> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-211-november-2025.md).

# Release 2.11 (November 2025)

The table below describes the features and enhancements introduced in the Cortex Xpanse Expander 2.11 (November 2025) release.

Cortex Xpanse typically upgrades customers over a three-week time frame. Contact customer success to find out your specific upgrade date.

| Feature                                                           | Description                                                                                                                                                                                                                                                                                                    |
| ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Attack Surface Testing Intrusiveness Levels                       | Safely test all your environments by adjusting the intensity of exposure checks.                                                                                                                                                                                                                               |
| AI Infrastructure Detections                                      | Ensure your visibility keeps pace with innovation by detecting more AI Infrastructure-related items, including MCP Servers, MCP Inspector, and more.                                                                                                                                                           |
| Service Version Enumeration and Filtering                         | Quickly isolate software by name and version in Services to speed investigations and hygiene work.                                                                                                                                                                                                             |
| Misconfiguration and Enumeration Alerts in Threat Response Center | Spot active misconfigurations and enumeration activity at a glance and prioritize response from a single view.                                                                                                                                                                                                 |
| Faster Triage with Bulk Actions                                   | New bulk actions to help you manage alerts and assets more efficiently.                                                                                                                                                                                                                                        |
| Bulk IP Address Paste                                             | <p>Accelerate your search and triage by pasting large IP address lists into any of the following views</p><ul><li>Alerts</li><li>Unified Inventory</li><li>Services</li><li>Domains</li><li>Certificates</li><li>Owned IPv4 Ranges (First and Last IPv4 Address fields)</li><li>Owned Responsive IPs</li></ul> |
| Cloud Resource Observation Timestamp Change                       | Cortex Xpanse will now take into account domains and IP addresses for First Observed and Last Observed timestamps for cloud assets.                                                                                                                                                                            |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-211-november-2025.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.