> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-6.x-rn/release-information/features-introduced-in-2026/november-2026/feature-enhancements.md). # Feature Enhancements These enhancements provide new and improved capabilities. ## General | FEATURE | DESCRIPTION | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Licensing Workspace | See exactly what you are entitled to and control spend from one place. A dedicated licensing workspace in the Cortex XDR interface brings your license details together so you can review entitlements in a single view. | | Amazon Security Hub forwarding | Act on Cortex XDR issues inside the security tools your team already runs. Add Amazon Security Hub as a destination in the platform notification forwarding settings, then edit or remove that integration at any time. | | Improved table field management | You can now select or deselect all fields in a dataset with a single action, even for tables containing more than 100 fields. These comprehensive bulk-selection options significantly reduce the manual effort required for data management and analysis, accelerating investigation workflows for complex data sources. | | Set report retention period |

Set how long reports are retained on your tenant and keep retention aligned with your compliance policy. Choose a retention period between 1 and 365 days, or turn retention off.
NOTE: This feature is enabled by default for main tenants in Multi-Tenant/MSSP deployments that are created after November 22, 2026. For all other tenants, you can enable custom report retention at Settings > Configurations > General > Server Settings > Report Retention. If this feature is not enabled, reports are retained indefinitely.

| | Stronger password requirements | Reduce account-takeover risk with one consistent password standard across Cortex XDR. Password fields now require at least 15 characters for people and 20 for service accounts, each with upper and lower case letters, a number, and a special character, plus a strength indicator. | | Simple grid filter mode | Quickly filter table results without writing complex expressions. Tables across Cortex XDR offer a simple filter mode that exposes common field filters directly above the results. | | Share filtered table views | Help other users find the right data quickly. You can now copy or bookmark a link to a filtered table, and anyone who opens it sees the same filtered view. | ## Access Management | FEATURE | DESCRIPTION | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | User group context switcher | Work with only the access context your current task needs, enforcing least privilege. Adopt a specific user group's permissions, scope, and objects, for your current task, with no need to sign in again. | | Configurable SSO user expiration | Tighten access hygiene to match your own security policy. Administrators can now set how long an inactive single sign-on (SSO) user is retained per tenant. Expired users are fully removed. | | SSO sign-in audit trail | Audit and troubleshoot who reached your tenant and with which permissions. Management audit logs now record every SAML single sign-on attempt, successful or failed, together with the roles granted through group-claim mapping. | | Self-managed API keys | Create and manage your own custom API keys and enjoy self-service programmatic access. Keys you create and edit inherit your own role permissions and scope, so they can never exceed the access you already hold. Note that keys created by other users are no longer visible or accessible to you. | | Role-based issue Controls | Keep high-impact issue changes in the hands of the right people. Two new role permissions control who can change issue and case severity and who can exclude a single issue, and both remain enabled for existing roles. | ## Access to Objects | FEATURE | DESCRIPTION | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Dataset access control | Protect your managed datasets (User, Lookup, Dataset Views, and Correlation datasets) from accidental or unauthorized changes by controlling exactly who can view, edit, and own each one. Administrators can grant Viewer or Editor access on individual user datasets to specific users, groups, or API keys, so only permitted people can query or modify the data. | | Default object access setting |

Match newly created object permissions to the way your team actually works. In Access Management, administrators can now set whether newly created objects default to Restricted or Public.
NOTE: This setting currently does not apply to playbooks and scripts.

| ## Advanced Email Security | FEATURE | DESCRIPTION | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Threat Inbox |

A new unified investigation workbench that brings together malicious emails and user-reported phishing in a single experience. Threat Inbox replaces the legacy Malicious Email Inventory and gives analysts a holistic view of email threats across automated detections and employee reports. Identical user-reported emails are automatically grouped to reduce duplicate investigation, while AI-powered analysis provides a concise investigation summary and verdict directly in the side panel.
Requires the Email Security add-on.

| | AI Overview |

Analysts can now access an AI-generated summary directly from the Overview tab of a flagged email. The summary highlights key email context, targeted recipients, URLs and attachments, supporting threat evidence, and the likely intent of the attack.
Requires the Email Security add-on.

| | QR Code Analysis |

Advanced Email Security now analyzes QR codes embedded within emails to help detect and investigate QR-code-based phishing attacks. Analysts can view QR-related indicators and threat analysis directly as part of the email investigation.
Requires the Email Security add-on.

