> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/release-information/feature-enhancements.md). # Feature Enhancements The following table describes new features in the and Cortex XDR agent 9.3 release. The release will be divided into three deployments: July 26th, August 9th and August 16th. ## General | FEATURE | DESCRIPTION | | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Expanded coverage & forensics (DLP, Mobile, & Linux) | Cortex XDR now supports archives and large file scanning up to 300 MB for DLP, provides day-one support for Android 17 and safer iOS deployments. Cortex XDR can now also collect the full set of Linux forensic artifacts. This achieves unified visibility, control, and IR parity across endpoint environments, eliminating manual collection and inspection gaps | ## Linux | FEATURE | DESCRIPTION | | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Resource-Efficient Linux Protection Agent | Our Linux agent now includes smart, built-in resource safeguards to keep your critical workloads running at peak performance. This feature automatically adjusts CPU and memory usage whenever your servers face heavy workload spikes, so your business-critical apps never lag or have downtime. The agent intelligently backs off under system pressure to prioritize your operations, giving your team continuous, invisible protection with minimal performance impact. | | CaaS Workloads | Protect your CaaS workloads running on Google Cloud Run or Azure Container Instance with the embedded Cortex XDR agent. You can now deploy the Cortex XDR agent inside Azure Container Instance and Google Cloud Run workloads to add runtime malware protection, exploit protection, and continuous vulnerability scanning. | | CaaS Workloads | Alpine Linux and other musl-based distributions are now supported for container-embedded deployments. | | Improved Linux Agent Resource Management | The Cortex XDR Linux agent now enforces per-component resource limits (CPU and memory) using Linux control groups. This ensures the agent and its subprocesses operate within predictable resource boundaries. Requires Cortex XDR Linux agent 9.3.0 or later. | ## Windows | FEATURE | DESCRIPTION | | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Runtime JSP Protection for Windows Servers | Detect and prevent malicious webshells from targeting your Java application servers. Cortex XDR agent for Windows now scans JSP and JSPX server pages at runtime. This protection extends the existing runtime coverage for Java applications. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/release-information/feature-enhancements.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.