October 2023 - Release Notes - Cortex XSIAM - Cortex - Security Operations

To help align the incident management process with your organization's security practices, you can now create custom incident statuses and custom resolution types.

Cortex XSIAM now includes in-product documentation that helps you find information about new and existing features, reference material, and common workflows. While you're working with Cortex products (XSIAM), the documentation will launch relative to your current location from within the product.

Stay tuned for the Help Chat (which will gradually be rolled out) as part of the In-App Help Center. With the AI driven chat-based help, you will be able to ask questions about features and tasks and immediately receive a response.

New and improved widgets help you measure the operational efficiency of incident and alert handling, and identify issues in the incident response process. The widgets identify peaks in incident and alert creation, provide visibility into the incident lifecycle, and help balance workloads by identifying the incidents assigned to each analyst:

To better secure your machines against ransomware attacks, a new solution based on native operating system backup mechanisms (Time Machine from MacOS and Shadow Copy from Windows) allows customers to turn on automatic machine backups from Cortex XDR.

For SSO configuration of Cortex XSIAM, you now have the option to enter a metadata URL, rather than manually providing the IdP SSO URL, issuer ID and x.509 certificate.

Cortex XSIAM introduces a new feature that identifies risky prevention policies based on Palo Alto Networks best-practice policy settings. Admins can review and update flagged policies to enhance global security posture.

Cortex XSIAM now supports using Filebeat and Winlogbeat version 8.8.1 when using XDR collectors on Windows and Linux machines.

This release includes performance improvements and bug fixes.

Cortex XSIAM now supports a new function called convert_to_base_64, which converts the base64-decoded input to the encoded string format. See more in convert_to_base_64.

To provide faster query results, instead of querying the entire xdr_data dataset, Cortex XSIAM added the following three datasets:

The fields contained in any of these datasets are a subset of the fields in the xdr_data dataset.

You can now edit queries that were built with simple search templates in XQL. With this flexibility, you can enrich the basic queries created by templates for more detailed investigation, or use the templates as a starting point for creating complex queries with full XQL functionality.

Cloud Data Exfiltration

This playbook responds to and investigates alerts from XSIAM analytics about data exfiltration activity in a cloud environment. It enriches all relevant data and performs investigation actions, such as IP address prevalence checks, bucket enumeration, and persistence mechanism by the attacker IP. Based on the enrichment and investigation results, the playbook performs remediation actions. This playbook is included in the Cloud Incident Response pack.

Cloud Key Rotation

An important aspect of every cloud playbook is handling compromised credentials. This playbook is one of the main building blocks for cloud investigation and response playbooks. It quickly and efficiently responds to rotate compromised credentials based on their type, performing actions, such as resetting passwords and changing credential profiles. This playbook is included in the Cloud Incident Response pack.

Identity Threat Detection and Remediation (ITDR)

New ITDR enhancements enable organizations to more effectively detect and manage risky users and hosts. Cortex XSIAM playbooks can now identify identity threats and empower analysts to make informed decisions based on calculated risk for assets in their network.