| | Email Rendering & Vision Analysis |

Analysts can inspect a rendered representation of an email together with vision-based analysis of its visual content. This helps identify indicators such as brand impersonation, misleading visual elements, and other suspicious characteristics that may not be apparent from text-based analysis alone.
Requires the Email Security add-on.

| ## AI Security | FEATURE | DESCRIPTION | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | LLM governance and visibility | Govern large language model use across your managed endpoints. The Cortex XDR agent now reports LLM activity for central visibility and checks prompts against Prisma AI Runtime Security (AIRS) inline, catching risky AI use before it reaches a model. | | Filter AI agent events | Determine whether AI activity on your endpoints is legitimate work or an attacker's tooling. Events in the xdr\_data dataset now carry an AI indication, so you can query and filter AI agent activity directly in XQL during an investigation. | ## API | FEATURE | DESCRIPTION | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SSO user provisioning API | New public APIs let customers add and remove SSO users programmatically, offering a lightweight alternative for managing the user lifecycle. Added users appear immediately in the user table and can be assigned roles and groups, enabling customers to implement their own provisioning flows. | ## Asset Management | FEATURE | DESCRIPTION | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | OCI workload asset visibility | See your Oracle Cloud Infrastructure (OCI) workloads alongside every other asset you own. Endpoints running the agent on OCI now appear in the asset inventory using the same asset model as the rest of your environments. | | Internal IP ranges column | See which internal networks an asset sits on while you triage it. The unified asset inventory includes an Internal IP Ranges column that displays each asset's internal IP addresses and attributed ranges. | | Account name enrichment | Identify which cloud account an asset belongs to across dashboards, cases, issues, and asset inventory. Cortex XDR now populates the account name and ID for a wider range of assets. | | Larger asset group limits | Cortex XDR raises the previous limit of 2,000 asset groups to 5,000 asset groups, which helps large organizations that manage many cloud accounts, subsidiaries, and security teams through scope-based access control and policies. | | Complete asset IP addresses | See every IP address linked to an asset, whichever module discovered it. Cortex XDR adds addresses from each discovery source to the asset record instead of overwriting them, so an address found by one scanner no longer disappears when another reports. | | Asset ownership visibility | Know who to contact the moment an asset needs attention. Cortex XDR adds an owner field to asset records, derived automatically from cloud tags and ServiceNow configuration management database (CMDB) fields, and lets you filter and sort the asset inventory by owner. | | ServiceNow CMDB asset enrichment | Investigate with full business context by bringing your configuration management database into Cortex XDR. Cortex XDR correlates and ingests ServiceNow asset attributes into Cortex XDR Assets, so each asset record carries the ownership and environment detail your teams already maintain in ServiceNow. | ## Attack Surface Management | FEATURE | DESCRIPTION | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Expanded Healthcare Coverage |

Detection coverage for several healthcare and medical record platforms, including OpenMRS, Orthanc Server, GNU Health, Bahmni, dcm4chee, and more to identify exposed instances and prevent unauthorized access to sensitive patient data.
Requires the ASM add-on.

| | On-demand attack surface rescan |

Confirm remediation faster by triggering a new Attack Surface Testing (AST) scan directly from an AST alert. Validate findings and keep alert status current without waiting for the next scheduled scan.
Requires the ASM add-on.

| | Proactive Adversary Detection |

Go beyond product fingerprinting to proactively uncover threats and anomalies in exposed web assets. New detections identify unauthorized script injections, Magecart skimmers, suspicious form destinations, and other indicators of compromised payment and login workflows.
Requires the ASM add-on.

