To streamline the investigation of your Cortex XDR data, a redesigned console now showcases the Cortex XDR capabilities in a clear and efficient way using a new responsive sidebar navigation.

The sidebar navigation allows you to easily find your way through the Cortex XDR investigation capabilities while providing greater real estate to display and assess your data.

To ensure a cohesive user experience, Cortex XDR Gateway has been renamed Cortex Gateway.

Cortex XDR now displays a notification 90 days prior to agent version end-of-life (EOL). Tenants with active agents of the version will receive a notification in the Notification Center indicating an upcoming EOL. The same notification will appear again 30 days before the due date if additional agents with this version remain.

In addition, in the

Endpoint Administration

table, endpoints with non-supported versions will be flagged with a red indicator.

To help you prepare for a scheduled release and become familiar with the upcoming features, Cortex XDR now displays a

New Release

banner a week before a scheduled release. Starting from Cortex XDR version 3.3, the

New Release

banner will be displayed in the user interface a week before the scheduled release date. This banner will indicate the date, scheduled release time frame, version number, and provide a link to the

Release Notes

, where you can get more information about the upcoming features.

To enable you to properly manage user groups permissions for a number of different system users in Cortex XDR, Cortex XDR now provides the following enhancements for managing user groups and group roles using role-based access control (RBAC).

Cortex XDR now allows you to define endpoints with Critical Environment Cortex XDR agent versions.

Critical Environment Versions are designed for sensitive and highly regulated environments and do not contain all updates and content existing in the standard version. Therefore, it is recommended to restrict the use of these versions to the required minimum.

Defining an endpoint with a Critical Environment agent version will require you to create and define the following:

To easily track the endpoints defined as Critical Environment, in the

Endpoint Administration

table, Cortex XDR displays a new

Version Type

field stating whether the endpoint is defined as a

Standard

or

Critical Environment

agent.

When enrolling in the Forensics Add-On, users with Account Admin and Instance Admin permissions can now change the tenant subdomain:

oldName.xdr.us.paloaltonetworks.com

to

newName.xdr.us.paloaltonetworks.com

To help you better visualize and manage your incidents, tasks, and MTTR, Cortex XDR introduces a new predefined dashboard called My Dashboard with the following new widgets.

To help you better visualize and manage your assets on the cloud, Cortex XDR introduces a new predefined dashboard called Cloud Inventory Dashboard with the following new widgets.

To help you better manage the Alerts associated with your incidents, Cortex XDR now allows you to perform the following actions on each alert:

In the

Alerts Table

, right-click an alert to now

Change Severity

and/or

Change Status

an alert.

Any update made to an alert impacts the associated incident. An incident with

all

its associated alerts marked as resolved is automatically set to

Auto-Resolved

. Cortex XDR will continue to group Alerts to an Auto-Resolved Incident for up to 6 hours. In the case where an alert is triggered during this duration, Cortex XDR will re-open the Incident.

To ensure consistency, when resolving an incident, you can now also select to

Mark all alerts as resolved

.

To help you track the alert resolution status, Cortex XDR now displays in the Alerts Table a new

Resolution Status

field.

To provide greater visibility of network assets and better align with other Cortex XDR offerings,

Assets

Asset Management

has been renamed to

Assets >

Asset Inventory. In addition, the new

All Assets

page, previously called

Assets

, now enables you to toggle between the

Legacy View

of the page and the new

Advanced View

, which includes the following features.

To improve the search and investigative functionality of the Quick Launcher, the Quick Launcher now supports searching in other tables related to

Asset Inventory

, previously called

Asset Management

, so you can query for a specific Asset Name or IP address. In addition, 2 new actions are now available when searching for Asset Inventory data.

To help you easily identify and resolve Correlation Rules errors, Cortex XDR now includes error handling by providing the following error messages in the applicable scenarios.

The Correlation Rules page indicates the error in the

LAST EXECUTION

column by displaying the last execution time in a red font and providing a description of the Correlation Rule Error when hovering over the field.

In addition, a notification is displayed to indicate these Correlation Rules errors.

To help you easily convert your existing Splunk queries to the Cortex XDR Query Language (XQL) syntax, Cortex XDR now includes in XQL Search a new toggle called Translate to XQL. When building your XQL query and this option is selected, both a

SPL query

field and

XQL query

field are displayed, so you can easily add a SPL query, which is converted to XQL in the

XQL query

field. This option is disabled by default, so only the XQL query field is displayed.

The Cortex XDR Query Language (XQL) now includes a new function called arrayindexof that enables you to return a value related to an array in one of the following ways.

