February 2025 - Release Notes - Cortex XDR - Cortex - Security Operations

Enhanced investigation experience

Causality Forensics Highlights are now enriched with MITRE ATT&CK tactics, techniques, and procedures (TTPs) as well as additional data points such as URL verdicts, WildFire reports and Threat Context. This streamlines your investigations and provides immediate, actionable insights into security alerts and the related artifacts in the causality chain.

Integrating forensics data in causality cards

Enriching the causality card with data from forensic collections such as OS system data, volatile and memory data, and application forensic data. This allows you to explore different layers of the investigation, simultaneously, within the same workflow.

Protection against security bypass techniques

Enhanced protection for Windows-based endpoints ensures your organization is safeguarded against malicious actors attempting to bypass Windows built-in security controls. This protects endpoints from the latest malicious tactics, empowering your team to focus on what truly matters without disruption.

Extended file type coverage for Windows

Strengthen your defense against advanced threats by using XDR to analyze ASP and ASPX files on Windows servers. This allows you to detect and prevent malicious files from being written to your endpoints’ file system.

Prisma Access Browser integration

Integrating Prisma Access Browser data into Cortex XDR expands the attack context to include browser activity. This allows you to query Prisma Access Browser data directly within Cortex and generate detection and correlation rules.

Enhanced visibility and auditing for Broker VM

Cortex XDR now provides enhanced error visibility and auditing for Broker VM applets. This enables you to quickly identify and resolve application, connectivity, and processing errors, simplifying troubleshooting and ensuring your critical workflows remain uninterrupted.

Flexible compute unit (CU) consumption

The new annual consumption plan allows you the flexibility to scale up during critical investigations or intensive periods and scale back during routine operations for predictable resource management.