organization’s unique knowledge. Connect directly to Google Drive, Confluence, or upload your standard operating procedures and documentation to power fully contextual agentic responses. Now available in private preview; contact your Palo Alto Networks representative to participate. | ## Cortex Query Language (XQL) | FEATURE | DESCRIPTION | | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | XQL query macros | The new XQL text-substitution macros and the macro library enable you to save and reuse modular code snippets to simplify query authoring and centralize organizational logic. XQL macros eliminate repetitive manual work through modular expansion and a dedicated management UI, empowering teams to maintain high-quality, standardized logic with ease. | | Reshape data in XQL | Turn raw query results into clear, presentation-ready tables. You can now pivot rows into columns, transpose columns into rows, and replace null values across complex data types such as arrays, JSON, and datetime fields. | | Consistent query result access | The Query History view now retains results from investigation flows, simple search, and scheduled queries for a fixed 72-hour period across every tenant. When results expire, Cortex XSIAM marks them as Data Purged and hides the Show Results action so you always know their availability. | | Faster query building and autocomplete | Cortex significantly improved query building and query autocomplete response times, with the largest gains on large, data-heavy tenants. | | Query asset groups | Simplify security investigations in Cortex Query Language (XQL) with richer context. You can now query asset group information directly in XQL to correlate, filter, and report on your assets more effectively. We added the `asset_groups` system dataset to help you easily retrieve asset group details within your custom queries. For example, join against the new dataset using the asset group ID to get the asset group name. | ## Dashboards and reports | FEATURE | DESCRIPTION | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | AI-driven dashboard builder | Turn natural language prompts into data visualizations in seconds. A streamlined workflow for setup, access control, reporting, and live previews helps your team build executive-ready dashboards and reports faster, with fewer manual steps. | ## Data Security | FEATURE | DESCRIPTION | | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Continuous Strata logging authentication | Maintain uninterrupted data logging across commercial and FedRAMP Moderate environments without manual re-authentication prompts every six months. Cortex XDR now automatically manages secure background authentication for the Strata Logging Service, ensuring continuous data flows. | ## DLP | FEATURE | DESCRIPTION | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Stop file extension evasion attacks |

Stop insider threat actor from exfiltrating sensitive data files by disguising their extensions. We now detect the original file type of most scanned files, preventing evasion attempts that rely on file extension manipulation.
Requires the DLP add-on.

| | Modernized DLP block dialogs |

Enjoy a modernized block dialog experience. We've refreshed the DLP block dialogs with the new Unity design system, delivering a cleaner, more consistent interface that aligns with the latest design standards.
Requires the DLP add-on.

| | Protect data in compressed files |

Protect sensitive data in compressed files. You can now apply DLP policies to archive files, ensuring comprehensive data protection across all file formats and providing visibility to the sensitive content results of those complex archive files.
Requires the DLP add-on.

