Palo Alto Networks

No entries match these filters. Clear filters

1. changelog Oct 21, 2026 · issue 120

   Palo Alto Networks launches Unit 42 Managed Agentic Endpoint Security (Managed AES) and extends AI Runtime Security to NVIDIA BlueField DPUsDPUsData Processing Units are purpose-built network processors that offload packet parsing, encryption, and telemetry from the host CPU, letting cyber tools run inspection pipelines at wire speed without taxing application cores..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces Unit 42 Managed Agentic Endpoint Security (Managed AES), a 24/7 managed service built on Cortex AES that adds Unit 42 threat hunting, investigation, response, and AI governance expertise to the existing Cortex AES platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Makes AI Runtime Security on NVIDIA BlueField DPUs generally available, isolating security processing in dedicated infrastructure silicon to enforce policies independently of a potentially compromised host across AI factory and industrial edge deployments.
   • Adds a Managed AES with Standalone Cortex AES deployment option, allowing organisations to run Cortex AES alongside an existing endpoint security solution to gain AI-native visibility and governance without replacing incumbent tooling.
   • Introduces AI Security Posture Reports and Threat Impact Reports as deliverables within Managed AES, providing periodic policy/control improvement recommendations and threat response summaries.
   • Advances an integration between agentic identity governance and NVIDIA Sentry on BlueField DPUs — moving identity and delegated authority controls to silicon, separate from the host OS — to provide zero-trust protection and tamper-resistant auditing for agents (availability pending).

   5 details in Everything

2. docs update Oct 8, 2026 · issue 097
   • New integration Infoblox Outbound API integration
3. docs update Oct 5, 2026 · issue 095

   Palo Alto Networks IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Security gains a new Infoblox Outbound API integration for device security data sharing.

   • New integration Infoblox Outbound API integration
4. docs update Oct 4, 2026 · issue 094
   • New integration Infoblox Outbound API integration for Device Security
5. changelog Sep 22, 2026 · issue 082

   Palo Alto Networks launches Unit 42 Continuous Frontier AI Defense, an always-on agentic offensive security service powered by Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces Unit 42 Continuous Frontier AI Defense, a new always-on agentic offensive security service that continuously finds, validates, and remediates enterprise exposures using proprietary multi-model AI harnesses with Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Continuous Testing Engine that performs a full-estate baseline scan followed by always-on testing as an organization's environment changes, covering web apps, APIs, cloud infrastructure, source code repositories, and network assets.
   • Introduces a proprietary Multi-Model AI Harness that routes offensive security tasks to the model best suited for each job, addressing the finding that no single model catches more than 40% of vulnerabilities and that leading models share less than 10% overlap in identified exposures.
   • Delivers Advanced Adversary Simulation that proves real-world exploitability by validating end-to-end attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. across first- and third-party web apps, APIs, cloud infrastructure, source code repositories, and network assets.

   4 details in Everything

6. changelog Sep 22, 2026 · issue 013

   Palo Alto Networks launches Unit 42 Continuous Frontier AI Defense, an always-on agentic offensive security service powered by Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces Unit 42 Continuous Frontier AI Defense, a new always-on agentic offensive security service that continuously finds, validates, and remediates enterprise exposures using proprietary multi-model AI harnesses with Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Continuous Testing Engine that performs a full-estate baseline scan followed by always-on testing as an organization's environment changes, covering web apps, APIs, cloud infrastructure, source code repositories, and network assets.
   • Introduces a proprietary Multi-Model AI Harness that routes offensive security tasks to the model best suited for each job, addressing the finding that no single model catches more than 40% of vulnerabilities and that leading models share less than 10% overlap in identified exposures.
   • Delivers Advanced Adversary Simulation that proves real-world exploitability by validating end-to-end attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. across first- and third-party web apps, APIs, cloud infrastructure, source code repositories, and network assets.

   4 details in Everything

7. Cortex Cloud Runtime Security: September 6, 2026 Sep 6, 2026 · release notes

   Cortex Cloud Runtime Security 2.2 introduces support for the Gemini 3.5 Flash model in specific geographic regions to enhance runtime AI capabilities.

8. Cortex Cloud Posture Management: September 2026 Sep 2026 · release notes

   Cortex Cloud Posture Management adds over 100 new API ingestions for Alibaba Cloud, AWS, Azure, GCP, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. asset discovery.

   • Adds alibaba-cloud-api-gateway ingestion with RIT names for API Gateway assets to discover API definitions, groups, and traffic controls in Alibaba Cloud
   • Adds alibaba-cloud-apsaradb-for-mongodb ingestion with RIT names for MongoDB instances to discover DB attributes, security IPs, audit policies, and backup policies
   • Adds alibaba-cloud-bastionhost-instance ingestion to discover Bastion Host instances and their attributes/tags
   • Adds alibaba-cloud-cbn-transit-router-attachment ingestion with RIT names for Transit Router attachments to discover VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., VBR, peer, and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. connections along with route table details in Alibaba Cloud
   • Adds aws-sagemaker-model-card ingestion with RIT names for SageMaker Model Cards to discover model cards and their tags in AWS

   +3 more show less

   • Adds aws-datazone-environment ingestion with RIT names for Datazone environments to discover environments and blueprint configurations in AWS
   • Adds aws-ec2-verified-access-endpoint ingestion with RIT names for Verified Access endpoints, instances, and trust providers to discover AWS Verified Access infrastructure
   • Adds aws-s3-bucket-replication ingestion to discover S3 bucket replication configurations in AWS

   8 details in Everything

9. Cortex XSIAM: September 2026 Sep 2026 · release notes

   Cortex XSIAM September 2026 adds over 140 new API ingestions across Alibaba Cloud, AWS, Azure, GCP, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. asset types.

