Granular RBAC Added to ITDR
(Available with the ITDR add-on)
With the new Case timeline record APIs, you can retrieve timeline records for a specified case with support for filtering, sorting, and pagination, and add new timeline records to capture case-related events and updates.
For implementation details, see:
• Retrieve case timeline records
• Add a case timeline record
The new API endpoint returns Least Privilege Access (LPA) recommendations for an asset based on its existing IAM policies or roles.
The endpoint analyzes the asset's activity during a specified lookback period and recommends the minimum set of existing IAM policies or roles required to preserve all observed actions. Use the returned policy or role configuration snippets to remediate over-privileged identities and implement least privilege access.
Track investigation milestones seamlessly directly from your case timeline. You can now edit specific playbook tasks to display their actions as case timeline records, matching your exact workflow naming conventions, and tag them as evidence to capture critical discovery details at the case level.
For autonomous playbooks, specific tasks are preconfigured to appear in the case timeline.
| | Improved agentic playbook predictability with LLM structured outputs | Highly reliable, automated workflows are now easier to maintain by enforcing structured responses for AI prompts within Cortex XSIAM playbooks. When configuring an AI prompt, you can optionally choose to use structured output and provide a JSON schema to ensure the model's response matches your required format, allowing subsequent playbook tasks to successfully use the output. | | Search playbooks by content pack | Find playbooks faster by filtering the Playbook Catalog by content pack. The Search by filter in the Playbook Catalog now includes a content pack option to find playbooks that belong to a specific content pack. | | Compute unit tracking for agentic requests | The Compute Units page now displays the evaluated compute cost for each agentic request to help you plan future resource allocations and understand the full ROI of your AI tools. These entries provide visibility into your AI usage patterns, but are marked as non-billable in the usage table and do not deduct from your current compute unit balance or affect daily limits. | ## Broker VM **Version 32.0.51 (reboot required)** For more information on maintenance releases, see [Maintenance Releases](/cortex-xsiam-rn/cortex-xsiam-release-information/maintenance-releases.md). | FEATURE | DESCRIPTION | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Upgrade applets independently | Deploy updates faster and with minimum dependences. You can now update individual Broker VM applets independently without upgrading the entire Broker VM. This reduces management overhead and delivers immediate enhancements without system-wide downtime. | | Enforce TLS 1.3 communication | Meet emerging compliance demands and secure your data transmissions against modern threats. Cortex XSIAM now supports TLS 1.3 communication between the Broker VM and the server to ensure your environment aligns with strict cybersecurity standards. | | DB collector Windows authentication | We have added Windows Authentication support to the (MSSQL) Database collector applet to enable secure connectivity in domain environments. The new authentication method supports Kerberos, NTLM and the standard SQL internal authentication. | ## Cortex Agentic Assistant | FEATURE | DESCRIPTION | | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Improved navigation to Agentic Assistant Hub | A new dedicated Agentic Assistant Hub menu item has been added to the main navigation sidebar to improve administrative efficiency. By providing a direct shortcut to your agent and action configurations, this update reduces operational overhead for security teams by eliminating the need to navigate through the chat interface. | | Personalized Agents | Unlock smarter, tailored agents infused with your organization’s unique knowledge. Connect directly to Google Drive, Confluence, or upload your standard operating procedures and documentation to power fully contextual agentic responses. Now available in private preview; contact your Palo Alto Networks representative to participate. | ## Cortex Query Language (XQL) | FEATURE | DESCRIPTION | | -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | XQL query macros | The new XQL text-substitution macros and the macro library enable you to save and reuse modular code snippets to simplify query authoring and centralize organizational logic. XQL macros eliminate repetitive manual work through modular expansion and a dedicated management UI, empowering teams to maintain high-quality, standardized logic with ease. | | Reshape data in XQL | Turn raw query results into clear, presentation-ready tables. You can now pivot rows into columns, transpose columns into rows, and replace null values across complex data types such as arrays, JSON, and datetime fields. | | Faster free text search | The new improved free text search enables you to run a single search across many datasets and get results faster and more reliably during investigations. | | Consistent query result access | The Query History view now retains results from investigation flows, simple search, and scheduled queries for a fixed 72-hour period across every tenant. When results expire, Cortex XSIAM marks them as Data Purged and hides the Show Results action so you always know their availability. | | Faster query building and autocomplete | Cortex significantly improved query building and query autocomplete response times, with the largest gains on large, data-heavy tenants. | | Query asset groups | Simplify security investigations in Cortex Query Language (XQL) with richer context. You can now query asset group information directly in XQL to correlate, filter, and report on your assets more effectively. We added the `asset_groups` system dataset to help you easily retrieve asset group details within your custom queries. For example, join against the new dataset using the asset group ID to get the asset group name. | ## Data Security | FEATURE | DESCRIPTION | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Continuous Strata logging authentication | Maintain uninterrupted data logging across commercial and FedRAMP Moderate