Cortex XDR Query Language (XQL) now supports using Contains and Not Contains operators within arrays.

Cortex XDR Query Language (XQL) now supports using an optional by clause in a comp stage, which was previously required.

The Cortex XDR Query Language (XQL) is extended to support case_sensitive value queries in functions and stages, as opposed to this previously only being supported in filters. If you do not provide this stage in your query, the default behavior is true; case is considered when evaluating field values.

To expand the current data ingestion capabilities for existing data collectors, Cortex XDR now supports the following additional log formats for the data collectors listed.

Cortex XDR can now ingest the following logs and data from Microsoft Office 365 Management Activity API and Microsoft Graph API using a new data collector called Office 365.

To receive data, configure

Configurations

Data Collection

Collection Integrations

settings for the Microsoft

Office 365

data collector in Cortex XDR.

As soon as Cortex XDR begins receiving logs, the app automatically creates an applicable dataset matching the log type for the data collected. This enables you to search the logs using XQL Search.

Cortex XDR now supports using Elasticsearch Filebeat version 7.16 with the Windows DHCP Data Collector.

To expand your investigation capabilities, the following XDR Collector fields (where applicable) are available for any dataset and can be queried in XQL Search.

To enhance the data retention offerings, Cortex XDR now supports a new period based retention policy for the following retentions.

To support these changes, the following updates have been implemented in the user interface.

To improve the overall user experience and minimize user errors when creating Parsing Rules, Cortex XDR now includes a new Simulate view in the Parsing Rules editor. This view enables you to test your Parsing Rules on actual logs and validate their outputs. The editor includes the following sections.

To help you avoid sending unnecessary data to the XDR server and reduce traffic, storage, and computing costs, Cortex XDR now supports using Parsing Rules to define the specific data captured by the broker VM in a new section called [COLLECT]. The

[COLLECT]

section is optional to configure, but once added this section runs before the

[INGEST]

section to enable data reduction and data manipulation at the broker VM. The

[COLLECT]

section uses the same syntax as the

[INGEST]

section and is configured in the same screen. It also follows the format as detailed in the following example.

To enhance the current Parsing Rules offerings in Cortex XDR, Cortex XDR now supports configuring the following new function and stage command in the INGEST section.

To allow for greater flexibility when investigating your data, Cortex XDR now displays in the

Endpoint Administration

table the

Cloud Instance Metadata

field.

The field provides IBM and Alibaba Cloud data reported by the endpoint.

To help better manage your agent auto-upgrades, Cortex XDR now allows you to define a

Delayed Auto Upgrade Roll-out

.

In the Agent Settings, select whether to rollout an auto-upgrade immediately or define a delay period of 7-45 days from the agent release date.

To help better manage your agent upgrades, Cortex XDR now allows you in the

Action Center

to track in the

Status

field which agent upgrade failed and directly create an Upgrade action for one or more of the failed agents.

To help you easily route all traffic between the Cortex XDR management server and Cortex XDR agents using the broker VM, it is now possible to designate the broker VM as a proxy server for another broker VM (i.e. chaining). Previously, the broker VM could only act as a proxy server for agents. This is now available to configure when logging in to the broker VM (

https://<broker_vm_ip_address>/.

), and configuring the broker VM settings. In the Proxy Server section, when you set the

Type

to

HTTP

to route broker VM communication, you need to add the IP address and port number (set when activating the Agent Proxy) for the other broker VM registered in your tenant that you want to designate as a proxy for this broker VM.

To clarify the difference between the two options available for creating and downloading logs under

Broker Management

in Cortex XDR, the right-click option previously called

Download Latest Logs

was renamed to Generate New Logs. This option regenerates the most up-to-date logs and downloads them once they are ready, as opposed to the other option called

Download Logs (TIMESTAMP)

, which downloads the logs from the last creation date reflected in the TIMESTAMP.

The broker VM’s Files and Folders Collector applet now supports collecting logs from files and folders in a network share for a Windows directory in tail mode, as opposed to only batch mode. When you configure the

Files and Folders Collector

applet, a new toggle button called

Mode

is now displayed when configuring the

Files and Folders Settings

. There are 2 modes available.

To expand your API capabilities, Cortex XDR now allows you to filter the

Get Alerts

API results according to the timestamp of when Cortex XDR created the alert using

server_creation_time

.

To expand your alert investigation capabilities, Cortex XDR now displays in the

Get Alerts

and

Get Extra Incident Data

APIs response whether an PAN NGFW type alert contains a PCAP triggering packet.

Using the new

Retrieve PCAP Packet

API, you can now retrieve a list of alert IDs and the associated PCAP data.