   • Adds support for ingesting Alibaba Cloud API Gateway configuration via ALIBABA_CLOUD_API_GATEWAY asset type
   • Adds support for ingesting Alibaba Cloud ApsaraDB for MongoDB instances and security settings via ALIBABA_CLOUD_APSARADB_FOR_MONGODB asset type
   • Adds support for ingesting Alibaba Cloud CBN Transit Router attachments and route tables via ALIBABA_CLOUD_CBN_TRANSIT_ROUTER_ATTACHMENT asset type
   • Adds support for ingesting Alibaba Cloud EIAM Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. Policies via ALIBABA_CLOUD_EIAM_CONDITIONAL_ACCESS_POLICY asset type
   • Adds support for ingesting Alibaba Cloud Bastion Host instances and tags via ALIBABA_CLOUD_BASTION_HOST_INSTANCE asset type

   +12 more show less

   • Adds support for ingesting Alibaba Cloud Data Transmission Jobs, DNS domains/records, HBR Vaults, and PrivateLinkPrivateLinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. endpoints via ALIBABA_CLOUD_DATA_TRANSMISSION_JOB, ALIBABA_CLOUD_DNS_DOMAIN, ALIBABA_CLOUD_DNS_RECORD, ALIBABA_CLOUD_HBR_VAULT, and ALIBABA_CLOUD_PRIVATELINK_VPC_ENDPOINT asset types
   • Adds support for ingesting AWS SageMaker model cards, experiments, and model packages via AMAZON_SAGEMAKER_MODEL_CARD, AWS_SAGEMAKER_EXPERIMENT, and AWS_SAGEMAKER_MODEL_PACKAGE asset types
   • Adds support for ingesting AWS Datazone environments and data sources via AWS_DATAZONE_ENVIRONMENT and AWS_DATAZONE_DATA_SOURCE asset types
   • Adds support for ingesting AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Verified Access endpoints, instances, and trust providers via AWS_EC2_VERIFIED_ACCESS_ENDPOINT, AWS_EC2_VERIFIED_ACCESS_INSTANCE, and AWS_EC2_VERIFIED_ACCESS_TRUST_PROVIDER asset types
   • Adds support for ingesting AWS S3 bucket replication configurations via AWS_S3_BUCKET_REPLICATION asset type
   • Adds support for ingesting AWS Storage Gateway information and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. settings via AWS_STORAGE_GATEWAY asset type
   • Adds support for ingesting Azure Data Factory V2 private endpoint connections and storage blob containers via AZURE_DATA_FACTORY_V2_PRIVATE_ENDPOINT_CONNECTION and AZURE_STORAGE_BLOB_CONTAINER asset types
   • Adds support for ingesting Azure DocumentDB MongoDB clusters and key vault certificates/keys via AZURE_DOCUMENT_DB_MONGO_CLUSTERS, AZURE_KEY_VAULT_CERTIFICATE, and AZURE_KEY_VAULT_KEY asset types
   • Adds support for ingesting Azure Management Locks, Monitor Private Link scopes, and subscription tenant policies via AZURE_MANAGEMENT_LOCKS, AZURE_MONITOR_PRIVATE_LINK_SCOPE, and AZURE_SUBSCRIPTION_POLICY asset types
   • Adds support for ingesting GCP Cloud Spanner instance backups, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. service account keys, logging folder sinks, and organization folders via GCLOUD_CLOUD_SPANNER_INSTANCE_BACKUP, GCLOUD_IAM_SERVICE_ACCOUNT_KEY, GCLOUD_LOGGING_FOLDER_SINK, and GCLOUD_ORGANIZATION_FOLDER asset types
   • Adds support for ingesting GCP Vertex AI Garden models, Dataproc Metastore services/federations, and SCC Event Threat Detection custom modules via GCLOUD_VERTEX_AI_GARDEN_MODEL, DATAPROC_METASTORE_SERVICE, DATAPROC_METASTORE_FEDERATION, and GOOGLE_SCC_EVENT_THREAT_DETECTION_CUSTOM_MODULE asset types
   • Adds support for ingesting OCI compartments via OCI_COMPARTMENT asset type

   17 details in Everything

10. Cortex Cloud Runtime Security: September 2026 Sep 2026 · release notes

    Cortex Cloud Runtime Security adds API ingestions for Alibaba Cloud, AWS, Azure, GCP and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. assets in September 2026

    • Adds new RIT names alibaba-cloud-api-gateway, alibaba-cloud-apsaradb-for-mongodb, alibaba-cloud-apsaramq-for-kafka, alibaba-cloud-bastionhost-instance, alibaba-cloud-cbn-transit-router-attachment, alibaba-cloud-data-transmission-job, alibaba-cloud-dns-domain, alibaba-cloud-dns-record, alibaba-cloud-eiam-conditional-access-policy, alibaba-cloud-hbr-vault, and alibaba-cloud-privatelink-vpc-endpoint to ingest Alibaba Cloud asset configurations via API calls such as DescribeApis, DescribeDBInstances, and ListInstance.
    • Adds new RIT names aws-sagemaker-model-card, aws-apigateway-client-certificate, aws-datazone-environment, aws-datazone-environment-blueprint-configuration, aws-ec2-verified-access-endpoint, aws-ec2-verified-access-instance, aws-ec2-verified-access-trust-provider, aws-s3-bucket-replication, aws-sagemaker-experiment, aws-sagemaker-model-package, and aws-storage-gateway-information to ingest AWS asset configurations via API calls such as ListModelCards, GET, ListEnvironments, DescribeVerifiedAccessEndpoints, GetReplicationConfiguration, and ListGateways.
    • Adds new RIT names azure-data-factory-v2-private-endpoint-connection, azure-documentdb-mongo-clusters, azure-monitor-private-link-scope, and azure-saas-resource to ingest Azure asset configurations via API calls such as read and Read.
    • Adds new RIT names gcloud-dataproc-metastore-service, gcloud-dataproc-metastore-federation, gcloud-ai-applications-cmek-config, and gcloud-security-command-center-organization-event-threat-detection-custom-module to ingest GCP asset configurations via API calls such as getIamPolicy, list, and get.

