> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2025/february-2025.md). # February 2025 This section describes the new features and updates introduced in the Cortex XSOAR SaaS 8.9 release. ## Release highlights The Cortex XSOAR 8.9 release includes the following highlights: | Feature | Description | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A new look and feel for playbooks |

The latest enhancements in user experience improve playbook readability and clarity through an updated look and feel.

For more information, see Use the Work Plan in an investigation.

| | Collapsible playbook sections |

The updated collapsible playbook sections enable users to stay focused on the relevant playbook details without distractions, allowing for easier navigation through complex playbooks and increased productivity.

For more information, see Create a section header.

| | Unlimited user license for development tenants |

With no license limit for users on development tenants, you can build, test, and refine automations at scale. This drives faster innovation, more reliable workflows, and scalable solutions as your organization grows.

For more information, see Understand Cortex XSOAR licenses.

| | Notifications for deprecated content |

New automated user notifications about deprecated playbooks, sub-playbooks, and scripts ensure updated, effective, and accurate security workflows.

For more information, see User preferences.

| ## Feature enhancements The Cortex XSOAR 8.9 release includes the following enhancements: **Incidents** | Feature | Description | | -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Allow bulk action for Retain/Undo Retain Incidents |

You can now Retain and Undo Retain Incidents from the incidents table on all incidents, including closed incidents. This feature allows you to keep incidents for compliance or incident management purposes, ensuring critical data is preserved and not deleted due to retention enforcement or accidental removal.

For more information, see Investigate an incident.

| | War room filtering | In the War Room, when selecting multiple filters, you can now view the results with any of the selected filters. | **Engines** | Feature | Description | | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enhanced engine upgrades |

Gain greater flexibility and control over the upgrade process by setting upgrade variables, such as https\_proxy, using a new upgrade.conf file.

For more information, see Upgrade an engine.

You can use this feature when upgrading engines to Cortex XSOAR 8.10 and later.

| | Platform support |

Cortex XSOAR now supports the following platforms for engine installation:

For more information, see Engine requirements.

| **Remote Repositories** | Feature | Description | | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enhanced version compatibility notifications for development and production environments |

Receive clear warnings and visual indicators for potential version mismatches when syncing content between development and production, ensuring seamless upgrades.

For more information, see Push content from a development tenant.

| | Support for the **ed25519 algorithm** to connect to private content repositories |

Cortex XSOAR now supports the high-speed, high-security ed25519 algorithm for SSH connections to content repositories. This aligns with industry best practices, providing a more secure method for access and enhancing your overall security posture.

For more information, see Set up a private remote repository.

| **Troubleshooting** | Feature | Description | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Analyst actions recorded in audit logs |

Audit logs now record commands entered by analysts in the War Room and Playground, which improves visibility into analyst actions taken during the incident response and troubleshooting processes.

For more information, see Management audit logs.

| | Forward integration logs to the Syslog server |

You can now forward integration logs to the Syslog server, which enables you to quickly manage and address any issues in your environment.

For more information, see Configure notification forwarding

| | Forward Guard Rail alerts and warnings to the Syslog Server |

You can now forward guard rail warnings and alerts to your Syslog Server, which enables you to quickly manage and address any issues that may occur in your environment.

For more information, see View service limit errors and warnings on the Guard Rails page.

| | Guard Rails performance-related alerts and warnings | Guard Rails includes new performance-related alerts and warnings that can be used as a guide to detect and prevent actions that may cause performance or instability issues. This ensures a reliable way to maintain a secure and stable environment. | **API** | Feature | Description | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | New administration APIs |

Significantly enhance the management and configuration experience for engines, syslog, and authentication settings by adding new APIs.

| | Support of additional Cortex APIs |

The following data management APIs are now supported:

| ## Marketplace content changes This section describes the changes in content (integrations, playbooks, and indicators) from October 2024 to February 2025. Reusing topic #UUID-ae766b8f-db61-39aa-e790-dce11ba4c9a4 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2025/february-2025.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.