| ## Automations | FEATURE | DESCRIPTION | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Automation error logs | Pinpoint why an automation failed with a clear record of every error. Automation runs now capture error detail, so you can review the cause of each failure directly. | | Prioritized Playbook Execution | Ensure your most critical response playbooks run first. You can now assign execution priorities directly within your automation rules. High-priority workflows now jump to the head of the queue, eliminating execution delays during traffic spikes. | ## Broker VM **Version 33.0.53 (reboot required)** For more information on maintenance releases, see [Maintenance Releases](/cortex-xdr-6.x-rn/release-information/maintenance-releases.md). | FEATURE | DESCRIPTION | | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved Broker VM upgrade mechanism | Separating OS (Debian) updates from broker version updates, designed to allow for greater flexibility in applying updates in the future. This infrastructural improvement optimizes the update delivery process and provides a foundation for more efficient security patching of your Broker VMs. | | TUI Broker VM access | Securely manage your broker through a restricted Text User Interface (TUI) that replaces full shell access. You can now perform administrative tasks, networking configuration, service management, and diagnostics from a menu-driven interface across Debian-based Broker VM deployments. | | Lean Broker VM image | Reduce your attack surface with a significantly smaller Broker VM image. The image no longer ships applet binaries and downloads them on demand at first activation. | | Kafka SCRAM-SHA-512 authentication | Meet stricter authentication standards when you collect Apache Kafka data. The Kafka collector on Broker VM now supports SCRAM-SHA-512, alongside the existing options of SSL and SCRAM-SHA-256. | ## Connectors & Data Sources | FEATURE | DESCRIPTION | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Prisma AIRS Integration | Protect enterprise AI with Cortex XSIAM and [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs). Correlate AI security threats with other attack vectors by ingesting Prisma AIRS data for search, detection, investigation, and response. | | Azure Event Hub Managed Identity | Choose a safer authentication method for Azure Event Hub log collection. Cortex XDR now supports Microsoft Entra ID managed identity alongside the existing Connection String (SAS) method. | | Connector-aligned instances table | Find and manage your connector, data source, and integration instances without hunting through a cluttered list. The main instances table now follows the connector structure, letting you switch between an instances view and a connectors view and search across instance capabilities. | ## Cortex Agentic Assistant | FEATURE | DESCRIPTION | | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Frontier AI, now globally available | Top-tier AI is now available to Cortex customers worldwide. Whether you are replacing legacy models or introducing agentic automation for the first time, Cortex now brings the world's most advanced LLMs directly to your SOC. Drive sharper reasoning, | | Screen-aware assistant | Get help that understands what you are looking at instead of re-describing it. The Agentic Assistant now reads the content of supported screens as you open them and as they change, and can provides suggested prompts and insights. | | Agents with Enterprise Knowledge | Make AI agents experts in your environment. Connect Google Drive, Confluence, or upload SOPs and documentation so agents understand your organization's workflows so they can tailor investigations and response actions to your organization’s practices. | | Persistent Agentic collaboration | Pick up investigations instantly without repeating triage steps. Issue conversations now preserve a continuous, audit-ready interaction history between human analysts and autonomous agents. | | Background diagnostics for Help Center agent | The Help Center agent now prompts for explicit approval before initiating long-running diagnostic actions, enabling background execution without blocking your workflow. Once approved, you can safely step away while the agent completes the run, notifies you via email upon completion, and automatically compiles findings into a summary report across all outcomes - including successful runs, failures, or manual cancellations. | ## Cortex XDR Gateway | FEATURE | DESCRIPTION | | --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | German sovereign cloud activation | Meet German data residency obligations when you bring a tenant online. You can activate Cortex XDR in the Germany sovereign cloud operated with T-Systems International (TSI), so tenant data stays within that sovereign environment. | ## Dashboards & Reports | FEATURE | DESCRIPTION | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Filtered dashboard drilldown | Move from a dashboard widget straight to the exact records behind it, without rebuilding filters by hand. When you configure a widget drilldown, you can now send users to a table view already filtered by the value they clicked and the widget's timeframe. | | Interactive line widgets | Focus on specific data points by isolating a specific part of the widget timeline. You can now zoom in and out of line widgets, and display average and base lines. | | Custom report logos | Customize your reports with your own logo. You can now replace the default Palo Alto logo when creating or editing a report in the Report builder. | ## Datasets | FEATURE | DESCRIPTION | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Multi-instance snapshot datasets | Snapshot datasets now support multiple collector instances. This allows several collector instances to save data to a snapshot dataset concurrently, without interfering with one another. | ## Endpoint DLP | FEATURE | DESCRIPTION | | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Richer DLP file details |

Spot suspicious data movement by seeing how recently a sensitive file changed and whether someone disguised its file type. The File section of the DLP issue card now shows the file creation time, the last modification time, and the original file type.
Requires the DLP add-on.