    4 details in Everything

11. Prisma Access 6.2 Preferred Innovation: Additional Prisma Access Locations Available for Existing Deployments by Default Sep 2026 · release notes

    Prisma Access 6.2 enables self-service onboarding to nine additional regional locations.

    • Adds Brazil Southeast, Colombia Central, France South East, India South Central, Israel Central, Mexico Northeast, Saudi Arabia West, UK West, US Midwest, and US West Central as self-serviceable Prisma Access locations for existing deployments
    • Removes the requirement to contact an account representative or engage SRE to activate these new regional locations in Prisma Access

    2 details in Everything

12. Prisma Access 6.2 Preferred Innovation: Morocco Compute Location and Estonia Location Sep 2026 · release notes

    Prisma Access 6.2 adds Morocco as a compute location and Estonia as a mapped location.

    • Adds Casablanca, Morocco as a new compute location for Prisma Access with its own processing city.
    • Adds Estonia as a new Prisma Access location that maps to the Europe North compute location (Finland).

    2 details in Everything

13. Cortex XDR Content Updates: 2390 Aug 18, 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Content Update 2390 adds kernel module support for multiple Linux distributions and updates detection rules across Windows, Mac, and Linux.

    • Adds Kernel modules compatibility support for Red Hat Enterprise Linux 10.2 (x86_64, aarch64), Alma Linux 10.2 (x86_64), Rocky Linux 10.2 (x86_64), Ubuntu 26.04 LTS (x86_64, aarch64), Alma Linux 9.8 (x86_64), Oracle Linux 9.8 (x86_64, aarch64), and Rocky Linux 9.8 (x86_64, aarch64).

    1 detail in Everything

14. Cortex Analytics: 2026.08.05 Aug 16, 2026 · release notes

    Cortex Analytics adds detection for uncommon AppleScript activity and enhances rare host communication alerts.

    • Adds 10 new detectors including 'Uncommon AppleScript containing a potential defense-evasion command was executed via the command line' to identify evasion techniques.
    • Adds 13 new variations such as AppleScript disabling Gatekeeper, manipulating hosts files, or accessing crypto wallet data for deeper behavioral coverage.
    • Updates logic for Potential Phishing has been detected, 'Rare WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS. Session by an RMM actor', and 'AWS S3 bucket was exposed to public access' to improve signal quality.

    3 details in Everything

15. changelog Aug 13, 2026 · issue 044

    Unit 42 Frontier AI Exposure Analysis gains GPT-5.6 Daybreak for automated attack-path discovery and exploitability validation.

    • Expands Unit 42 Frontier AI Exposure Analysis to deploy GPT-5.6 Daybreak — previously unavailable for commercial use — directly in customer environments to find exposures, test exploitability, validate attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and prioritize remediation.
    • Adds Action Center to Device Security, enabling automated response actions against IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure./OT devices.
    • Adds integration between Device Security and IGEL UMS for unified endpoint and device security management.

    3 details in Everything

16. Palo Alto Networks release updates 2026-08-10 Aug 10, 2026 · release notes

    Cortex XSOAR 8.14 GA introduces dedicated workspaces for custom content and expanded audit logging for notifications and content management.

    • Adds dedicated workspaces in the UI to separate custom work from content pack items
    • Expands audit logs to capture notification forwarding and content management activities

    2 details in Everything

17. Cortex Analytics: 2026.07.22 Aug 3, 2026 · release notes

    Adds 12 new detectors and 10 variations to Cortex Analytics content

    • Adds "Uncommon AppleScript containing a potential persistence command was executed via the command line" (Low) detector with High severity variations for .plist modification and launchctl load targeting
    • Adds Suspicious Network Connection Originating from AWS SSM Agent (Medium) detector
    • Adds "Unusual process executed by AWS Systems Manager" (Medium) detector
    • Adds "An Azure VM snapshot SAS URL was generated" (Informational) detector with Low severity variations for unusual identity characteristics
    • Adds "Slack Connect direct message invite was accepted" (Informational) detector with Low severity variations for abnormal and suspicious external user invites

    +7 more show less

    • Adds AWS Bedrock AI infrastructure enumeration activity (Informational) detector with Informational variation for identities with no prior AI activity
    • Adds Azure Monitor alert rule deleted (Informational) detector with Informational variations for compute workload and unusual deletion events
    • Adds Azure VM extension abuse attempt (Informational) detector with Informational variation for unusual abuse
    • Adds Azure route table creation or modification (Informational) detector with Informational variation for unusual creation/modification
    • Adds First-time attachment exchange (Informational) detector
    • Adds Initial person-to-person email contact (Informational) detector
    • Adds "Uncommon Azure Cosmos DB master key read by identity" (Informational) detector

    12 details in Everything

18. Prisma Cloud Compute Edition: 34.05 (Build 34.05.157) Aug 2, 2026 · release notes

    Prisma Cloud Compute 34.05 adds Rocky Linux 10/RKE2 v1.35 support, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. compartment scoping, and custom CVE exclusion feeds.

