February 2025

This section describes the new features and updates introduced in the Cortex XSOAR SaaS 8.9 release.

Release highlights

The Cortex XSOAR 8.9 release includes the following highlights:

Feature	Description
A new look and feel for playbooks	The latest enhancements in user experience improve playbook readability and clarity through an updated look and feel. For more information, see Use the Work Plan in an investigation.
Collapsible playbook sections	The updated collapsible playbook sections enable users to stay focused on the relevant playbook details without distractions, allowing for easier navigation through complex playbooks and increased productivity. For more information, see Create a section header.
Unlimited user license for development tenants	With no license limit for users on development tenants, you can build, test, and refine automations at scale. This drives faster innovation, more reliable workflows, and scalable solutions as your organization grows. For more information, see Understand Cortex XSOAR licenses.
Notifications for deprecated content	New automated user notifications about deprecated playbooks, sub-playbooks, and scripts ensure updated, effective, and accurate security workflows. For more information, see User preferences.

Feature enhancements

The Cortex XSOAR 8.9 release includes the following enhancements:

Incidents

Feature	Description
Allow bulk action for Retain/Undo Retain Incidents	You can now Retain and Undo Retain Incidents from the incidents table on all incidents, including closed incidents. This feature allows you to keep incidents for compliance or incident management purposes, ensuring critical data is preserved and not deleted due to retention enforcement or accidental removal. For more information, see Investigate an incident.
War room filtering	In the War Room, when selecting multiple filters, you can now view the results with any of the selected filters.

Engines

Feature	Description
Enhanced engine upgrades	Gain greater flexibility and control over the upgrade process by setting upgrade variables, such as https_proxy, using a new upgrade.conf file. For more information, see Upgrade an engine. You can use this feature when upgrading engines to Cortex XSOAR 8.10 and later.
Platform support	Cortex XSOAR now supports the following platforms for engine installation: RHEL version 9.5 Oracle Linux version 9.4 Amazon Linux 2023 Ubuntu 24.04 For more information, see Engine requirements.

Remote Repositories

Feature	Description
Enhanced version compatibility notifications for development and production environments	Receive clear warnings and visual indicators for potential version mismatches when syncing content between development and production, ensuring seamless upgrades. For more information, see Push content from a development tenant.
Support for the ed25519 algorithm to connect to private content repositories	Cortex XSOAR now supports the high-speed, high-security ed25519 algorithm for SSH connections to content repositories. This aligns with industry best practices, providing a more secure method for access and enhancing your overall security posture. For more information, see Set up a private remote repository.

Troubleshooting

Feature	Description
Analyst actions recorded in audit logs	Audit logs now record commands entered by analysts in the War Room and Playground, which improves visibility into analyst actions taken during the incident response and troubleshooting processes. For more information, see Management audit logs.
Forward integration logs to the Syslog server	You can now forward integration logs to the Syslog server, which enables you to quickly manage and address any issues in your environment. For more information, see Configure notification forwarding
Forward Guard Rail alerts and warnings to the Syslog Server	You can now forward guard rail warnings and alerts to your Syslog Server, which enables you to quickly manage and address any issues that may occur in your environment. For more information, see View service limit errors and warnings on the Guard Rails page.
Guard Rails performance-related alerts and warnings	Guard Rails includes new performance-related alerts and warnings that can be used as a guide to detect and prevent actions that may cause performance or instability issues. This ensures a reliable way to maintain a secure and stable environment.

API

Feature	Description
New administration APIs	Significantly enhance the management and configuration experience for engines, syslog, and authentication settings by adding new APIs. Automate the deployment and management of engines. Facilitate easier management of syslog servers at scale. Configure IdP and SSO, enabling administrators greater control and efficiency in enforcing and managing access control.
Support of additional Cortex APIs	The following data management APIs are now supported: Editing indicators Deleting batches of incidents:

Marketplace content changes

This section describes the changes in content (integrations, playbooks, and indicators) from October 2024 to February 2025.

Reusing topic #UUID-ae766b8f-db61-39aa-e790-dce11ba4c9a4