April 2024 - Release Notes - Cortex XSIAM - Cortex - Security Operations

Multi-Role API Keys

You can now create API keys with multiple roles to improve operational efficiency and allow dynamic RBAC management of API keys. The API key permissions have the aggregated permissions of the roles associated with it.

Timer fields in alerts

Create and add a Timer field to alerts, enabling you to measure time duration at the alert level, improve response times, and gain visibility of the alert progress.

Attack Surface Testing

Cortex XSIAM can now confirm the presence of vulnerabilities through customer-authorized, benign Attack Surface Testing. Confirming or disproving the presence of a vulnerability allows Cortex XSIAM to prioritize risks with more precision and confidence. Attack surface tests are run daily on services exposed to the public internet and can be configured to automatically include new directly-discovered services. This narrows the automation gap between attackers and defenders and enables you to focus on the most impactful remediations.

Redesigned External Service Details

Cortex XSIAM has introduced a redesigned details page for external services, providing a single point of access to all the incidents, alerts, and assets related to a service. The new service details also display a comprehensive list of attack surface test results or inferred CVE intelligence.

ASN Data

Gain additional context for investigating alerts with Autonomous System Number (ASN) data filters and details. Cortex XSIAM now supports filtering based on ASN data in the Asset Inventory and provides ASN details on the details pane for IPv4 ranges and responsive IPs.

Analytics for Containerized Environments

Cortex XSIAM enhances its container security capabilities with the introduction of a detection analytics pack designed for managed and unmanaged Kubernetes environments. This enhancement strengthens cloud workload protection by enabling proactive identification and mitigation of malicious content inside containerized applications.

New dataset for auditing correlation executions

The new correlations_auditing dataset provides visibility into your correlation rules by logging each rule execution. The dataset records the query times, correlation start/end times, retry attempts, failure reasons, and other useful metrics.

Remediation Confirmation Scans for ASM Alerts

Cortex XSIAM introduces remediation confirmation scanning to validate the resolution of Attack Surface Management (ASM) alerts. A security analyst can initiate this scan anytime using a button on the ASM alert page. Remediation confirmation scans use the same payloads and ASM global scanning infrastructure that are used for service discovery to quickly validate that the risk has been addressed.

Broker VM and XDRC data sources in the XSIAM Command Center

Broker VM and XDRC are now displayed as part of the XSIAM Command Center data sources. In addition, the XSIAM Command Center dashboards have been enhanced to include even more drill downs.

Cloud Security Agent

Cortex XSIAM now includes a unified (single) agent that reduces maintenance and resource overheads while providing runtime security and vulnerability management capabilities for cloud native environments.

Requirements:

Supports:

Root detection alerts on Android-based endpoints

Cortex XSIAM now includes root detection alerts, to help you identify Android devices where malicious tools could be installed using root access privileges.

Additional malware protection for iOS-based endpoints

The endpoint iOS malware profile now includes options to enforce use of the Safari browser security module to monitor network traffic, and to restrict and block network traffic for unsanctioned apps on supervised iOS devices. These enhancements provide proactive gating of suspicious sites, and granular control and monitoring of network traffic.

Additional network filtering alerts for iOS-based endpoints

Safari Safeguard provides new protection modules in iOS to help track malicious app activity, unwanted access to malicious web sites and URLs, and monitoring of unsanctioned web access. The new events are:

Enhanced Vulnerability Assessment

Cortex XSIAM introduces the Enhanced VA mode that uses advanced algorithms and comprehensive databases to deliver in-depth analysis and extensive details on CVEs. The Enhanced VA mode is available on Windows and MacOS endpoints running Cortex XDR agent versions 8.3 and later.

Cortex XSIAM Notebooks Enhancements

Introducing new capabilities to leverage your custom analytics, insights, and learnings to enrich your detection and investigation experience using Cortex XSIAM Notebooks.

Notebooks now expose custom tables as datasets. You can now generate and store profiles, custom tables, and insights as XQL datasets. You can then use these datasets for correlations, queries, and day-to-day work.

XDR Collectors 1.4.1

This release includes performance improvements and bug fixes.

Broker VM 23.0.33

This release includes performance improvements and bug fixes.

TTL for lookup datasets

Cortex XSIAM now enables configuring Time To Live (TTL) for lookup datasets, which specify when lookup entries expire and are removed automatically from the dataset. The default value is forever, meaning they never expire.

NGFW configuration log ingestion

NGFW configuration logs are now ingested, to enrich the firewall data ingested into Cortex XSIAM.

New Parsing Rules regexcapture function

Cortex XSIAM now supports using a new Parsing Rules function called regexcapture to extract fields using regular expression named groups from a given string and return a JSON object with capturing groups. This function simplifies the Parsing Rules code for fields extraction.

Aligned XQL function descriptions and syntax

The XQL query function and syntax descriptions in Cortex XSIAM are now aligned with the descriptions found in the Cortex XSIAM XQL Language Reference guide. This ensures that the same information is provided in both places.

ASM Automation Enhancement

Introducing new functionality within Cortex XSIAM to support endpoint-based mitigation playbooks on select Attack Surface Management (ASM) alert types. This enhancement empowers defenders by offering diverse options for addressing internet-exposed risks effectively.

QR Code Phishing investigation

Introducing a new playbook that provides enhanced investigation capabilities for phishing incidents with the latest playbook feature focused on QR code phishing. This functionality automatically analyzes embedded QR codes, enabling thorough scrutiny of malicious emails and enhancing your response strategy against this prevalent attack vector.

Prisma Cloud Compute

Introducing a new playbook designed specifically for compliance incidents within Prisma Cloud Compute. This feature enriches incident data with integration commands, empowering analysts with a comprehensive review. Explore advanced capabilities such as resource-specific data retrieval, email compliance reports, and seamless ticket creation across relevant systems.

Prisma Cloud Network, API, and Anomaly Incidents

Introducing a new playbook that handles incidents of internet-exposed services and detects potential risky configurations that can make your cloud environment vulnerable to attacks. It also focuses on incidents of unusual network and user activity for all users and is especially critical for privileged users and assumed roles. Detecting such activity early on may indicate the first steps in a potential misuse or account compromise.

Prisma Cloud Audit Incidents

Introducing a new playbook that handles policies that identify AWS S3 and IAM configuration updates such as creating, deleting, or modifying bucket policies, and modifying user groups that are invoked from the following penetration tools, Pentoo Linux, Kali Linux, Parrot Security.

Identity analytics

Introducing a new playbook that handles identity analytics alerts from Cortex XSIAM, covering enrichment, investigation, and response strategies. These alerts focus on identifying suspicious user behavior and activities, providing valuable insights for proactive security measures.