| | Expanded local application coverage | Close data exfiltration gaps across more of the applications your users run every day. Data loss prevention policies now cover Telegram Lite, curl, netcat, Signal, Claude Desktop, Microsoft Copilot, Cursor, and Microsoft Outlook on Windows and macOS. Requires the DLP add-on. | | Reliable file evidence retrieval | Investigate data loss incidents with complete evidence, even after someone changes or deletes the original file. You can now retrieve the file involved in a blocked or reported data-in-motion issue, including when multiple copies of that file exist. Requires the DLP add-on. | | Minimum pattern occurrence threshold | Focus your data classification on the files that hold sensitive data in volume. You can now require a minimum number of pattern occurrences before a file matches a data profile condition, so a file with only a few matches is not classified. Requires the DLP add-on. | | File share data protection | Stop sensitive files from leaving your endpoints when users move them to external network file shares. Select File Share as a destination channel in data-in-motion rules to block, report, or allow transfers from Windows and macOS endpoints. This covers shared folders and mapped network drives hosted on another machine. The File Share channel applies only to outgoing transfers to external file shares. Each issue will record the file share destination path alongside the file evidence. Requires the DLP add-on. | | Endpoint DLP executive dashboard | Track sensitive data leaving your endpoints and Endpoint DLP module deployment coverage from a single view. The new Endpoint DLP Dashboard (Data Security > Endpoint DLP Dashboard) shows unresolved DLP issues by severity, DLP module and web extension coverage across endpoints, top data profiles and egress vectors by channels / applications and their issue count and blocked or reported files data volume over time. Requires the DLP add-on. | | Per-tab web account visibility |

Catch sensitive data leaving through personal accounts in the browser. Endpoint DLP now identifies the signed-in account for each Google Workspace and Microsoft 365 tab, records it on the issue card as the Web User, and applies your enforcement rules to that account.
Requires the DLP add-on.

| ## Endpoint Security | FEATURE | DESCRIPTION | | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Agent downgrade for Windows | Recover Windows endpoints from a problematic agent version by rolling them back to a version you know is stable. You can downgrade one endpoint at a time, up to 200 endpoints from the Action Center, or up to 2,000 endpoints through the public API. | | Custom YARA file scanning | Hunt for threats across your Windows endpoints using the detection logic your team trusts. Import custom YARA rules, run on-demand file system scans from the Action Center or the API, and review every rule match with full file and host detail. | | Protect Tanzu TAS workloads | Protect your Tanzu Application Service (TAS) environments with the same threat prevention and response you already use on Linux hosts. Generate a Tanzu tile installer from Cortex XDR, deploy the agent to Diego Cells, and apply your existing Linux profiles and endpoint actions such as malware scans and forensics triage. Cortex XDR captures the TAS application, organization, space, and Diego cell behind each endpoint event, so you can tell which application an activity belongs to instead of reading it as unattributed container data. Each Diego Cell also appears in your asset inventory and is scanned for vulnerabilities, with findings tagged by TAS foundation, organization, and space so you can filter your vulnerability dashboards by those fields. | | Cloud-Optimized Linux agent | A new eBPF-based agent type built for cloud workflows - Cortex XDR delivers lightweight runtime security for Linux and Kubernetes. | | Agent Type Selection | Match the agent to each workload by choosing the agent type when you build an installer: select Standard, Cloud Optimized (Linux), or Targeted in the installation wizard, and view the agent type for every package in the installers table. Endpoint profiles now display Standard, Cloud Optimized, and Targeted tabs, each listing only the protection modules that apply to that agent type. | | Tabbed policy view | Zero in on the policies for one platform at a time. The Policies page now groups rules into tabs by platform with a count on each tab, while keeping policy ordering, filtering, import, and the risky profile indicator. | | Asset filtering improvement | Find assets quickly in environments with millions of endpoints. Asset table filters now include "Starts with" as the first option, which returns results much faster than a "Contains " search on large inventories. | | Application control for endpoints | Block untrusted applications from running on your Windows and macOS endpoints. The Cortex XDR agent now enforces policies you define to control which applications are allowed to run. Requires the XDR ONE or AES license. | | Extended AIDR Visibility & Control for Unhooked AI Agents |

On Windows and macOS, Cortex XDR ONE now brings deep AIDR visibility and runtime enforcement to AI agents operating without native hooks.
Requires the XDR ONE license.