environments without manual re-authentication prompts every six months. Cortex XSIAM now automatically manages secure background authentication for the Strata Logging Service, ensuring continuous data flows. | ## DLP | FEATURE | DESCRIPTION | | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Protect large files | DLP now supports classification of large files up to 300MB, including large PDFs, spreadsheets and archives. | | Stop file extension evasion attacks | Stop insider threat actor from exfiltrating sensitive data files by disguising their extensions. We now detect the original file type of most scanned files, preventing evasion attempts that rely on file extension manipulation. | | Modernized DLP block dialogs | Enjoy a modernized block dialog experience. We've refreshed the DLP block dialogs with the new Unity design system, delivering a cleaner, more consistent interface that aligns with the latest design standards. | | Protect data in compressed files | Protect sensitive data in compressed files. You can now apply DLP policies to archive files, ensuring comprehensive data protection across all file formats and providing visibility to the sensitive content results of those complex archive files. | ## Endpoint Security | FEATURE | DESCRIPTION | | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CaaS Workloads | Protect your CaaS workloads running on Google Cloud Run or Azure Container Instance with the embedded Cortex XDR agent. You can now deploy the Cortex XDR agent inside Azure Container Instance and Google Cloud Run workloads to add runtime malware protection, exploit protection, and continuous vulnerability scanning. | | Runtime protection for Java JSP files | Detect and prevent malicious webshells from targeting your Java application servers. Cortex XDR agent for Windows now scans JSP and JSPX server pages at runtime. This protection extends the existing runtime coverage for Java applications. | | Improved Linux Agent Resource Management | The Cortex XDR Linux agent now enforces per-component resource limits (CPU and memory) using Linux control groups. This ensures the agent and its subprocesses operate within predictable resource boundaries. Requires Cortex XDR Linux agent 9.3.0 or later. | ## Exposure Management | FEATURE | DESCRIPTION | | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Crowdstrike integration | Bring in assets and vulnerabilities discovered by CrowdStrike, then view and filter them alongside your other findings in Cortex Exposure Management. We added a built-in CrowdStrike integration that ingests discovered endpoints and vulnerabilities mapped to a CVE or vendor advisory. | | Network Scanner Compliance Scans for Debian and Ubuntu | Network Scanner capabilities now include compliance scanning support for Debian and Ubuntu operating systems. This allows security and compliance teams to audit Linux-based assets directly through network assessments. You can seamlessly run compliance and configuration audits on Debian and Ubuntu distributions alongside your existing scanned infrastructure. | ## Extended Analytics Detection Coverage | FEATURE | DESCRIPTION | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | NDR Unmanaged Subnet Analytics | Detects malicious activity instantly from blind spots created by new or unmanaged devices. We added NDR Unmanaged Subnet Analytics to analyze the collective behavior of the subnets, eliminating the need for a historical baseline and detecting attacks on unmanaged hosts. | | EDR Linux Sensitive Information Theft Analytics | A novel analytics-based detection tailored to the Linux domain, designed to identify anomalous or uncommon attempts by processes to access and extract data from sensitive system files and configuration directories. By profiling behavioral baselines, it automatically filters out standard administrative noise while exposing sophisticated adversaries, Webshells, and malicious scripts seeking to gather system-level intelligence, discover credentials, and uncover pathways for lateral movement. | | SSM Remote Management Analytics | Detects suspicious activity involving AWS Systems Manager (SSM), including command execution, session access, parameter store operations, and SSM agent behavior on endpoints. | | Cloud Log Tampering Analytics | Detects adversaries attempting to disable, delete, or modify cloud audit and activity logs to cover their tracks across AWS, Azure, and GCP. The suite leverages behavioral baselines and anomaly scoring to surface uncommon log-configuration changes, rare API calls targeting logging services, and unusual identities interacting with cloud telemetry pipelines. | | OCI Analytics | Detects malicious activity in Oracle Cloud Infrastructure (OCI) tenants by extending Cortex cloud analytics to OCI, giving customers a unified detection layer across all four major cloud providers. | | Extended EDR macOS AppleScript Analytics | The upgraded analytics detection suite uncovers adversaries abusing AppleScript to proxy malicious behavior on macOS, a technique increasingly leveraged by macOS infostealers and other threats. The suite surfaces uncommon command-line patterns and high-risk script intent across the attack lifecycle, including data exfiltration, credential and credential-file theft, cryptocurrency wallet access, sensitive application data collection, screen and clipboard capture, system information discovery (including VM/sandbox evasion checks), persistence via Launch Agents/Daemons, defense evasion and Gatekeeper bypass, and command-line obfuscation. | ## External Data Ingestion and Management | FEATURE | DESCRIPTION | | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Group Marketplace integrations into unified connectors |Connect each vendor through a single unified connector instead of dealing with separate data sources and marketplace integrations. On the Data Sources & Integrations page, Cortex XSIAM now groups related Marketplace integrations into one unified connector per vendor. This allows you to discover, add, and manage all of a vendor's capabilities from a single entry in the catalog. This new connector experience includes the following built-in features:
• Centralized vault credentials: Authenticate your connectors directly with secret vaults instead of manually entering credentials, extending standard platform credential security across your capabilities.
