> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1-ce/cortex-xdr-agent-release-information/feature-enhancements.md).
# Feature Enhancements
These enhancements provide new and improved capabilities.
The following table describes the Cortex XDR agent 9.1-CE release. The release will be divided into two deployments, June 15 2026 and June 22 2026.
## General
| FEATURE | DESCRIPTION |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Amazon ECS EC2 agent installer | Expanded runtime protection for AWS ECS EC2 workloads improves real-time defense against malware, exploits, and behavioral threats using the XDR agent to help teams stop attackers. |
| Endpoint Data Loss Prevention (DLP) | Protect web and endpoint activity from data leakage, even when devices are offline. Endpoint DLP delivers unified, proactive protection to stop data loss and keep critical information secure. Requires an additional license. |
## Linux
| FEATURE | DESCRIPTION |
| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Linux protection updates | - Neutralize multi-vector threats the moment they touch your Linux systems. New on-write protection automatically scans ELF, PE, and Mach-O files blocking malicious binaries from being stored in your environment.
- Identify stealthy "Command and Control" behavior by spotting unusual network connections. This new detection suite profiles network baselines for Linux to identify abnormal communication patterns.
|
| Secure Linux workloads with broader protection coverage | Prevent malicious activity on more Linux systems without requiring kernel-level access. We expanded Child Process Protection to support User Mode, ensuring your workloads stay secure even when kernel modules aren't available. This update provides broader coverage and simpler deployment for diverse Linux environments. |
| Linux distribution support | Support added for Alibaba Cloud Linux Release 3 |
## macOS
| FEATURE | DESCRIPTION |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| macOS protection updates | - Identify stealthy "Command and Control" behavior by spotting unusual network connections. This new detection suite profiles network baselines for macOS to identify abnormal communication patterns.
- Block malicious USB device attacks on macOS. Protect your macOS systems from unauthorized hardware attacks and malicious USB devices. The Malicious Device Prevention module identifies and blocks tools like the "USB Rubber Ducky" that exploit device trust to execute attack techniques from a USB device.
|
| MDM installation settings | Deploy agents effortlessly across your organization using your preferred mobile device management (MDM) tool. You can now configure installation settings directly through your MDM provider. We integrated support for managed app configurations to ensure seamless, single-package deployments. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1-ce/cortex-xdr-agent-release-information/feature-enhancements.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.