    • Adds excludedCve custom feed entries to suppress specific CVEs per OS distribution for vulnerability results.
    • Adds compartment ID support for the Agentless scanner on Oracle Cloud Infrastructure (OCI).
    • Adds expanded fallback instance types (beyond m5.2xlarge, etc.) for the Agentless AWS scanner to cover more regions.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Defenders below release v31 are neither supported nor functional and will disconnect from the Console.
19. Prisma Access 6.2 Preferred Innovation: IoT Device-ID Based Policies for Mobile Users Aug 2026 · release notes

    Prisma Access 6.2 adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Device-ID based security policies for mobile users.

    • Creates Device-ID based Security policies specific to mobile users
    • Extends existing Device-ID based Security policies to include mobile users

    2 details in Everything

20. Prisma Access 6.2 Preferred Innovation: SASE Resilience and Business Continuity Aug 2026 · release notes

    Prisma Access 6.2 adds multi-region resilience for Cloud Identity Engine and Enterprise DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., plus a new HA view in Strata.

    • Cloud Identity Engine gains enhanced failover capabilities between cloud regions in the United States
    • Enterprise DLP (DLP) gains enhanced failover capabilities between cloud regions in the United States
    • SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. Private Location supports in-country multicloud and on-premises hosting options for Prisma Access mobile users to route to own infrastructure when primary CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. fails
    • High-Availability and Resilience view added in Strata Cloud Manager to monitor multi-region and multi-cloud deployment status for Mobile User deployments

    4 details in Everything

21. Cortex XSIAM: August 2026 Aug 2026 · release notes

    August 2026 adds new Cortex Cloud API ingestions for Alibaba, AWS, Azure and GCP asset discovery.

    • Adds alibaba-cloud-ack-cluster ingestion to discover Alibaba Cloud ACK clusters via the cs:GetClusters permission and DescribeClustersV1 action.

    1 detail in Everything

22. Cortex Cloud Posture Management: August 2026 Aug 2026 · release notes

    Cortex Cloud adds API ingestions for Alibaba Cloud ACK/EIAM, AWS AppStream/Cognito/DMS/Neptune/Route53/ServiceQuotas, Azure AD/Apps/Monitor/MySQL/Power BI/Role Eligibility, G

    • Adds alibaba-cloud-ack-cluster asset type for Alibaba Cloud ACK cluster discovery via the cs:GetClusters permission and DescribeClustersV1 action.
    • Adds alibaba-cloud-eiam-instance and alibaba-cloud-eiam-user asset types for Alibaba Cloud EIAM instance and user data ingestion.
    • Adds aws-app-stream-app-block-builder asset type for AWS AppStream App Block Builder discovery.
    • Adds aws-cognito-identity-provider asset type for AWS Cognito Identity Provider discovery.
    • Adds aws-dms-data-provider, aws-dms-instance-profile, aws-dms-replication-config, and aws-dms-replication-subnet-group asset types for AWS Database Migration Service discovery.

    +20 more show less

    • Adds aws-neptune-analytics-graph asset type for AWS Neptune Analytics Graph discovery.
    • Adds aws-route53-domains-operation and aws-route53-profile asset types for AWS Route 53 domains and profiles discovery.
    • Adds aws-servicequotas-service-quota asset type for AWS Service Quotas discovery.
    • Adds azure-active-directory-authentication-flows-policy, azure-entra-password-policy asset types for Azure AD authentication flow and password policy ingestion.
    • Adds azure-app-container-apps-job, azure-app-container-apps-revision-replicas, and azure-app-container-apps-revisions asset types for Azure Container Apps discovery.
    • Adds azure-azurestack-registrations asset type for Azure Stack Hub registration discovery.
    • Adds azure-monitor-private-link-scope asset type for Azure Monitor Private LinkPrivate LinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. Scope discovery.
    • Adds azure-mysql-flexible-server-configurations asset type for Azure MySQL Flexible Server configuration discovery.
    • Adds azure-powerbi-dedicated-capacities-diagnostic-settings asset type for Azure Power BI Dedicated capacity diagnostics ingestion.
    • Adds azure-role-eligibility-schedule asset type for Azure Role Eligibility Schedule discovery.
    • Adds gcloud-gke-backup-backup-plan asset type for GCP Kubernetes Engine Backup Plan discovery.
    • Adds gcloud-secretsmanager-regional-secret asset type for Google Cloud Regional Secrets Manager discovery.
    • Updates aws-cognito-user-pool asset type to include additional user pool data ingestion capabilities.
    • Updates aws-route53-list-hosted-zones asset type to include DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. and resource record set data ingestion.
    • Updates aws-route53resolver-resolver-endpoint asset type to include resolver endpoint discovery.
    • Updates azure-active-directory-conditional-access-policy asset type for conditional access policy ingestion.
    • Updates azure-active-directory-user asset type for Azure AD user profile ingestion.
    • Updates azure-app-service-web-apps-functions asset type for Azure App Service web app function ingestion.
    • Updates gcloud-compute-instances-ssh-key asset type for GCP Compute Engine SSH key pair ingestion.
    • Adds oci-iam-user asset type for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. user domain and user list discovery.