| | Linux agentic endpoint security |

Protect your Linux endpoints with the same agentic security you already run on Windows and macOS. Agentic Endpoint Security (AES) now runs on Linux.
Requires the XDR ONE or AES License.

| | Enhanced kubernetes and cloud issue metadata | Triage issues from Linux workloads with the full cloud and cluster context attached. Issues raised by the Linux agent now carry the Kubernetes cluster, namespace, pod, and container, the running image, and the cloud provider, region, account, and instance. | | Linux anti-tampering protection | Stop attackers from disabling your Linux endpoint protection. Enable XDR Agent Tampering Protection in the Linux agent settings profile to block attempts to terminate, debug, or modify the agent and its files, with separate controls for each protection type. | | Azure Container Apps runtime protection | Extend vulnerability management, compliance, runtime drift detection and real-time protection to Azure Container Apps. | | AI-powered script protection | Catch malicious scripts that signatures miss by examining them with a Cortex AI language model on the endpoint. Turn on Cortex AI Language Model Examination in your malware profile to analyze PowerShell, JScript, and Visual Basic files on Windows and macOS, or other script types through the new Generic File Types module. | | Suppress disable prevention issues | Silence issues for activity you have already vetted. When you create a disable prevention rule, you can now suppress both the issue and the endpoint pop-up for the matched process. A new column in the rules table shows this setting per rule. Requires Cortex XDR agent 9.4 or later. | | Improved blocking capabilities for malicious Android apps | Stop users from interacting with Android apps that Cortex XDR agent has detected as malicious. On devices under mobile device management (MDM), the agent hides the app, ending its processes and removing its icon from the launcher; on unmanaged devices, it pushes the app to the background. | | Secure QR code scanning | On iOS and Android, avoid phishing sites hidden behind QR codes by checking a link before it opens. Scan a code with the in-app camera or from a saved image, and the app traces the full redirection chain and warns you about malicious or phishing destinations before your browser loads them. You see every redirect the link passes through and whether each one is safe. | | Report false positive detections | Android users can now report a false positive from the App Info screen. This sends the app details to an administrator for review. If the administrator allowlists the app, it is unblocked automatically. | ## Exposure Management | FEATURE | DESCRIPTION | | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Control effectiveness on findings |

Focus remediation on the vulnerabilities that your existing defenses do not already cover. Vulnerability findings now show a Control Effectiveness column, and the finding details list the security and compensating controls that apply, including endpoint protection and any next-generation firewall you register as a control. Control Effectiveness is only available when the Asset is determined to be Internet Exposed.
Requires the Exposure Management add-on.

| | NGFW Protection Coverage |

Understand which vulnerabilities are already protected by your Palo Alto Networks firewalls. Cortex Exposure Management maps NGFW rules and Threat Prevention profiles to asset and vulnerability findings, validates active exploit protection, and recommends updates where coverage is incomplete.
Requires the Exposure Management add-on.

| | Advanced Network Scanning Details |

This new view significantly improves visibility into the Network Scanner to help better understand recent scanning activity, host behavior, and credential use.
Requires the Exposure Management add-on.

| | XDR Virtual Patching for Exposure Management |

Protect vulnerable applications when patching and downtime are not an option. The Cortex XDR agent selectively blocks malicious traffic with high precision and minimal performance impact using active vulnerability data to activate targeted threat prevention signatures. Available in private preview.
Requires an Exposure Management add-on.