| ## Endpoint Security | FEATURE | DESCRIPTION | | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CaaS Workloads | Protect your CaaS workloads running on Google Cloud Run or Azure Container Instance with the embedded Cortex XDR agent. You can now deploy the Cortex XDR agent inside Azure Container Instance and Google Cloud Run workloads to add runtime malware protection, exploit protection, and continuous vulnerability scanning. | | CaaS Workloads | Alpine Linux and other musl-based distributions are now supported for container-embedded deployments. | | Runtime JSP Protection for Windows Servers | Detect and prevent malicious webshells from targeting your Java application servers. Cortex XDR agent for Windows now scans JSP and JSPX server pages at runtime. This protection extends the existing runtime coverage for Java applications. | | Enhanced issue descriptions | Malware issues from the Cortex XDR agent now include a comprehensive description of the detected threat. | | Improved Linux Agent Resource Management | The Cortex XDR Linux agent now enforces per-component resource limits (CPU and memory) using Linux control groups. This ensures the agent and its subprocesses operate within predictable resource boundaries. Requires Cortex XDR Linux agent 9.3.0 or later. | ## Exposure Management | FEATURE | DESCRIPTION | | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Crowdstrike integration | Bring in assets and vulnerabilities discovered by CrowdStrike, then view and filter them alongside your other findings in Cortex Exposure Management. We added a built-in CrowdStrike integration that ingests discovered endpoints and vulnerabilities mapped to a CVE or vendor advisory. Requires the Exposure Management add-on. | | Network Scanner Compliance Scans for Debian and Ubuntu | Network Scanner capabilities now include compliance scanning support for Debian and Ubuntu operating systems. This allows security and compliance teams to audit Linux-based assets directly through network assessments. You can seamlessly run compliance and configuration audits on Debian and Ubuntu distributions alongside your existing scanned infrastructure. Requires the Exposure Management add-on. | ## Extended Analytics Detection Coverage | FEATURE | DESCRIPTION | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | LOLBIN Execution Analytics | Catch hidden threats by detecting adversaries abusing Living-Off-The-Land-Binaries (LOLBin) system tools for proxy execution of malicious code and evade signature-based defenses. The suite leverages behavioral baselines and anomaly scoring to surface uncommon command-line patterns, unusual child processes, and rare network connections originating from LOLBins. | | NDR Unmanaged Subnet Analytics | Detects malicious activity instantly from blind spots created by new or unmanaged devices. We added NDR Unmanaged Subnet Analytics to analyze the collective behavior of the subnets, eliminating the need for a historical baseline and detecting attacks on unmanaged hosts. | | EDR Linux Sensitive Information Theft Analytics | A novel analytics-based detection tailored to the Linux domain, designed to identify anomalous or uncommon attempts by processes to access and extract data from sensitive system files and configuration directories. By profiling behavioral baselines, it automatically filters out standard administrative noise while exposing sophisticated adversaries, Webshells, and malicious scripts seeking to gather system-level intelligence, discover credentials, and uncover pathways for lateral movement. | | SSM Remote Management Analytics | Detects suspicious activity involving AWS Systems Manager (SSM), including command execution, session access, parameter store operations, and SSM agent behavior on endpoints. | | Cloud Log Tampering Analytics | Detects adversaries attempting to disable, delete, or modify cloud audit and activity logs to cover their tracks across AWS, Azure, and GCP. The suite leverages behavioral baselines and anomaly scoring to surface uncommon log-configuration changes, rare API calls targeting logging services, and unusual identities interacting with cloud telemetry pipelines. | | OCI Analytics | Detects malicious activity in Oracle Cloud Infrastructure (OCI) tenants by extending Cortex cloud analytics to OCI, giving customers a unified detection layer across all four major cloud providers. | | Extended EDR macOS AppleScript Analytics | The upgraded analytics detection suite uncovers adversaries abusing AppleScript to proxy malicious behavior on macOS, a technique increasingly leveraged by macOS infostealers and other threats. The suite surfaces uncommon command-line patterns and high-risk script intent across the attack lifecycle, including data exfiltration, credential and credential-file theft, cryptocurrency wallet access, sensitive application data collection, screen and clipboard capture, system information discovery (including VM/sandbox evasion checks), persistence via Launch Agents/Daemons, defense evasion and Gatekeeper bypass, and command-line obfuscation. | ## External Data Ingestion and Management | FEATURE | DESCRIPTION | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CLCS log type filtering | Reduce your ingestion costs by controlling exactly which logs you send to Cortex XDR. When you onboard a Cloud Log Collection Service (CLCS) data source, including CNGFW, NGFW, Prisma Access, Panorama, or PAB, you can now select specific log types to ingest through a multi-select list. You can also edit log type filters on existing CLCS data sources at any time, so only high-value security logs reach the ingestion pipeline. | | Continuous data parsing | Avoid data gaps and keep collecting critical logs when datasets grow unexpectedly. When a dataset reaches its 2,000-field limit, you can now add a parsing rule stage to explicitly select the fields you need, which resumes the parsing. The updated error messages provide exact steps to resume data flow. | ## Forensics | FEATURE | DESCRIPTION | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Deeper Linux forensic visibility | Investigate Linux incidents with deeper context across system activity and administrative actions. Cortex XDR forensic triage collection now gathers system log history and sudo log records, and captures additional user login and session details. You can filter and hunt across these new artifacts to trace unauthorized access and privileged actions faster. Requires the Forensics add-on. | ## Investigation and Response | FEATURE | DESCRIPTION | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Centralized Identity Security for domain controllers | Simplify your security management with the new Identity Profile to streamline the configuration and enforcement of identity security policies across Windows Domain Controllers. Monitor LDAP protection, dynamic risk-based Conditional Access Policies (CAP), and proactive Active Directory (AD) using the purpose-built unified hub. Requires the ITDR add-on. | | Manage