April 2024 - Release Notes - Cortex XDR - Cortex - Security Operations

Enhanced Vulnerability Assessment

Cortex XDR introduces the Enhanced VA mode that uses advanced algorithms and comprehensive databases to deliver in-depth analysis and extensive details on CVEs. The Enhanced VA mode is available on Windows and MacOS endpoints running Cortex XDR agent versions 8.3 and later.

Root detection alerts on Android-based endpoints

Cortex XDR now includes root detection alerts to help you identify Android devices where malicious tools could be installed using root access privileges.

Analytics for Containerized Environments

Cortex XDR enhances its container security capabilities with the introduction of a detection analytics pack designed for managed and unmanaged Kubernetes environments. This enhancement strengthens cloud workload protection by enabling proactive identification and mitigation of malicious content inside containerized applications.

New configuration options for the iOS malware profile

The endpoint iOS malware profile now includes options to configure the use of the Safari browser security module to monitor the browser traffic, and to configure the network security module options to restrict and block network traffic for unsanctioned apps on supervised iOS devices. These enhancements provide proactive gating of suspicious sites, and granular control and monitoring of network traffic.

Additional network filtering alerts for iOS-based endpoints

Network Shield and Safari Safeguard are two new protection modules in iOS that can help track malicious app activity, unwanted access to malicious web sites and URLs and monitoring of unsanctioned web access. New event alerts for these modules include:

New dataset for auditing correlation executions

(Requires a Cortex XDR Pro license)

The new correlations_auditing dataset provides visibility into your correlation rules by logging each rule execution. The dataset records the query times, correlation start/end times, retry attempts, failure reasons, and other useful metrics.

Cloud Security Agent

(Requires Cortex XDR Cloud per Host license)

Unified (single) agent that reduces maintenance and resource overheads while providing runtime security and vulnerability management capabilities for cloud native environments.

Requirements:

Supports:

XDR Collectors 1.4.1

This release includes performance improvements and bug fixes.

Broker VM 23.0.33

This release includes performance improvements and bug fixes.

TTL for lookup datasets

(Requires a Cortex XDR Pro license)

Cortex XDR now enables configuring Time To Live (TTL) for lookup datasets, which specify when lookup entries expire and are removed automatically from the dataset. The default value is forever, meaning they never expire.

NGFW configuration log ingestion

NGFW configuration logs are now ingested, to enrich the firewall data ingested into Cortex XDR.

New Parsing Rules regexcapture function

(Requires a Cortex XDR Pro per GB license)

Cortex XDR now supports using a new Parsing Rules function called regexcapture to extract fields using regular expression named groups from a given string and return a JSON object with capturing groups.This function simplifies the Parsing Rules code for fields extraction.

Aligned XQL function descriptions and syntax

(Requires a Cortex XDR Pro license)

The XQL query function and syntax descriptions in Cortex XDR are now aligned with the descriptions found in the Cortex XDR XQL Language Reference guide. This ensures that the same information is provided in both places.