> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/features-introduced-in-this-release/feature-enhancements.md).
# Feature Enhancements
The Cortex XSOAR 8.9 release includes the following enhancements:
**General**
| Feature | Description |
| ----------------------- | --------------------------------------------------------- |
| Support for CIS Level 1 | Cortex XSOAR now follows CIS Level 1 security guidelines. |
**Incidents**
| Feature | Description |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Allow bulk action for **Retain**/**Undo Retain Incidents** | You can now **Retain** and **Undo Retain Incidents** from the incidents table on all incidents, including closed incidents. This feature lets you keep incidents for compliance or incident management purposes, ensuring critical data is preserved. |
| War room filtering | In the War Room, when selecting multiple filters, you can now view the results with any of the selected filters. |
Proxy
| Feature | Description |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Bypass the proxy server | Enhance network flexibility and avoid potential connectivity issues by specifying a list of domains, IP addresses, or network ranges in the textual UI to ensure traffic to these destinations is routed directly and not through a proxy. |
**Engines**
| Feature | Description |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enhanced engine upgrades | Gain greater flexibility and control over the upgrade process by setting upgrade variables, such as https\_proxy, using a new upgrade.conf file.
Note
You can use this feature when upgrading engines to Cortex XSOAR 8.10 and later.
Cortex XSOAR now supports the following platforms for engine installation:
- RHEL version 9.5
- Oracle Linux version 9.4
- Amazon Linux 2023
- Ubuntu 24.04
|
**Remote Repositories**
| Feature | Description |
| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enhanced version compatibility notifications for development and production environments | Receive clear warnings and visual indicators for potential version mismatches when syncing content between development and production, ensuring seamless upgrades. |
| Support for the **ed25519 algorithm** to connect to private content repositories | Cortex XSOAR now supports the high-speed, high-security **ed25519 algorithm** for SSH connections to content repositories. This aligns with industry best practices, providing a more secure method for access and enhancing your overall security posture. |
**High Availability**
| Feature | Description |
| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Backup and restore management in the Cortex XSOAR UI | Protect your data by enabling on-demand backup in the Cortex XSOAR UI. Customize backup frequency, restore data, and enable/disable backups from the Cortex XSOAR UI. |
**Troubleshooting**
| Feature | Description |
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Analyst actions recorded in audit logs | Audit logs now record commands entered by analysts in the War Room and Playground, which improves visibility into analyst actions taken during the incident response and troubleshooting processes. |
| Guard Rails performance-related alerts and warnings | Guard Rails includes new performance-related alerts and warnings that can be used as a guide to detect and prevent actions that may cause performance or instability issues. This ensures a reliable way to maintain a secure and stable environment. |
**API**
| Feature | Description |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| New administration APIs | Significantly enhance the management and configuration experience for engines and authentication settings by adding new APIs.
- Automate the deployment and management of engines.
- Configure IdP and SSO, enabling administrators greater control and efficiency in enforcing and managing access control.
|
| Support of additional Cortex APIs | The following data management APIs are now supported:
- Editing indicators
- Deleting batches of incidents:
|
**Multi-tenant**
| Feature | Description |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Upgrade main and child tenants for MSSPs | Improve flexibility when upgrading MSSP tenants:
Effortlessly upgrade the main tenant and child tenants with the previous version (n-1). For example, upgrade the main tenant running Cortex XSOAR version 8.10 alongside child tenants running version 8.9.
You can use this feature when upgrading to Cortex XSOAR 8.9 and later.
- Streamline the upgrade process by simultaneously upgrading all child tenants or a subset of them, removing the requirement for individual manual upgrades. You can also gradually upgrade tenants rather than upgrading them all at once.
|
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/features-introduced-in-this-release/feature-enhancements.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.