About Cortex XDR Collector content updates - To quickly resolve any issues in policy, Palo Alto Networks can seamlessly deliver software packages called content updates. - Administrator Guide - Cortex CLOUD

To quickly resolve any issues in policy, Palo Alto Networks can seamlessly deliver software packages for Cortex Cloud, called content updates. Content updates for XDR Collectors contain changes or updates to the Elasticsearch Filebeat infrastructure or the Elasticsearch* Winlogbeat infrastructure.

When a new update is available, Cortex Cloud notifies the XDR Collectors. The XDR Collectors then randomly choose a time within a six-hour window during which they retrieve the content update from Cortex Cloud.