> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-211-november-2025.md).

# Release 2.11 (November 2025)

The table below describes the features and enhancements introduced in the Cortex Xpanse Expander 2.11 (November 2025) release.

Cortex Xpanse typically upgrades customers over a three-week time frame. Contact customer success to find out your specific upgrade date.

| Feature                                                           | Description                                                                                                                                                                                                                                                                                                    |
| ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Attack Surface Testing Intrusiveness Levels                       | Safely test all your environments by adjusting the intensity of exposure checks.                                                                                                                                                                                                                               |
| AI Infrastructure Detections                                      | Ensure your visibility keeps pace with innovation by detecting more AI Infrastructure-related items, including MCP Servers, MCP Inspector, and more.                                                                                                                                                           |
| Service Version Enumeration and Filtering                         | Quickly isolate software by name and version in Services to speed investigations and hygiene work.                                                                                                                                                                                                             |
| Misconfiguration and Enumeration Alerts in Threat Response Center | Spot active misconfigurations and enumeration activity at a glance and prioritize response from a single view.                                                                                                                                                                                                 |
| Faster Triage with Bulk Actions                                   | New bulk actions to help you manage alerts and assets more efficiently.                                                                                                                                                                                                                                        |
| Bulk IP Address Paste                                             | <p>Accelerate your search and triage by pasting large IP address lists into any of the following views</p><ul><li>Alerts</li><li>Unified Inventory</li><li>Services</li><li>Domains</li><li>Certificates</li><li>Owned IPv4 Ranges (First and Last IPv4 Address fields)</li><li>Owned Responsive IPs</li></ul> |
| Cloud Resource Observation Timestamp Change                       | Cortex Xpanse will now take into account domains and IP addresses for First Observed and Last Observed timestamps for cloud assets.                                                                                                                                                                            |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-211-november-2025.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.