May 2026

This section describes the new features and updates of the Cortex XSOAR 8.14 SaaS release.

Release Highlights

The following are the key highlights for this release.

FEATURE	DESCRIPTION
Multi-tenant support for child tenant name changes	Simplify tenant management by renaming child tenants from within the Cortex Gateway. You now have the flexibility to ensure tenant names consistently reflect current business requirements, maintaining operational clarity across large-scale SOC deployments. For MSSP/Enterprise Multi-tenant customers.
Organized content management	Easily distinguish between your custom work and content pack items with a dedicated workspace for each. To ensure a cleaner view, we moved all content pack items to the Content Pack Items page, while the Content Items page is now reserved exclusively for your custom creations.
Enhanced audit logs	Gain full visibility and meet compliance requirements with expanded auditing for notification forwarding and content management. You can now track configuration changes for notifications and high-stakes content lifecycle events, such as pushing content to production, directly within the Management Audit log.
Identity and privilege-based SOC response	Instantly disrupt the kill chain with minimal user impact by validating identity and dynamically limiting privileges via CyberArk Endpoint Privilege Manager. Available via Cortex Marketplace. Requires a CyberArk EPM license.

Marketplace Content Changes

The following marketplace content updates have been made in this release.

FEATURE	DESCRIPTION
Crowdstrike Falcon integration	Deepen your security insights by consolidating a wider range of security data into a single view for more comprehensive threat analysis. We expanded the CrowdStrike integration by adding a new data collection type to capture additional security events.
AzureWAF integration	Strengthen your cloud defense and gain full visibility into web traffic threats by centralizing security events from your Azure Front Door deployments. We added support for ingesting and analyzing WAF policy data to help you respond to attacks faster.