> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-26-june-2024.md).
# Expander Release 2.6 (June 2024)
The table below describes the features and enhancements introduced in the Expander 2.6 (June 2024) release.
Cortex Xpanse typically upgrades customers over a three-week time frame. Contact customer success to find out your specific upgrade date.
| Feature | Description |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Inventory Tag Rules | Automate the tagging of assets with Inventory Tag Rules (formerly called asset tag rules). Inventory Tag Rules enable you to define custom tags and custom rules for assigning tags automatically to IPv4 addresses, domains, certificates, and Prisma Cloud resources. |
| New Inventory Fields | Gain additional context for investigating assets with new domain and certificate identifier fields that have been added to the Inventory. |
| New Alerts Fields | New fields have been added to the Alerts table to help you more easily investigate and remediate alerts, including Remediation Guidance and Certificate Subject Organization. |
| Cortex Xpanse API updates | New and updated API endpoints:
- Override Business Units for Assets
- Create User Defined IP Ranges (with tags)
- Delete Unused Asset Tags
|
| Threat Reports | You can now generate reports on new zero-day threats and impacted assets per business unit. These reports highlight the problem, provide remediation recommendations, and list affected assets in the selected business unit. |
| SBAC Support for the Threat Response Center | The Threat Response Center now works with scope-based access control (SBAC), which means that scoped users will see all the widgets in the Threat Response Center. |
| Active Response Improvements | Notifications:
- You can now set up Slack notifications for newly discovered ASM risks.
Remediation:
- You can now automate remediation for select attack surface rules via patching for Linux (Ubuntu only) through AWS Systems Manager.
|
| Cortex Xpanse XSOAR pack enhancements | Enhancements to the Cortex Xpanse pack for Cortex XSOAR include:
- New Xpanse Expander v2 Feed integration
- New XSOAR layout for Xpanse alerts
- Indicator extraction support
- Added new 'Reopened' status for alert fetching
- Various updates to ASM integration commands
|
| Some high-impact attack surface rules will be enabled for all customers | Cortex Xpanse will be enabling additional attack surface rules for all customers during the Expander 2.6 upgrade. Many of the rules to be enabled are related to the Internet of Things (IoT) and operational technology (OT), in addition to other impactful but uncommon rules. Due to the low prevalence of these applications on the public internet, we anticipate this change having minimal impact for most customers while providing faster visibility into critical risks.
Additionally, we will be disabling the Insecure PHP rule by default.
These rule changes will not override any customer-applied changes to the enablement status or severity for attack surface rules.
|
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-26-june-2024.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.