case team members and access | Gain clear visibility into who is actively working on an investigation and enforce strict access controls for cases containing sensitive context. Security investigations require cross-functional collaboration across multiple teams and users. With this update, you can now capture all participating individuals and user groups while ensuring sensitive context is accessible only to designated team members. | | Enhanced case SLA tracking and reporting | Elevate your compliance reporting and case prioritization with fully integrated Case SLAs and advanced XQL querying capabilities. You can now track real-time SLA metrics directly from the case header and table views, while utilizing custom fields and out-of-the-box resolution timers to ensure organizational KPIs are met. Additionally, new XQL support allows you to search, filter, and report on SLA data, such as breach status and remaining time, to quickly surface at-risk cases. | | Enhanced detection logic with rule and policy metadata | Accelerate triage and investigation by instantly tracing detections back to their underlying logic with newly added rule and policy metadata. You can now analyze and filter issues and findings by specific detection sources with direct links to rule and policy details. | | Case experience improvements | Work cases faster and more effectively with usability enhancements designed to streamline your everyday investigation workflow. You can now expand the grouping graph to full screen, navigate between issues in the issue feed the same way as the issue table, and group issues in the issue feed by data source. Additionally, asset group names and asset tags are now natively exposed for use in cases and XQL searches, while the resolution center automatically opens to the first tab containing tasks to help you jump straight into remediation. | | Issue export optimization | To ensure fast, reliable downloads, the issues TSV export is now capped at a maximum of 50k issues per export. | | AI tool visibility in the causality chain | Accelerate your investigations by identifying and highlighting usage of AI tools within the causality chain. The causality chain now features visual indicators for AI-driven processes across Windows and Mac. Beyond a simple visual flag, each indicator provides specific context to identify the exact AI tool detected, giving analysts the immediate clarity needed to triage incidents faster. | | Filter issues by resolution SLA and resolution timer in XQL | Query and filter issues by their resolution service-level agreement (SLA) and resolution timer values using Cortex Query Language (XQL). We now expose the Resolution SLA and Resolution Timer as filterable XQL fields. The Resolution SLA and Resolution Timer XQL schemas also include derived fields, so you can build queries, correlation rules, and dashboards that track whether issues are resolved within their defined SLA goals. | ## Marketplace Content Changes | FEATURE | DESCRIPTION | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Built-in Cortex automation commands | Execute essential playbook commands instantly without manual setup overhead. Built-in commands replace the older **Core Investigation and Response** and **Cortex Platform - Core** integrations while maintaining full functionality and improving performance. | ## Vulnerability Management | FEATURE | DESCRIPTION | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Active Vulnerability Findings Over Time widget | Track active vulnerability findings over the last 6 months in the new Active Vulnerability Findings Over Time widget on the Vulnerability Management dashboard. Requires the Exposure Management add-on. | | Streamlined Resolution Actions | We’ve updated the Vulnerability Issues side-panel to introduce Resolution Actions, providing a unified and consistent remediation experience across both individual issues and broader cases. When an immediate patch isn’t viable, the side-panel now surfaces approved compensating controls as a valid Resolution Action to help you mitigate risk safely. Speed up your incident response with clear, prescriptive guidance—whether that means launching a dedicated automation playbook or following step-by-step manual instructions. Recommendations are also provided at the case level, giving you access to full operational context without needing to pivot between screens. Requires the Exposure Management add-on. | | Remediate Zero Day threats faster | Enhancements to the Vulnerability Management list view help you isolate and triage global attack surface events and major zero-day events, with greater speed. You can now easily filter vulnerabilities to focus exclusively on high-priority, newly identified emerging threats. For security events associated with multiple vulnerabilities, you can drill down to filter by a single, specific vulnerability, giving you granular visibility. Requires the Exposure Management add-on. | | Improved Kubernetes context for Vulnerability Findings | Vulnerability findings for Kubernetes Resource asset types now include dedicated Kubernetes metadata, providing you deeper visibility into containerized environments. You can view and filter by fields such as, Cluster, Namespace, Namespace Label across the UI, XQL, and the Public API (PAPI). This enhancement provides the granular context needed to quickly isolate vulnerabilities by specific environments or microservices. Requires the Exposure Management add-on. | | Redesigned Vulnerability Findings side panel |

We have redesigned the Vulnerability Findings side-panel to put critical context right at your fingertips. Evidence fields are now front and center, giving you insight into exactly why a vulnerability was detected including additional extraction, normalization, and display of detection evidence from all Cortex scan sources.

Surfacing the detection logic, allows you to reduce the time spent investigating false positives or searching for root causes. The revamped interface allows you to assess the risk and context of a findings at a glance, accelerating your mean time to remediation (MTTR). Requires the Exposure Management add-on.

| ## XDR Collectors **XDR Collectors 1.5.3:** Windows 1.5.3.2503 and Linux 1.5.3.2371 **XDR Collectors 1.4.3:** Windows 1.4.3.1686 | FEATURE | DESCRIPTION | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | XDR Collectors 1.5.3 upgrade | Protect your environment with the latest security enhancements and system stability. Cortex XDR now supports XDR Collectors version 1.5.3.XXXX for Windows and version 1.5.3.XXXX for Linux. | | Upgraded Winlogbeat | Cortex XDR now supports version 9.3.2 Winlogbeat for 64-bit XDR Collectors. Live 64-bit XDR Collectors receive this update automatically, while 32-bit XDR Collectors remain unaffected, as this independent update is not tied to any specific XDR Collectors version. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/feature-enhancements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.