> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026/release-highlights.md).

# Release Highlights

The following are the key highlights for this release.

| FEATURE                                         | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Native Support for Frontier AI Models           | <p>Equip Cortex AgentiX agents with the world’s most powerful <a href="https://www.paloaltonetworks.com/blog/security-operations/cortex-frontier-ai/">frontier AI models</a>, including Anthropic Claude Sonnet 4.6, Claude Opus 4.8, and Gemini 3.5 Flash, and seamlessly switch between them to match specific tasks with the most appropriate model.</p><p>Claude Sonnet 4.6 and Claude Opus 4.8 are available in the US and EU regions. Gemini 3.5 Flash is available in the US, EU, SG, JP, IN and UK regions. Claude Sonnet 5 is available upon request in the US and EU regions.</p> |
| Extended Threat Intel (XTI)                     | Introducing XTI, a comprehensive threat intelligence offering that embeds adversary insights directly into SOC workflows through enriched case investigations and AI-driven behavioral analysis. Powered by Unit 42, XTI delivers a unified catalog of threat actors, malware, and vulnerabilities to supercharge XQL-based threat hunting and continuous IOC detection. Analysts can further accelerate triage and remediation by automating threat-aware responses in playbooks and leveraging the AgentiX AI assistant for natural language intelligence searches.                       |
| AI-driven dashboard builder                     | Turn natural language prompts into data visualizations in seconds. A streamlined workflow for setup, access control, reporting, and live previews helps your team build executive-ready dashboards and reports faster, with fewer manual steps.                                                                                                                                                                                                                                                                                                                                             |
| AI-Generated Data Model Rules                   | Onboard custom logs in minutes, not hours. Instantly generate XDM mapping rules to normalize data for effortless querying and unified threat detection. Now available in public preview, available in these regions US, EU, CA, UK, KR, SG, AU, JP, IN, DE, and FR.                                                                                                                                                                                                                                                                                                                         |
| AI-Powered Remediation Guidance                 | Turn vulnerability findings into actionable commands with AI-driven, step-by-step guidance. See recommended fixes, verified vendor patch links, and risk-reducing workarounds, so your team can act faster with less manual research.                                                                                                                                                                                                                                                                                                                                                       |
| Agentic Endpoint Security (AES)                 | Protect your AI attack surface with real-time discovery and risk assessment for AI plugins, components, and binaries running on endpoints—all built into the unified Cortex XDR agent. Additional license required.                                                                                                                                                                                                                                                                                                                                                                         |
| Enhanced Identity Threat Detection and Response | Strengthen identity protection with streamlined investigations, risk-based conditional access policies, proactive Active Directory posture management, and 17 new out-of-the-box detectors for Idira. Additional license required.                                                                                                                                                                                                                                                                                                                                                          |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026/release-highlights.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.