• Selective service onboarding: For multi-service connectors, such as Microsoft 365 or Google Workspace, you can choose to onboard the full suite at once or select individual services. Additional services can be enabled later without disrupting your existing configuration.
New tenants will see this updated experience across the entire catalog. Existing tenants will immediately get this new look-and-feel experience for a select number of initial Marketplace integrations.
| | CLCS log type filtering | Reduce your ingestion costs by controlling exactly which logs you send to Cortex XSIAM. When you onboard a Cloud Log Collection Service (CLCS) data source, including CNGFW, NGFW, Prisma Access, Panorama, or PAB, you can now select specific log types to ingest through a multi-select list. You can also edit log type filters on existing CLCS data sources at any time, so only high-value security logs reach the ingestion pipeline. | | Device Security data collector |Introducing a new data collector called Device Security, which collects alerts and device data from Strata Device Security using a new Strata Cloud Manager authentication method. Existing IoT Security data collectors will continue to operate using the legacy authentication method, now labeled IoT Security (Deprecated).
Legacy IoT Security data collectors will be discontinued in the near future. We recommend migrating to the new Device Security data collector to ensure uninterrupted data collection.
| | Continuous data parsing | Avoid data gaps and keep collecting critical logs when datasets grow unexpectedly. When a dataset reaches its 2,000-field limit, you can now add a parsing rule stage to explicitly select the fields you need, which resumes the parsing. The updated error messages provide exact steps to resume data flow. | ## Forensics | FEATURE | DESCRIPTION | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Deeper Linux forensic visibility |Investigate Linux incidents with deeper context across system activity and administrative actions. Cortex XDR forensic triage collection now gathers system log history and sudo log records, and captures additional user login and session details. You can filter and hunt across these new artifacts to trace unauthorized access and privileged actions faster.
Foresics add-in required
| ## Investigation and Response | FEATURE | DESCRIPTION | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Manage case team members and access | Gain clear visibility into who is actively working on an investigation and enforce strict access controls for cases containing sensitive context. Security investigations require cross-functional collaboration across multiple teams and users. With this update, you can now capture all participating individuals and user groups while ensuring sensitive context is accessible only to designated team members. | | Enhanced case SLA tracking and reporting | Elevate your compliance reporting and case prioritization with fully integrated Case SLAs and advanced XQL querying capabilities. You can now track real-time SLA metrics directly from the case header and table views, while utilizing custom fields and out-of-the-box resolution timers to ensure organizational KPIs are met. Additionally, new XQL support allows you to search, filter, and report on SLA data, such as breach status and remaining time, to quickly surface at-risk cases. | | Enhanced detection logic with rule and policy metadata | Accelerate triage and investigation by instantly tracing detections back to their underlying logic with newly added rule and policy metadata. You can now analyze and filter issues and findings by specific detection sources with direct links to rule and policy details. | | Case experience improvements | Work cases faster and more effectively with usability enhancements designed to streamline your everyday investigation workflow. You can now expand the grouping graph to full screen, navigate between issues in the issue feed the same way as the issue table, and group issues in the issue feed by data source. Additionally, asset group names and asset tags are now natively exposed for use in cases and XQL searches, while the resolution center automatically opens to the first tab containing tasks to help you jump straight into remediation. | | Issue export optimization | To ensure fast, reliable downloads, the issues TSV export is now capped at a maximum of 50k issues per export. | | AI tool visibility in the causality chain | Accelerate your investigations by identifying and highlighting usage of AI tools within the causality chain. The causality chain now features visual indicators for AI-driven processes across Windows and Mac. Beyond a simple visual flag, each indicator provides specific context to identify the exact AI tool detected, giving analysts the immediate clarity needed to triage incidents faster. | | Manage service threads more efficiently | Manage your service threads more efficiently. We've redesigned the Cortex managed services workspace to help you work faster: view threads in a table layout for better scanning, set assignee and status directly in the report body without switching views, and read comments in a wider section for improved readability. | | Granular escalation contacts and actions | Manage escalation contacts and response actions with greater precision in your Cortex managed detection and response (MDR) experience. Define actions and escalation contacts that determine how the Cortex MDR team responds to detections in your environment, replacing the earlier file-based update process with a more structured configuration model. | | Filter issues by resolution SLA and resolution timer