> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-27-september-2024.md).

# Expander Release 2.7 (September 2024)

The table below describes the features and enhancements introduced in the Expander 2.7 (September 2024) release.

Cortex Xpanse typically upgrades customers over a three-week time frame. Contact customer success to find out your specific upgrade date.

| Feature                                           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Scanning enhancements                             | <p>Scanning on 60+ additional protocols will be released by the end of October. Periodic discovery scans on all 65k ports was released in September.</p><p>Cortex Xpanse now performs periodic discovery scans across global IPv4 address space for all 65k ports and on 60+ additional protocols. Once a service is found, we scan it daily until it becomes inactive. These enhancements reduce the possibility of important exposures being missed, making it easier for you to secure your attack surface.</p> |
| Services XQL dataset enhancements                 | Cortex Xpanse has enhanced the external services XQL dataset to include more detailed CVE data and additional service classification and geolocation information. This enhanced dataset will enable you to configure more targeted custom alerting and more detailed custom dashboards.                                                                                                                                                                                                                            |
| Alerts Overview dashboard                         | The Alerts Overview dashboard (formerly called the Comprehensive Alerts Overview) has been updated to present trends such as alert resolution journey and top ten alerts by type and cloud provider, over a one year period.                                                                                                                                                                                                                                                                                       |
| QRadar outbound Integration                       | This new integration forwards Xpanse-discovered risks for correlation and alerting within QRadar.                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Active Response Improvements                      | <p>Enrichment improvements:</p><ul><li>Support for retrieving the hierarchy of an Azure Compute instance</li></ul><p>Increased coverage of remediation for the following attack surface rules:</p><ul><li>TFTP Server</li><li>Libssh</li><li>Insecure Bitvise SSH Server</li><li>Insecure SFTPGo</li></ul>                                                                                                                                                                                                         |
| Remediation Report                                | This new report provides detailed information, broken down by business unit, on your security risks, prioritization of those risks, and instructions on how to reduce your overall security risk. Use this report to share detailed risk remediation information with individuals who do not have access to Expander.                                                                                                                                                                                              |
| Version column added to alerts table              | A software version column has been added to the Alerts table, enabling you to export and filter on the detected software version.                                                                                                                                                                                                                                                                                                                                                                                  |
| New attack surface rules and attack surface tests | Detect and verify new risks with the introduction of more than 30 attack surface rules and 40 attack surface tests.                                                                                                                                                                                                                                                                                                                                                                                                |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-27-september-2024.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.