Release Highlights

The following are the key highlights for this release.

FEATURE	DESCRIPTION
File Integrity Monitoring (FIM) for XDR	Meet strict compliance requirements across Windows and Linux by monitoring critical file and directory changes. FIM is fully consolidated into the Cortex XDR agent, eliminating the need for additional deployments. Additional license required.
Container as a Service (CaaS) support for AWS ECS Fargate	Embed the Cortex XDR agent within the container image for CaaS workloads and get real-time monitoring and protection against active threats. This is available via the Cloud Runtime Security add-on for Cortex XDR.
Mobile security updates	Streamline large-scale deployments with new Android zero-touch installation support via MDM providers like Workspace ONE and Intune.
Advanced Email Security enhancements	Streamline threat triage with Malicious Emails Inventory – a purpose-built view for rapid analysis and preliminary remediation. Additionally, the Email Security Agent uses AI to analyze suspicious and user-reported phishing, providing context on why an email was flagged and the recommended remediation. Available with the Advanced Email Security add-on.
Identity and privilege-based SOC response	Instantly disrupt the attack kill chain with minimal user impact by validating identity and dynamically limiting privileges via CyberArk EPM. CyberArk EPM license required.
Device guardrails for SD cards	Fortify your perimeter by blocking SD Card devices connected via the PCI Bus. This new capability closes a critical vector for data exfiltration and neutralizes a common entry point for malicious code.
Advanced prevention for macOS	Neutralize privilege escalation attempts in near-real-time with macOS kernel behavioral monitoring.
Endpoint DLP improvements	Accelerate file scanning and minimize resource consumption with an optimized classification engine designed for larger files. The expanded application library now supports the latest versions of WhatsApp, Teams, and Zoom, along with new FTP, SSH, and RDP tools to better monitor or block data movement by privileged users.