    25 details in Everything

23. Prisma Access 6.2 Preferred Innovation: Additional Locations for App Acceleration and App Security Aug 2026 · release notes

    Prisma Access 6.2 Preferred Innovation extends App Acceleration and App Security to ten new global locations

    • Adds App Acceleration and App Security support in Bahrain, Canada West, Europe North (Stockholm), Ireland, Middle-East Central (UAE), New Zealand, South Africa West, Sweden, and UK West.

    1 detail in Everything

24. Cortex Cloud Runtime Security: August 2026 Aug 2026 · release notes

    Cortex Cloud Runtime Security adds API ingestions for Alibaba Cloud, AWS, Azure, and GCP assets in August 2026

    • Adds alibaba-cloud-ack-cluster asset type ingestion to support discovering Alibaba Cloud ACK clusters via the cs:DescribeClustersV1 API
    • Adds alibaba-cloud-eiam-instance and alibaba-cloud-eiam-user asset types to ingest EIAM identity configuration and user details
    • Adds aws-app-stream-app-block-builder asset type ingestion to discover AppStream 2.0 block builders
    • Adds aws-cognito-identity-provider asset type ingestion to ingest AWS Cognito identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configurations
    • Adds multiple aws-dms-* asset types (aws-dms-data-provider, aws-dms-instance-profile, aws-dms-replication-config, aws-dms-replication-subnet-group) to discover DMS data providers, instance profiles, replication configs, and subnet groups

    +11 more show less

    • Adds aws-neptune-analytics-graph asset type ingestion to discover Neptune Analytics graphs
    • Adds aws-route53-domains-operation and aws-route53-profile asset types to ingest Route 53 Domain operations and Profile configurations
    • Adds aws-servicequotas-service-quota asset type ingestion to discover service quotas for VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. and other services
    • Adds azure-active-directory-authentication-flows-policy, azure-entra-password-policy, and azure-role-eligibility-schedule Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. asset types
    • Adds azure-app-container-apps-* asset types (azure-app-container-apps-job, azure-app-container-apps-revision-replicas, azure-app-container-apps-revisions) for Container Apps jobs and revisions
    • Adds azure-azurestack-registrations asset type to discover Azure Stack Hub registrations
    • Adds azure-monitor-private-link-scope asset type ingestion to ingest Private LinkPrivate LinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. Scope resources
    • Adds azure-mysql-flexible-server-configurations asset type to ingest MySQL Flexible Server configurations
    • Adds azure-powerbi-dedicated-capacities-diagnostic-settings asset type to discover Power BI Dedicated capacity diagnostic settings
    • Adds gcloud-gke-backup-backup-plan and gcloud-secretsmanager-regional-secret asset types for GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Backup plans and Regional Secrets Manager secrets
    • Updates aws-cognito-user-pool, aws-route53-list-hosted-zones, and other existing asset types to ingest additional fields and API actions

    16 details in Everything

25. Prisma Access 6.2 Preferred Innovation: Web Application Isolation for Secure Agentless Access Aug 2026 · release notes

    Prisma Access 6.2 adds mandatory Remote Browser Isolation for public web apps and optional isolation for private web apps via URL Access Management.

    • Adds Remote Browser Isolation as a mandatory feature for Public Web Applications in Secure Agentless Access, automatically enforced when the app type is selected.
    • Enables configurable Remote Browser Isolation for Private Web Applications by marking custom URL categories for isolation in a URL Access Management profile.
    • Leverages Let's Encrypt to manage the certificate lifecycle for the Secure Agentless Access domain, eliminating manual DNS and certificate import tasks.

    3 details in Everything

26. Prisma Access 6.2 Preferred Innovation: Native IPv6 Support for Service Connections and Remote Networks in Panorama and Strata Cloud Manager Aug 2026 · release notes

    Prisma Access 6.2 adds native IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for service connections and remote networks in Panorama and Strata Cloud Manager.

    • Adds native IPv6 support for Prisma Access service connections to extend WAN connectivity with end-to-end IPv6 communication between on-premises networks and Prisma Access.
    • Expands native IPv6 capabilities for Prisma Access remote networks in underlay and overlay architectures, enabling public-facing IPs in native IPv6 environments.

    2 details in Everything

27. Prisma Cloud: Features Introduced in August 2026 Aug 2026 · release notes

    Prisma Cloud adds Rocky Linux 10 support, agentless OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. compartment scoping, generic distro CVE exclusions, and 25 new AWS/GCP API ingestions.

    • Adds MONGO_DB_CUSTOM_CONFIG_PATH environment variable to configure MongoDB internal limits for Vulnerability/Compliance Explorer daily refresh at scale
    • Enables agentless Oracle Cloud Infrastructure scans scoped to a specific compartment ID via the new compartmentId parameter
    • Extends generic distro-based CVE exclusion so administrators can upload custom excludedCve entries per target distribution (Windows, Ubuntu, Red Hat, Alpine) in the portal
    • Adds Amazon Bedrock support for prompts (aws-bedrock-prompt), flows (aws-bedrock-flow), flow aliases (aws-bedrock-flow-alias), and guardrails (aws-bedrock-guardrail)
    • Adds Amazon Bedrock AgentCore support for browser sessions (aws-bedrock-agentcore-browser-session) and code interpreter sessions (aws-bedrock-agentcore-code-interpreter-session)

