June 2023 - Release Notes - Cortex XDR - Cortex - Security Operations

To enable a better understanding of the risk score of an asset in the Identity Threat Module,  Cortex XDR includes a risk level severity in the API. The severity categories are Low, Medium, or High, based on a deep analysis of the incidents in which the asset participated.

To expand the current automation capabilities of Cortex XDR:

Cortex XDR now supports automatic enrichment for asset role tags for quick asset role extraction during incident response activities.

The Local File Threat Examination security module is now available for macOS. This provides extra protection for the agent and can optionally quarantine malicious files and terminate malicious processes on the endpoint.

To provide you with more granularity, Cortex XDR now enables you to manage detection separately from prevention when disabling a BIOC rule.

You can now cancel the option to isolate an agent if the connection with the managing server is lost after a defined period of time.

To enhance Cortex security measures, a new password strength requirement is now enforced for Uninstall Password in the Agent settings profile.

Cortex XDR has added an API for initiating forensic triage actions.

The forensics add-on now includes two new remote access artifacts: AnyDesk Trace Logs and AnyDesk Connection Logs. The addition of these artifacts expands the Cortex XDR ability to identify attacker infiltration and persistence within a network.

New metrics with improved precision in tracing data collection. These metrics are saved in the metrics_source dataset, and are reflected on the Ingestion dashboard.

Additional Okta data collector event types have been added, and are now saved in the saas_audit_logs dataset.

The Google Pub/Sub subscription has been implemented to ensure that you can download each file only once.

The parsing_rules_errors dataset was improved to help you identify and resolve errors during data collection.

As part of the enhancements to the integration of NGFW through the native Cortex XDR data lake, NGFW log ingestion was also enhanced.

Cortex XDR now displays all API errors for data collectors on the Collection Integrations page. Each time an integration instance changes its status, an audit entry is added to the new collection_auditing dataset. Error entries are also logged as collection alerts in the data_ingestion_health dataset, which trigger health monitoring notifications in the UI.

Cold storage queries are now faster and more efficient due to an improved data rewarm algorithm. Rewarmed data is saved in a temporary hot storage cache that is available for subsequent queries on the same time-range at no additional cost.

To monitor the collection health of the XDR Collectors, Cortex XDR now provides an out-of-the-box template that collects log files in a designated dataset, panw_xdrc_raw.

You can now copy the configuration of a Broker VM to another Broker VM. This also includes applet settings.

Each Local Agent Settings applet on the Broker VM now supports up to 50,000 agents, as opposed to only 10,000.

You can now configure the retrieval value for a timestamp as an integer or a string. The following string timestamp formats are now supported:

The Cortex XQL Schema Reference Guide has been improved to provide the latest fields and field descriptions available in the xdr_data dataset.

The Cortex Query Language (XQL) now includes a new boolean not operator to exclude data from your query.

Cortex Query Language (XQL) now supports a column order function with the view stage. You can use this function when building a query and want to show results that contain empty fields with a null value last.

Cortex Query Language (XQL) now includes a getrole stage to enhance investigation capabilities. It enriches events with specific roles associated with usernames or endpoints. The results are displayed in a new column called asset_roles.

To expand the current gateway capabilities, you can view and manage user-groups across all products.

To expand the current gateway capabilities, you can view and manage tenants and role-based access control (RBAC) settings across all products.

To improve security measures, you can configure a password for all files that were downloaded during an investigation by the Cortex XDR agent.