Feature Enhancements - Release Notes - Cortex XSIAM - Cortex - Security Operations

Expanded Asset Group scoping

Scope-Based Access Control (SBAC) has been enhanced to provide more granular control over your access policies. You can now define Asset Groups that include the Business Application Names attribute for scoping definitions.

New SBAC support for dataset rows

Security administrators can now define policies that grant Security Operations Center (SOC) teams access to only the relevant row data for their specific roles. This new granular scoping capability applies to product areas that reference dataset rows, such as XQL queries and custom widgets in dashboards.

User and role APIs

These new APIs enable you to manage user roles, update API keys, and add or remove role and scope assignments for users, which gives greater flexibility to automate and scale your user management workflows.

Attack Surface Testing Intrusiveness Levels

Safely test all your environments by adjusting the intensity of exposure checks.

Alerts for Attack Surface Testing misconfiguration findings

Attack Surface Testing will now generate issues for confirmed positive misconfiguration findings, enabling you to identify and secure your attack surface against these types of risks.

Attack Surface Management dashboard

This new dashboard provides a visual overview of your attack surface and can be used for reporting or as the starting point for ASM workflows.

Global Lookup improvements

The following improvements were introduced to provide more comprehensive and actionable insights from internet scan data beyond your own attack surface:

Additional ASM enhancements

Auto-populate command and Quick Action parameters

On-demand enrichment from the Unified Asset Inventory (UAI) enables commands and Quick Actions to remain dynamic and adaptable. Any attribute in the UAI, not just those hardcoded into the issue schema, can be accessed when needed for automation execution. This improves flexibility and reduces the need for playbooks to retrieve relevant data.

Dismiss alerts for non-configured playbook components

When setting up playbooks, you can now dismiss alerts for components you don't need, such as specific sub-playbooks, scripts, and commands. Alerts can be dismissed in both system and custom playbooks, and you do not need to edit or duplicate a system playbook to dismiss an alert. This enables you to reduce visual noise, making it easier to focus on tasks that require configuration.

Recommended Quick Actions

Recommended Quick Actions enable you to receive contextual and diverse automation recommendations directly within issue response workflows. Recommendations accelerate issue response and drive automation adoption by guiding users to the most relevant and efficient actions.

Unique task logos

Boost clarity and quickly distinguish between integration commands, custom scripts, and system actions with playbooks that display unique logos and content pack indicators.

Streamlined playbook development with drag-and-drop functionality

Streamline your playbook development by using drag-and-drop to build automation flows. This enables you to create and organize your playbooks faster by simply dragging tasks from the side panel directly onto the canvas.

AI Script Generator

Generate high-quality Python scripts quickly and efficiently with the AI Script Generator. It's built-in testing panel lets you validate and refine the code generated from natural language, ensuring accuracy and significantly reducing the time spent on manual development.

Choose an integration instance for Quick Actions

When running a Quick Action on demand or as part of an automation rule, you can now select a specific integration instance to use, enabling a more efficient and targeted response.

Automation health issues

New automation health issues help you quickly identify and resolve potential automation configuration issues, enabling you to maintain peak system performance.

Automation Exclusion Center enhancements

The automation exclusion center now allows for more dynamic and flexible policies:

Enhanced error visibility and auditing for additional Broker VM applets

Gain better insight into application, connectivity, and processing errors for the FTP Collector, Netflow Collector, Network Mapper, and Apache Kafka collector applets running on Broker VMs. Error messages are displayed on Apps of Broker VMs and Clusters, and applet status changes are logged in the collection_auditing dataset, enabling detailed investigations through XQL queries.

Broker VM support for Spain’s Esquema Nacional de Seguridad (ENS) National Security Framework

The Broker VM has been updated to comply with Spain’s Esquema Nacional de Seguridad (ENS) National Security Framework. You must enable the option Only use recommended cipher suites to meet the ENS regulation. This new setting is located in the Advanced Settings section, which you can access when configuring the Broker VM using its URL.

Enhanced Database Collector

The Database Collector applet now has a new Storage Method option, which offers more control over how the data is handled:

Enhanced XQL query monitoring and governance

Introducing significant updates to XQL query management that deliver a more responsive, holistic, and powerful Query Center experience. Key enhancements:

Lookup datasets enhancement

Cortex XSIAM has implemented a fix to improve lookup dataset queries and provide better flexibility in managing your data. Now, when you create or add data to a lookup dataset using the target stage, the _time field won't be included by default unless you explicitly add it with the fields stage.

New and improved Analytics tags

New analytics suites

Improved analytics tags:

New Advanced Email Security response engine

A lightweight, real-time remediation engine enabling automated, policy-driven actions to quickly respond to email threats before they manifest. All remediation actions initiated by automatic policies are tracked in the Remediation Action Center, where you can review the emails and actions taken.

File examination on-load for macOS

Detect and prevent execution of malicious Mach-O files when loaded on macOS-based endpoints, using this new Cortex XDR agent capability.

JScript file examination for Windows

Detect and prevent malicious JScript files from being executed or written to disk on Windows-based endpoints, using this new capability provided by the Cortex XDR agent.

LDAP Query Protection for Windows

Identify and block malicious reconnaissance activity targeting Windows Domain Controllers. Customers with the ITDR add-on can now use the XDR agent for real-time prevention against attack techniques used by tools like BloodHound's SharpHound collector.

Child Process Protection for Linux

Cortex XDR introduces an additional prevention module for Linux that examines the relations between parent and child processes to detect suspicious relations. This module provides improved detection and protection coverage capabilities.

XDR Agent for Windows on ARM64

Extend agent deployments to Windows devices running on ARM64 architecture, including Microsoft Surface devices.

Cortex XDR Security Controls Detection

Gain enhanced visibility into XDR agent profile configurations and exploit protection status, improving vulnerability risk identification, protection efficacy assessment, and prioritization.

Cortex Network Scanner enhancements

The following enhancements were introduced:

Unified integration error notifications

Instead of being inundated with multiple notifications, all data collector errors are now grouped into a single notification. This new, non-dismissible notification alerts all users to data source integration errors.

Cortex Vulnerability Block Grace Period

Enhancements to Cortex Vulnerability Management allow you to establish a block grace period when creating prevention policies. Grace periods are based on a fixed date and temporarily override the blocking action of a policy when new vulnerabilities are found. You can configure a uniform grace period for all severities or provide different settings for each severity. When grace periods are configured, findings trigger as normal, notifying you that a vulnerability exists in your environment. The block action is suppressed for the number of days specified, giving you time to mitigate the vulnerability.

Cortex Vulnerability Risk Score

The Cortex Vulnerability Risk Score (CVRS) is a dynamic vulnerability risk-scoring approach that helps you prioritize vulnerabilities. CVRS uses critical organization-specific information along with public vulnerability intelligence to provide a tailored, accurate risk score for each vulnerability alert and finding.

Vulnerability Management Enhancements

Updates to the Vulnerability Management UI help you contextualize risk and prioritize remediations. The following enhancements are included:

Enhanced visibility and auditing of XDR Collectors

Cortex XSIAM now provides enhanced error visibility and auditing for XDR Collectors. This enables you to quickly identify and resolve application, connectivity, and processing errors, simplifying troubleshooting and ensuring your critical workflows remain uninterrupted.