| ## Extended Analytics Detection Coverage | FEATURE | DESCRIPTION | | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Kubernetes Sensitive File Access Analytics | Identifies adversaries accessing sensitive files in Kubernetes environments, including service account tokens, secrets, mounted configuration, kubelet credentials, container runtime sockets, host filesystem mounts, and system logs. The suite surfaces uncommon file-access patterns, exposing reconnaissance, credential theft, container escape to the host, and lateral-movement techniques while filtering out routine workload, node, and operator activity. | | Container Runtime Socket Abuse Analytics | Exposes adversaries abusing exposed container runtime sockets in Kubernetes environments. The suite covers the attack lifecycle through the runtime API: reconnaissance, remote code execution, data exfiltration, and changes to container configuration and state. | | QR Code | An email tag that indicates the presence of a QR code within a message. This tag strictly highlights its existence and does not imply that the QR code or its destination is malicious. | | Released From Quarantine | Indicates a message was previously quarantined, then subsequently released for delivery and collected from the recipient’s mailbox. | | NHI Analytics | Surfaces malicious activity involving Non-Human Identities(NHI). We added NHI Analytics to analyze behavioral baselines and anomalies across different cloud environments and identity providers. | | Salesforce | Flags attack attempts within Salesforce. The suite uncovers a broad range of different sub-techniques, such as suspicious authentications, application installations, data exfiltration, privileged permissions assignment unauthorized policy modification. The suite uses dynamic baselines and anomaly scoring to provide comprehensive analytics, identifying abnormal user activity patterns. | | Slack | A novel analytics-based detection suite tailored to Slack Enterprise+. It detects suspicious authentications, data collection, external communication, and external file sharing within Slack Enterprise+ based on advanced behavioral baselines and audit log analysis of user activity. | | EDR Linux Evasion | Reveals uncommon attempts to evade defenses, impair security controls, execute payloads, and erase traces of malicious activity in Linux environments. Behavioral baselines suppress routine administrative and infrastructure noise while exposing shell-history manipulation, remote process-memory modification through ProcFS, suspicious execution from world-writable directories, and rare changes that flush firewall rules or enable port forwarding. This suite highlights activity associated with sophisticated adversaries, webshells, malicious cron jobs, and scripts attempting fileless execution, unauthorized network access, or artifact removal. | | NDR FTP Analytics | Monitors baseline FTP traffic to flag anonymous access, massive file uploads, and session anomalies. | | AI Insight Fusion Analytics | Leveraging AI-driven correlation, this analytics suite combines individually low-fidelity signals into high-confidence threat combinations. When multiple specific insights trace back to a single actor or causality, correlated events will now be escalated into cases. | | Malicious Package Analytics | Identifies malicious activity stemming from compromised Node.js dependencies, including software supply chain attacks. By monitoring package behavior across process execution, file system access, and network traffic, the suite detects compromised components attempting credential theft, data exfiltration, or unauthorized access. | | Virtualization Analytics | Spotlights threats targeting VMware ESXi and vCenter environments. This solution highlights anomalous command executions linked to hypervisor-specific ransomware, defense evasion tactics, security control tampering, unauthorized persistent and administrative access, as well as destructive operations directed at virtual machines. | ## Identity Threat Detection & Response | FEATURE | DESCRIPTION | | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | macOS Conditional Access pop-ups | Stop risky credential use on Mac endpoints before it succeeds. When a Conditional Access Policy blocks an identity request or requires multifactor authentication, macOS users now see the same interactive Cortex XDR agent pop-up Windows users receive, and can confirm the action or report it as suspicious. | | Entra ID MFA step-up | Challenge risky authentications with the multi-factor provider you already run. Add Microsoft Entra ID as a data source with the Identity Prevention capability, then select it as the MFA provider when you create a conditional access rule. | ## Investigation & Response | FEATURE | DESCRIPTION | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cortex initiatives | Track proactive goals alongside your case work. Create initiatives in a new case domain with dedicated experiences that gathers matching Posture issues and updates as new matches arrive. | | AI causality summary | Understand a complex attack chain in seconds instead of reading the full process tree. Open the AI Causality Summary tab on a causality card to get a plain-language description of what ran, in what order, under which user, and how the product responded, with thumbs-up or thumbs-down feedback on each summary. | | Agents as Collaborators | Turn AI agents from isolated assistants into active members of the SOC team. Analysts can now work side by side with agents on cases, offloading tasks, and monitoring the agent’s contribution via investigation history and agent activity logs within a seamless collaboration experience. | | Identity Security dashboard | Prioritize identity risk across your cloud, SaaS, and on-premises environments from a single view. The Identity Security dashboard ranks your highest-risk identities by case severity and shows