    +21 more show less

    • Adds Amazon AppFlow connector support via the aws-appflow-connector API ingestion
    • Adds Amazon CloudFront VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. origin support via the aws-cloudfront-vpc-origin API ingestion
    • Adds Amazon Connect contact flow and security profile application support via aws-connect-contact-flow and aws-connect-security-profile-application APIs
    • Adds Amazon Q Connect assistant support via the aws-qconnect-assistant API ingestion
    • Adds AWS Database Migration Service data migration support via the aws-dms-data-migration API ingestion
    • Adds Amazon EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Image Builder lifecycle policy support via the aws-imagebuilder-lifecycle-policy API ingestion
    • Adds AWS Lambda function recursion configuration support via the aws-lambda-get-function-recursion-config API ingestion
    • Adds Amazon Route53 Resolver DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. config support via the aws-route53resolver-dnssec-config API ingestion
    • Adds SageMaker MLflow tracking server support via the aws-sagemaker-mlflow-tracking-server API ingestion
    • Adds AWS Systems Manager command invocation support via the aws-ssm-command-invocation API ingestion
    • Adds AWS Systems Manager OpsItem related item support via the aws-ssm-ops-item-related-item API ingestion
    • Adds AWS Systems Manager Ops metadata support via the aws-ssm-ops-metadata API ingestion
    • Adds AWS Systems Manager Quick Setup configuration support via the aws-ssm-quicksetup-configuration API ingestion
    • Adds Amazon Textract adapter support via the aws-textract-adapter API ingestion
    • Adds Google BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. model support via the gcloud-bigquery-model API ingestion
    • Adds Google Cloud Conversational Insights conversation analysis support via the gcloud-conversational-insights-conversation-analysis API ingestion
    • Adds Google Cloud Customer Engagement Suite app and conversation support via gcloud-ces-app and gcloud-ces-app-conversation APIs
    • Expands Amazon S3 bucket ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. ingestion to include the bucketKeyEnabled attribute via aws-s3api-get-bucket-acl
    • Adds AWS CodeConnections connection and host support via aws-codeconnections-connection and aws-codeconnections-host API ingests
    • Supports Rocky Linux 10.x (Red Quartz) for vulnerability/compliance scanning and runtime protection in Prisma Cloud Enterprise Edition 26.8.1
    • Improves Rocky Linux CVE matching by linking binary packages to source packages and honoring RPM epoch values

    26 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The aws-elbv2-describe-load-balancers RQL in the 'ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. is not using the latest predefined security policy' check now accepts ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09, which may re-open existing resolved alerts
28. PAN-OS 12.2: PA-520-5G Next-Generation Firewall Aug 2026 · release notes

    PAN-OS 12.2 adds embedded 5G modem to PA-520 chassis with dual SIM failover and ZTP over cellular.

    • Adds embedded Sierra EM9293 Sub-6 GHz 5G cellular modem to PA-520 chassis for built-in primary or backup internet connectivity
    • Introduces dual nano SIM slots operating in active/standby mode to enable carrier failover on the cellular interface
    • Extends Zero Touch Provisioning (ZTP) support to work over cellular interfaces simultaneously with Ethernet before wired WAN is established

    3 details in Everything

29. docs update Jul 24, 2026 · issue 024

    AI Runtime Security adds tool chaining attack detection in agent scans, Azure SLR support, and updated vCPU capacity.

    • Adds Tool Chaining Attack detection capability within Agent Scans for AI runtime security.
    • Adds Security Lifecycle Review (SLR) support for Azure environments.
    • Updates vCPU support limits for AI Runtime Security deployments.

    3 details in Everything

30. docs update Jul 24, 2026 · docs issue 004

    AI Runtime Security adds tool chaining attack detection in agent scans, Azure SLR support, and updated vCPU capacity.

    • Adds Tool Chaining Attack detection capability within Agent Scans for AI runtime security.
    • Adds Security Lifecycle Review (SLR) support for Azure environments.
    • Updates vCPU support limits for AI Runtime Security deployments.

    3 details in Everything

31. Cortex XSIAM: July 20, 2026 Jul 20, 2026 · release notes

    This release updates XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Collectors with new Filebeat and Winlogbeat versions and improves reliability by reducing the default upload interval from 60s to 3s.

    • XDR Collectors now support version 9.3.2 of Filebeat and Winlogbeat for 64-bit deployments.
    • Default log upload interval reduced from 60 seconds to 3 seconds to ensure frequent data delivery in high-volume environments.

    2 details in Everything

32. Cortex XDR 3.x: July 20, 2026 Jul 20, 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.19 updates collectors with new Filebeat/Winlogbeat support and fixes upload interval.

    • Cortex XDR/XSIAM/Cloud now supports version 9.3.2 Filebeat and Winlogbeat for 64-bit XDR Collectors
    • The default log upload interval has been reduced from 60 seconds to 3 seconds

    2 details in Everything

33. Cortex Analytics: 2026.07.08 Jul 19, 2026 · release notes

    Cortex Analytics adds Kubernetes secrets enumeration detection and updates S3 lifecycle and AWS audit log monitoring detectors

    • Adds Kubernetes secrets enumeration detector for low-risk activity across all namespaces
    • Adds AWS S3 bucket data retention policy change through S3 Lifecycle rule detector (Informational)
    • Adds Disable AWS audit logs through Event Selectors detector (Informational)

    3 details in Everything

34. changelog Jul 16, 2026 · issue 017

    Prisma AIRS AI Gateway reaches GA with inline LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code./MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface./A2AA2AAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools. enforcement, agent identity binding, and quantum-resilient SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. fabric via AT&T partnership.

