Protected: What’s New in Cortex

Enabling Autonomous Security Operations with New Data Management and Agentic-first Analyst Experience Capabilities Across the Cortex Platform (Jan ’26 Release) The latest Cortex portfolio release introduces exciting innovations to our AI-driven security operations platform that drastically simplify data management and accelerate detection and response times to enable autonomous security operations. Not only that, we’ve officially set a higher standard for investigation efficiency, data protection, and cross-platform defense with the new and improved XDR 5.0. Cortex XSIAM 3.4: Transforming the SOC with an Agentic-First Analyst Experience and Elevated Data Management Cortex XSIAM 3.4 moves security operations closer to autonomy. This pivotal release delivers a faster way to investigate and respond, enhances data management and embeds agentic AI across the platform. Redefining How Analysts Work in the SOC Our reimagined analyst experience represents a major step forward in security operations, embedding advanced AI directly into the analyst’s daily workflow. Designed to reduce investigation time, the experience brings together AI-generated summaries, visualized issue relationships, and a centralized Resolution Center in a unified case management workspace. [caption id="attachment_351749" align="aligncenter" width="2048"] Figure 1: The new Case Management Workspace provides full investigative context to streamline case analysis.[/caption] Agentic AI is now further embedded throughout the Cortex XSIAM console, allowing context-aware AI agents to work in real time alongside analysts. Using the Cortex Agentic Assistant, teams can call on context-aware AI agents to plan and execute investigation workflows directly within their cases. Agentic playbooks bring AI directly into automation workflows, embedding AI-driven tasks that adapt in real time and help teams resolve incidents faster. They automate complex operations, analyze inputs with generative AI, and produce context-specific outputs. AI-Ready Data, Anywhere You Need It Cortex XSIAM elevates security data management with a new cost-effective data retention option built for scale, flexibility, and efficiency. The newly introduced Cortex Data Lake tier delivers high-speed search and long-term storage for investigations, forensics, and compliance. Combined with federated search introduced in a prior release, these capabilities give SOC teams greater control over how data is stored and accessed. This release also introduces natural language querying, enabling analysts to hunt for threats using simple, plain-language prompts rather than traditional query syntax. By removing technical barriers, XSIAM accelerates investigations and enables analysts at every experience level to work more effectively on complex cases. [caption id="attachment_351762" align="aligncenter" width="2048"] Figure 2: Natural Language Querying allows analysts to hunt using natural language.[/caption] Cortex XDR 5.0: Strengthening Defenses Against Advanced Attacks The newest release of XDR introduces a reimagined user experience, natively embedded Cortex AgentiX for next-generation automation, Endpoint DLP, Exposure Management for XDR customers, as well as advanced protection capabilities for Linux and macOS. Next-Generation Automation and Immersive AI Cortex XDR 5.0 introduces AgentiX, a fleet of specialized AI agents for endpoint, email, and network security designed to plan, reason, and execute forensic analysis with human-like intuition. Whether you deploy these purpose built agents or use our no-code builder to create custom versions tailored to your environment, AgentiX allows analysts to offload manual toil. By automating complex triage and response, the platform accelerates incident resolution and empowers your team to focus on high level strategy rather than repetitive tasks. [caption id="attachment_351775" align="aligncenter" width="2048"] Figure 3 Embedded AgentiX for XDR.[/caption] This release also introduces a fully immersive AI experience that transforms the XDR console into an intelligent, collaborative workspace. Experience a completely reimagined case management workflow. The console leverages AI-driven summarization to translate complex alerts into clear, actionable narratives, while visualized issue relationships allow analysts to see the connections between disparate entities at a glance. With this new AI experience, it enables analysts to streamline workflows, use AI guidance throughout their investigations, and ultimately, accelerate time-to-resolution to shut down attacks faster. [caption id="attachment_351788" align="aligncenter" width="2048"] Figure 4: Updated Analyst Experience with Immersive AI.[/caption] Comprehensive Protection and Risk Management Beyond automation, XDR 5.0 expands the platform's reach with Endpoint Data Loss Prevention (DLP) and Exposure Management module, allowing teams to protect sensitive data and attack surfaces. Endpoint Data Loss Prevention (DLP) Traditional DLP solutions were built for a workforce that operated differently. Employees are increasingly relying on Generative AI for coding assistance and shifting critical communication to local desktop applications like WhatsApp and Slack channels that legacy DLP cannot see. Cortex XDR DLP eliminates these blind spots by monitoring the complete application layer and introducing intelligent Category-Based Blocking. Beyond expanding coverage, we have reimagined the user experience to ensure business continuity. Built on a privacy-first architecture, our DLP engine performs 100% on-endpoint inspection, ensuring sensitive data never leaves the device for analysis, which is a critical requirement for regulated industries. But protection shouldn’t come at the cost of productivity. That is why we have introduced automatic, user-empowered noise reduction controls. Rather than silently blocking users and generating frustrated helpdesk tickets, Cortex XDR DLP delivers real-time educational prompts that explain the policy violation and guide the user toward sanctioned alternatives. [caption id="attachment_351801" align="aligncenter" width="2048"] Figure 5: Cortex Endpoint DLP.[/caption] Unified Exposure Management and ASM Modules Modern security teams are drowning in data but starving for clarity; the challenge isn’t a lack of information, but knowing where to focus amidst siloed logs and a shifting perimeter. Cortex XDR 5.0 addresses this head-on, marking a significant shift from traditional "inside-out" vulnerability management to a comprehensive Exposure Management (EM) framework. By collapsing silos and integrating the Cortex Network Scanner and Attack Surface Management (ASM) directly into the console, we eliminate the visibility gaps created by fragmented legacy tools. The result is a single, unified pane of glass that replaces fragmented noise with a clear, actionable roadmap for defense. [caption id="attachment_351814" align="aligncenter" width="2048"] Figure 6: Exposure Management for Cortex XDR.