open case trends alongside conditional access attempt outcomes. | | External grouping artifact | Group third-party alerts into cases. Correlation rules now accept a External Grouping Artifact ID and Type values that influence case grouping. | ## Managed Services | FEATURE | DESCRIPTION | | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Export managed services data | Take managed service records out of Cortex XDR for your own reporting and review. You can now export the data shown in the Managed Services tab, and each export is captured in the audit log. | ## MSSP/Multi-Tenant | FEATURE | DESCRIPTION | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cross-tenant role-based access | Limit what a managing parent tenant can do inside each child environment. Child tenants define granular roles and grant the parent only the permissions it needs, replacing the blanket instance admin access previously used across multi-tenant and managed security service provider (MSSP) deployments. | ## Threat Intelligence | FEATURE | DESCRIPTION | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Third party threat intel support | Build a broader picture of threats by combining your own third-party intelligence feeds with Unit 42 intelligence in a single indicator set. You can now ingest and enrich IP, domain, URL, and file indicators from marketplace feed integrations, and see which source each indicator came from. Requires the XTI add-on. | | Retroactive indicator hunting | Uncover attacks that entered your environment before you knew an indicator was malicious. Adding or changing a retrohunt indicator rule triggers a search of your historical event data over a 30-day lookback window, and the resulting issues carry the matching source events as evidence, with event context. Requires the XTI add-on. | | XTI threat intelligence automation | Automate threat intelligence workflows against the full Extended Threat Intelligence (XTI) data model. New scripts allow you to look up information on threat actors, malware families, and reports, as well as update indicators. You can integrate these scripts directly into your playbooks to operationalize your XTI data. Additionally, onboarding third-party feed and enrichment integrations will automatically merge external indicators with your existing indicator data. Requires the XTI add-on. | | Threat-aware AI case summaries | Understand who is behind a case as soon as you open it. AI-generated case summaries now include indicator verdicts, associated threat actors, malware families, and behavioral attribution, drawn from threat intelligence as it updates, so a later summary reflects a changed verdict. Requires the XTI add-on. | | Threat context on vulnerabilities | Judge how urgent a vulnerability is by seeing which adversaries actually use it. Open a CVE and a new Associations tab shows the threat actors and malware families linked to it, using the same tables and filters as the Threat Intel Library. Requires the XTI add-on. | ## Vulnerability Management | FEATURE | DESCRIPTION | | --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Fix-Oriented Vulnerability Policies | Turn vulnerability findings into more manageable remediation tasks. New policies aggregate CVEs that can be resolved with the same fix into a single issue, reducing ticket volume and helping teams systematically remediate more effectively. Available as a limited GA; contact your account team for access. | | ServiceNow vulnerability response integration | Track and remediate Cortex XDR vulnerability findings inside your existing ServiceNow workflows. Findings now include the container image repository, registry, and digest, plus Kubernetes cluster and namespace, so ServiceNow Vulnerability Response and Container Vulnerability Response can assign and prioritize the right work. | ## XDR Collectors **XDR Collectors 1.5.3:** Windows 1.5.3.2503 and Linux 1.5.3.2371 **XDR Collectors 1.4.3:** Windows 1.4.3.1686 | FEATURE | DESCRIPTION | | ------------------------------ | ------------------------------------------------------------- | | XDR Collectors 1.5.3 and 1.4.3 | This release includes performance improvements and bug fixes. | ## XQL | FEATURE | DESCRIPTION | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Scheduled query permission | Control who can work with scheduled queries independently of everything else in Query Center. A dedicated role-based access control (RBAC) permission for scheduled queries lets administrators grant or fully restrict that access on its own. | | XQL export format options | Get query results into your downstream tools without manual conversion. When you export XQL results, you can now choose JSON or TSV output and apply GZIP compression. Very large result sets compress automatically so the download completes reliably. | | XQL autocomplete control | Build multi-line queries without fighting the suggestion menu. A new server setting lets you accept Cortex Query Language (XQL) autocomplete suggestions with Tab only, so Enter inserts a new line instead of a suggestion. | | New Math Functions in XQL |

Accelerate your investigations and reduce manual errors with our expanded XQL math toolkit. New functions like max\_by and min\_by eliminate follow-up searches by returning peak records instantly, while tanh normalizes unbounded counts so outliers cannot dominate rankings. Additionally, tools like atan2 calculate true bearings from two values rather than simple ratios. To enable these advanced calculations directly within your initial query, we have added 13 new math functions to XQL across three categories:
• Selection: max\_by, min\_by
• Hyperbolic: sinh, cosh, tanh, coth, sech, csch
• Inverse: asinh, acosh, atanh, atan, atan2

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-6.x-rn/release-information/features-introduced-in-2026/november-2026/feature-enhancements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.