    ⤢
    • Introduces Prisma AIRS AI Gateway as a unified control plane sitting inline between AI apps, LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., MCP tool calls, and A2A interactions for centralized governance.
    • Adds unified observability across all AI usage: tracking users, projects, models, token counts, latency, and cost in a single view to expose shadow AI.
    • Enables central governance of approved models, tools, and access with FinOps controls including per-team/project budget enforcement and rate limiting before access is granted.
    • Adds Coding Assistant Security that replaces raw provider API keys with scoped, per-user/team credentials to protect secrets and proprietary code.
    • Introduces Agent Identity Security that binds verifiable, ephemeral identities to agents at execution time, enforcing just-in-time least-privilege access.

    +7 more show less

    • Delivers Runtime Security with inline prompt and response inspection aligned to OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces. and OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Applications, blocking prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
    • Supports Universal API for traffic distribution across LLM providers with quota enforcement and failover.
    • Adds Post-Quantum CryptographyPost-Quantum CryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA.) to Prisma SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. via hybrid key exchanges based on IETF RFC 9370, 9242, and 8784, wrapping data in classical and quantum-resistantquantum-resistantCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. protection simultaneously.
    • Transitions all Prisma SASE control plane traffic to TLS 1.3 for quantum-resilient management plane protection.
    • Encrypts all network telemetry and metadata in transit via TLS 1.3 with region-geofenced storage and no cross-region aggregation.
    • Embeds crypto-agility natively so PQC algorithms can be updated via automated cloud updates without hardware replacement.
    • Adds Secure Boot support on Prisma SD-WAN ION hardware with TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake.-backed hardware root-of-trust, cryptographically signed boot chain, and PQC-secured management/control/data plane tunnels.

    12 details in Everything

35. Cortex Analytics: 2026.07.01 Jul 12, 2026 · release notes

    Cortex Analytics 2026.07.01 adds detections for Kubernetes role creation, AWS Lambda cross-account access, and modified logic for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./Okta phishing patterns.

    • [Low] A Kubernetes cluster role was created for the first time by the identity
    • [Low] AWS Lambda Cross-Account sensitive permissions configured
    • [Medium] Potential Phishing has been detected
    • [Medium] Okta FastPass reported phishing attack suspected from a suspicious IP
    • [Medium] Abnormal SSO authentication by a honey user - Modified Logic

    +1 more show less

    • [Low] SSO authentication by a service account via a suspicious IP - Added

    6 details in Everything

36. PAN-OS 12.2: Dedicated Tunnels for Panorama Connectivity Jul 2026 · release notes

    PAN-OS 12.2 adds Dedicated Tunnels to Panorama for redundant management connectivity via DIA interfaces.

    • Adds Dedicated Tunnel to Panorama feature allowing branch devices to establish persistent IPSec tunnels to Panorama through designated termination devices using Direct Internet Access (DIA) interfaces
    • Allows configuration of primary and secondary termination devices with preferred and secondary DIA interfaces for redundant connectivity paths to Panorama
    • Introduces a separate VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. address pool for tunnel IP address assignments that must not overlap with existing SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. overlay configurations

    3 details in Everything

37. Cortex Cloud Posture Management: July 2026 Jul 2026 · release notes

    Cortex Cloud adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks for Alibaba Cloud, EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., Debian 13, and Ubuntu 24.04; updates Windows Server scanning.

    • Adds support for the CIS Alibaba Cloud Foundation Benchmark (Level 1 and Level 2) v2.0.0 to the Standards Catalog.
    • Adds support for the CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.8.0 to the Standards Catalog.
    • Adds support for the CIS Debian Linux 13 Server and Workstation Benchmarks (Level 1 and Level 2) v1.0.0 to the Standards Catalog.
    • Adds support for the CIS Ubuntu Linux 24.04 LTS Server and Workstation Benchmarks (Level 1 and Level 2) v1.0.0 to the Standards Catalog.
    • Adds support for NIST SP 800-190 to the Standards Catalog.

    +5 more show less

    • Updates CIS Microsoft Windows Server 2019 Benchmark to include network scanning rules for automated discovery of OS-level configuration drifts.
    • Updates CIS Microsoft Windows Server 2016 Benchmark to include network scanning rules for automated discovery of OS-level configuration drifts.
    • Maps SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.-specific security configuration rules to existing benchmarks including CIS Critical Security Controls v8, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria..
    • Maps AI-focused cloud security posture managementcloud security posture managementCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. rules to EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001:2023, and NIST AI 600-1.
    • Maps AI-focused Application Security rules to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Applications 2025 and OWASP Top 10 for Agentic Applications 2026.

    10 details in Everything

38. Cortex XDR 5.x: July 2026 Jul 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. July 2026 adds AES for AI surface visibility, XTI threat intel, Prisma Browser integration, and numerous API/UI/agent enhancements.

    • Adds the AES (AI Attack Surface) capability inside the unified Cortex XDR agent to provide deep visibility into AI components, plugins, and binaries on endpoints
    • Introduces Extended Threat Intel (XTI), a comprehensive threat intelligence offering that embeds adversary insights directly into SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflows through enriched case investigations and AI-driven behavioral analysis
    • Natively integrates Prisma Browser telemetry, unifying endpoint and browser data in a single platform for cross-environment investigation queries
    • Enables Resource-efficient Linux protection agent with smart, built-in resource safeguards to automatically adjust CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and memory usage during heavy workload spikes
    • Expands DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support to archives and large file scanning up to 300 MB