[/caption] Enhanced Linux & mEnhanced Linux & macOS Protection The update also brings heavy-duty enhancements to Linux and macOS protection, introducing on-write scanning to block malicious binaries and behavioral analytics to stop credential harvesting. These tools work in tandem to identify stealthy "Command and Control" behaviors, ensuring robust, cross-platform defense against multi-vector threats across the entire enterprise environment. Cortex AgentiX 1.2: Unleashing The Future of XSOAR Introducing the newest innovations to the Cortex Agentix platform, the industry’s most secure solution for building, deploying and governing the AI agent workforce of the future. Cortex AgentiX transforms security automation into an intuitive, agentic AI powerhouse. By introducing a centralized agent prompt library, teams can now manage and share natural language prompts as reusable assets, while a reimagined user experience simplifies the creation of complex playbooks. The platform further accelerates development with a new Automation Engineer agent that translates natural language into scripts that can be easily converted into actions for agents or playbooks. Together, these enhancements allow SOC teams to create, deploy, and scale sophisticated automations faster than ever before. [caption id="attachment_351827" align="aligncenter" width="2048"] Figure 7: New Cortex AgentiX Platform.[/caption] Cortex Exposure Management: Sharpening Prioritization and Improving Asset Confidence Now available in both XSIAM and XDR, Exposure Management advances beyond traditional vulnerability management. By leveraging enhanced Security & Compensating Controls, analysts can automatically verify which defenses are active for any given asset. This allows teams to measure the true effectiveness of their controls and prioritize issues based on tangible risk instead of an overwhelming and unranked list of vulnerabilities. This helps teams reduce exposure faster with fewer resources. [caption id="attachment_351840" align="aligncenter" width="1187"] Figure 8: Exposure Management - Compensating Controls.[/caption] The addition of the new “Scan Now” feature further accelerates the remediation cycle by allowing analysts to verify fixes instantly. Instead of waiting for a scheduled sweep or configuring a new scan setup, teams can trigger an immediate rescan of vulnerable assets directly from the Issues or Findings dashboard. This automation confirms remediation in real time and automatically closes resolved findings, while API support ensures these validations can be executed at scale, even without direct UI access. Advanced Email Security: Neutralizing Threats for Absolute Clarity Our Advanced Email Security module now features a lightweight, real-time response engine that neutralizes threats before they reach the inbox. Coupled with our new Command Center, you can watch these automated defences unfold live and easily audit every action taken. That solves two major customer pain points: reaction time and visibility. First, this isn't just about detection; it’s about instant remediation. The real-time response engine uses automated policies to neutralize threats before they ever manifest in the user’s inbox. Second, we’re giving admins total clarity with the new Command Center. Customers no longer have to guess if they are protected; they can watch threats and our automated responses unfold live on an interactive dashboard. Plus, they can audit every single move in the Remediation Action Center. [caption id="attachment_351853" align="aligncenter" width="2048"] Figure 9: New Command Center for Advanced Email Security.[/caption] Cortex Xpanse 2.12: Enhance Validation and Precision in Attack Surface Management The latest updates to Cortex Xpanse 2.12 focus on providing deeper transparency and accuracy in how organizations manage their digital footprint. With improved asset attribution, analysts can now see the specific logic, driven by both machine learning and human analysis, behind why an asset is linked to their environment, making validation significantly faster. Furthermore, the introduction of more intrusive Attack Surface Tests (AST) allows teams to actively validate dangerous API misconfigurations in frameworks like Spring Boot, moving beyond simple discovery to proactive security testing. Streamlined Workflows and Data Accuracy Operational efficiency sees a major boost through smarter data processing and integration. New Cloud Observation Logic drastically reduces false positives by syncing asset retention directly with cloud providers, ensuring that decommissioned assets are immediately dropped from the dashboard. Additionally, the inclusion of CPE Information in the Services API enables security teams to automate vulnerability workflows by directly correlating services with specific CVEs and version tracking. These enhancements ensure that SOC teams are working with the most accurate, real-time data while accelerating their response to potential threats. These are just the highlights from a feature-packed month. For a detailed breakdown of the latest features and enhancements across the Cortex portfolio, please refer to the full release notes. To learn more about these and other innovations across the Cortex portfolio, visit https://www.paloaltonetworks.com/cortex.

Protected: What’s New in Cortex

Related Blogs

Get the latest news, invites to events, and threat alerts

Get the latest news, invites to events, and threat alerts

Products and Services

Company

Popular Links

Protected: What’s New in Cortex

Related Blogs

Must-Read Articles, Product Features

What’s New in Cortex

Must-Read Articles, Product Features

How Cortex Defends Against Microsoft SharePoint "ToolShell" Exploits

Must-Read Articles, News and Events, Product Features

What’s Next in Cortex: New Innovations for Security Operations

Must-Read Articles

Defending against Phantom Taurus with Cortex

Announcement, Must-Read Articles, News and Events

What’s New in Cortex: The Latest Innovations for the World’s #1 SecOps Platform (Feb ’25 Release)

Must-Read Articles, News and Events, Playbook of the Week

What’s New for Cortex and Cortex Cloud (Apr ‘25)

Subscribe to Security Operations Blogs!

Get the latest news, invites to events, and threat alerts

Get the latest news, invites to events, and threat alerts

Products and Services

Company

Popular Links