in XQL | Query and filter issues by their resolution service-level agreement (SLA) and resolution timer values using Cortex Query Language (XQL). We now expose the Resolution SLA and Resolution Timer as filterable XQL fields. The Resolution SLA and Resolution Timer XQL schemas also include derived fields, so you can build queries, correlation rules, and dashboards that track whether issues are resolved within their defined SLA goals. | | Prisma Browser & Cortex XSIAM integration | Cortex XDR now natively integrates Prisma Access Browser telemetry, unifying endpoint and browser data in a single platform. Now, teams gain a comprehensive investigation surface, empowering them to perform cross-environment queries and analysis from a centralized platform. | | Cortex Cloud Consumption dashboard | Track your cloud usage at a glance. You can now monitor your cloud consumption over the last 90 days with a detailed breakdown by workload type and usage details across all your cloud accounts. The new Cortex Cloud Consumption dashboard shows usage trends over 7, 30, and 90-day windows. It enables filtering by date range, cloud provider, account, and asset type, with the past 365 days of data available for custom date ranges. | ## Marketplace Content Changes | FEATURE | DESCRIPTION | | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Built-in Cortex automation commands | Execute essential playbook commands instantly without manual setup overhead. Built-in commands replace the older **Core Investigation and Response** and **Cortex Platform - Core** integrations while maintaining full functionality and improving performance. | ## Vulnerability Management | FEATURE | DESCRIPTION | | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Streamlined Resolution Actions | We’ve updated the Vulnerability Issues side-panel to introduce Resolution Actions, providing a unified and consistent remediation experience across both individual issues and broader cases. When an immediate patch isn’t viable, the side-panel now surfaces approved compensating controls as a valid Resolution Action to help you mitigate risk safely. Speed up your incident response with clear, prescriptive guidance—whether that means launching a dedicated automation playbook or following step-by-step manual instructions. Recommendations are also provided at the case level, giving you access to full operational context without needing to pivot between screens. | | Remediate Zero Day threats faster | Enhancements to the Vulnerability Management list view help you isolate and triage global attack surface events and major zero-day events, with greater speed. You can now easily filter vulnerabilities to focus exclusively on high-priority, newly identified emerging threats. For security events associated with multiple vulnerabilities, you can drill down to filter by a single, specific vulnerability, giving you granular visibility. | | Improved Kubernetes context for Vulnerability Findings | Vulnerability findings for Kubernetes Resource asset types now include dedicated Kubernetes metadata, providing you deeper visibility into containerized environments. You can view and filter by fields such as, Cluster, Namespace, Namespace Label across the UI, XQL, and the Public API (PAPI). This enhancement provides the granular context needed to quickly isolate vulnerabilities by specific environments or microservices. | | Redesigned Vulnerability Findings side panel |We have redesigned the Vulnerability Findings side-panel to put critical context right at your fingertips. Evidence fields are now front and center, giving you insight into exactly why a vulnerability was detected including additional extraction, normalization, and display of detection evidence from all Cortex scan sources.
Surfacing the detection logic, allows you to reduce the time spent investigating false positives or searching for root causes. The revamped interface allows you to assess the risk and context of a findings at a glance, accelerating your mean time to remediation (MTTR).
| | Active Vulnerability Findings Over Time widget | Track active vulnerability findings over the last 6 months in the new Active Vulnerability Findings Over Time widget on the Vulnerability Management dashboard. | | Operating system-level filtering for application vulnerability matching | Reduce false positive vulnerability findings and improve the accuracy of application vulnerability detection with operating system (OS)-level filtering. We now support OS-level filtering when matching applications to CVEs. Application matching evaluates the OS on which an application runs before associating a CVE with that application. When a CVE affects an application only on a specific OS, Cortex flags the application as vulnerable only on the affected OS. OS-level filtering also extends application matching to support macOS vulnerability data. | ## XDR Collectors **XDR Collectors 1.5.3:** Windows 1.5.3.2503 and Linux 1.5.3.2371 **XDR Collectors 1.4.3:** Windows 1.4.3.1686 | FEATURE | DESCRIPTION | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | XDR Collectors 1.5.3 upgrade | Protect your environment with the latest security enhancements and system stability. Cortex XSIAM now supports XDR Collectors version 1.5.3.XXXX for Windows and version 1.5.3.XXXX for Linux. | | Upgraded Winlogbeat | Cortex XSIAM now supports version 9.3.2 Winglobeat for 64-bit XDR Collectors. Live 64-bit XDR Collectors receive this update automatically, while 32-bit XDR Collectors remain unaffected, as this independent update is not tied to any specific XDR Collectors version. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026/feature-enhancements.md?ask=