> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-6.x-rn/release-information/features-introduced-in-2026/november-2026/release-highlights.md). # Release Highlights The following are the key highlights for this release. ## Agentic Endpoint Security (AES) | FEATURE | DESCRIPTION | | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Extend Agentic Endpoint Security with XDR ONE | Transform your SOC by bringing Cortex XDR and AES together into a unified, single-console and sensor experience. This provides complete 360 visibility and control across your endpoint ecosystem, including AI adoption. Discover your endpoint AI technology stack, govern the agentic supply chain against risky components or silent updates, and enforce active runtime guardrails across both XDR and AES. Can be managed by dedicated Unit 42 security expertise for managed agentic endpoint security. Requires the XDR ONE or AES license. | | Native Application Control | Discover every executed binary on managed endpoints and enforce tailored allow, block, or alert policies with intelligent guardrails. Requires the XDR ONE or AES license. | | Runtime Protection and AI Detection & Response | Captures every action an AI coding agent takes into a session-centric audit trail and intercepts policy-violating actions before they execute. Requires the AES license. | ## Core Cortex XDR Capabilities | FEATURE | DESCRIPTION | | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cortex Targeted Sensor | A new sensor deployment model allows customers to deploy targeted capabilities such as AES or the Active Directory Security Posture Management (AD-SPM) module of ITDR to run alongside existing third-party EDRs without conflict, providing operational flexibility today and an effortless path to flip to a full Enterprise XDR Sensor when ready. Requires either the XDR ONE, AES license, or ITDR add-on. | | AI-Powered Behavioral Protection | AI-Powered Behavioral Threat Protection continuously monitors runtime process chains to block zero-day exploits and living-off-the-land attacks, providing customers with instant, real-time protection. | | On-sensor SLMs for Fileless Threat Defense | Complementing runtime defense, optimized SLMs execute directly on the endpoint sensor to analyze obfuscated scripts pre-execution, providing customers with zero-latency, offline-capable protection against evasive fileless threats without sending sensitive code to the cloud. | | Real-Time On-Write Threat Prevention | Extended On-Write Protection performs real-time hash reputation checks across all WildFire-supported file types on Windows, macOS, and Linux, preventing attacks at the exact moment a file is written to the disk. | | AgentiX-Driven YARA Rule Management | AI-Powered YARA Rule Management uses AgentiX to automatically create, test, and run custom detection across Windows endpoints. Teams can hunt for threats on demand and instantly convert findings into enterprise containment. | | AIDR - AI agent context | Using the Cortex XDR agent's tracking of process causality chains that interact with AI services, the Cortex Analytics Engine now flags AI agent involvement in the issue and can adjust its severity when an AI agent performed the activity. | | Autonomous playbooks | Close the loop from detection to response with fully managed, out-of-the-box workflows that proactively remediate threats. | ## Cortex Add-On Module Enhancements | FEATURE | DESCRIPTION | | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Advanced Email Security Enhancements | Accelerate threat triage and elevate SOC performance across advanced email security. Powered by a centralized Threat Inbox and embedded capabilities like automated cluster analysis, email rendering, and AI-driven investigation summaries into a unified workspace. Requires the Email Security add-on. | | New Identity Security Dashboard for ITDR | Enhance your SOC visibility and power faster investigations with a new unified dashboard, bringing in identity posture and real-time identity runtime signals across human, non-human, and agentic identities into a single view. Requires the ITDR add-on. | | Endpoint DLP Enhancements | Gain centralized visibility into data-in-motion with our new Endpoint Data Loss Prevention (DLP) dashboard, built to track module activation, primary egress vectors, and top-detected data profiles. This release also introduces support for File-Share channels, an upgraded file-retrieval mechanism for data-in-motion, and tab-level user identity visibility across supported web browsers. Requires the DLP add-on. | | Integrated Threat Intelligence | Cortex XTI combines native Unit 42 threat intelligence with third-party intelligence sources for enhanced threat coverage, enrichment, and prioritization across investigations. Extend threat hunting with a new retrohunting capability and a more robust Threat Intelligence agent. Requires the XTI add-on. | | Cortex Data Security is now GA | Unify DSPM, DLP, and DDR to protect sensitive data across cloud, SaaS, on-premises, and AI. Extend XDR protection beyond the endpoint with broader coverage, unified data classification, and connected prevention and detection. Email and browser coverage is planned for the future. Requires the Data Security license. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-6.x-rn/release-information/features-introduced-in-2026/november-2026/release-highlights.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.