> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/release-highlights.md). # Release Highlights The following are the key highlights for this release. | FEATURE | DESCRIPTION | | ----------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Secure your expanding AI-Driven attack surface | Built directly into your unified Cortex XDR agent, AES introduces deep visibility into the AI components, plugins, and binaries operating on your endpoints, allowing you to easily assess and govern AI-driven risks. Available for purchase to existing XDR customers, AES is a complementary solution that seamlessly operates on your existing agent, providing instant visibility and protection with zero deployment headaches. | | Extended Threat Intel (XTI) | Introducing XTI, a comprehensive threat intelligence offering that embeds adversary insights directly into SOC workflows through enriched case investigations and AI-driven behavioral analysis. Powered by Unit 42, XTI delivers a unified catalog of threat actors, malware, and vulnerabilities to supercharge XQL-based threat hunting and continuous IOC detection. Analysts can further accelerate triage and remediation by automating threat-aware responses in playbooks and leveraging the AgentiX AI assistant for natural language intelligence searches. | | Frontier AI seamlessly deployed | Cortex XDR has been fully optimized and tested across all operating systems to safely support heavy AI workloads. This ensures your existing XDR agent can run next-generation, AI-driven security features at scale without impacting stability, performance, or introducing security risks. | | Prisma browser & Cortex XDR integration | Cortex XDR now natively integrates Prisma Browser telemetry, unifying endpoint and browser data in a single platform. Now, teams gain a comprehensive investigation surface, empowering them to perform cross-environment queries and analysis from a centralized platform. | | Resource-efficient Linux protection agent | Our Linux agent now includes smart, built-in resource safeguards to keep your critical workloads running at peak performance. This feature automatically adjusts CPU and memory usage whenever your servers face heavy workload spikes, so your business-critical apps never lag or have downtime. The agent intelligently backs off under system pressure to prioritize your operations, giving your team continuous, invisible protection with minimal performance impact. | | Expanded coverage & forensics (DLP, Mobile, & Linux) | Cortex XDR now supports archives and large file scanning up to 300 MB for DLP, provides day-one support for Android 17 and safer iOS deployments. Cortex XDR can now also collect the full set of Linux forensic artifacts. This achieves unified visibility, control, and IR parity across endpoint environments, eliminating manual collection and inspection gaps. | | Conditional Access Policies (CAP) | Enables dynamic, risk-based enforcement. Cortex can now automatically trigger step-up authentication with Okta and Microsoft Entra MFA across on-prem AD environments or restrict access the exact moment an identity begins behaving suspiciously. Requires the ITDR add-on. | | Active Directory Security Posture Management (AD-SPM) | Extends proactive defense to identity infrastructure by identifying misconfigurations, tracking risk drift, and hardening on-premises Domain Controllers before an attack occurs. Requires the ITDR add-on. | | End-to-end experience & User Card updates | Streamlines how you investigate threats with updated User Cards that consolidate a user’s full profile, continuous risk score, and activity timeline into a single, intuitive view. Requires the ITDR add-on. | | Dedicated Idira IdP threat detection | Introduces 17 new, out-of-the-box detectors built specifically to monitor your Idira identity provider environment, instantly flagging credential manipulation and identity provider compromise. Requires the ITDR add-on. | | Secure and govern access with granular RBAC | Introduces a new standardized structure featuring dedicated roles (Viewer, Administrator), allowing for precise permissions for identity security and Conditional Access Policies. Existing users will be migrated to these new roles. Requires the ITDR add-on. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/release-highlights.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.