    +6 more show less

    • Adds day-one support for Android 17 and safer iOS deployments alongside full set of Linux forensic artifacts collection for unified visibility
    • Implements Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. Policies (CAP) allowing automatic step-up authentication with Okta and Microsoft Entra MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. or access restriction based on identity behavior, requiring the ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on
    • Extends Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Security Posture Management (AD-SPM) to identify misconfigurations, track risk drift, and harden on-premises Domain Controllers, requiring the ITDR add-on
    • Updates End-to-end experience & User Card to consolidate a user’s full profile, continuous risk score, and activity timeline into a single intuitive view, requiring the ITDR add-on
    • Dedicated Idira IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. threat detection with 17 new out-of-the-box detectors monitoring your Idris identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. environment for credential manipulation and identity provider compromise, requiring the ITDR add-on
    • Introduces granular RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. structure with dedicated roles (Viewer, Administrator) for precise permissions in identity security and Conditional Access Policies, requiring the ITDR add-on

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Non-admin users with Access Management permissions can no longer grant effective Instance Administrator role, modify access for these entities, or delete associated API keys.
    • !The field name Cloud Provider Account ID in the Endpoint table is renamed to Account ID.
    • !Cortex Query Language (XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform.) queries strictly enforce domain-based access controls for Cases and Issues.
39. PAN-OS 12.2: Cellular SNMP MIB Monitoring for 5G-Integrated Firewalls Jul 2026 · release notes

    PAN-OS 12.2 adds PAN-CELLULAR-MIB SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. monitoring for 5G modem health, signal quality, and SIM status on 5G-integrated firewalls.

    • Exposes six new SNMP data tables in PAN-CELLULAR-MIB for cellular metrics: modem hardware state (IMEI, firmware version, temperature), signal quality (RSRP, RSRQ, RSSI, SINR), SIM card status, APN/DNN profiles, per-interface network state/counters, and subinterface details.
    • Adds support for PAN-CELLULAR-MIB in SNMP managers via files like PAN-CELLULAR-MIB.my to access cellular metrics across 5G-integrated firewalls.
    • Introduces two new SNMP traps for proactive alerting: one when signal quality drops below the FAIR threshold and another on packet-switched connectivity loss, with hold-down timers of 10 minutes and 90 seconds respectively.

    3 details in Everything

40. Cortex XSIAM: July 2026 Jul 2026 · release notes

    July 2026 release adds asset ingested for Alibaba Cloud, AWS Bedrock Agent Core, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Backup and Managed Kafka to Cortex XSIAM.

    • Adds ingestion of alibaba-cloud-ecs-image and alibaba-cloud-ecs-snapshot assets from Alibaba Cloud ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. services
    • Adds ingestion of alibaba-cloud-kms-instance and alibaba-cloud-kms-key assets from Alibaba Cloud KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. services
    • Adds ingestion of alibaba-cloud-product-quota assets from Alibaba Cloud Quotas service
    • Adds ingestion of aws-athena-prepared-statement assets from AWS Athena service
    • Adds ingestion of five new AWS Bedrock Agent Core assets (agent-runtime, agent-runtime-endpoint, gateway, memory, and policy)

    +21 more show less

    • Adds ingestion of aws-ecr-repository-creation-template assets from AWS ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. service
    • Adds ingestion of aws-ecs-task assets from AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. service
    • Adds ingestion of aws-eks-access-entry assets from AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. service
    • Adds ingestion of two AWS OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Serverless access and security policy assets
    • Adds ingestion of aws-glue-table assets from AWS Glue service
    • Adds ingestion of aws-opensearch-vpc-endpoint assets from AWS OpenSearch service
    • Adds ingestion of two AWS QBusiness assets (application and index)
    • Adds ingestion of two AWS S3 Vector assets (vector-bucket and vector-index)
    • Adds ingestion of three Amazon SageMaker assets (app-image-config, image-version, and monitoring-schedule)
    • Adds ingestion of aws-ssm-timeline-events-list assets from AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. Incidents service
    • Adds ingestion of azure-automation-account-private-endpoint-connections assets from Azure Automation
    • Adds ingestion of azure-compute-ssh-public-keys assets from Azure Compute
    • Adds ingestion of azure-data-shares-account-diagnostic-setting assets from Azure Data Share
    • Adds ingestion of azure-dns-privatedns-zones-virtual-network-link assets from Azure Private DNS Zones
    • Adds ingestion of azure-monitor-scheduled-query-rule assets from Azure Monitor
    • Adds ingestion of two Google Cloud CES App assets (app and conversation)
    • Adds ingestion of gcloud-conversational-insights-conversation-analysis assets from GCP Conversational Insights
    • Adds ingestion of gcloud-gke-backup-backup-channel and gcloud-gke-backup-restore-channel assets from GKE Backup
    • Adds ingestion of two Google Cloud Managed Kafka assets (acl and connect-cluster)
    • Adds ingestion of two Google Cloud Network Connectivity Center assets (hub-group and policy-based-route)
    • Adds ingestion of gcloud-vertex-ai-aiplatform-reasoning-engine assets from GCP Vertex AI

    26 details in Everything

41. PAN-OS 12.2: Automatic Certificate Renewal for Passive HA Devices Jul 2026 · release notes

    PAN-OS 12.2 enables automatic device certificate renewal on passive High Availability units.

    └──▷ TRY IT
    Verify that the passive unit has successfully renewed its certificate after a failover or renewal event.
    copy

    $ show device-certificate status

42. PAN-OS 12.2: HTTP Request and Response Header Logging Jul 2026 · release notes

    PAN-OS 12.2 adds HTTP Request and Response Header Logging to URL filtering profiles

    • Adds Enable logging of response code in HTTP response setting to force a response log entry even when response headers are not logged.
    • Adds Max Header Length config field (1–4,092 bytes) to limit captured header value size.
    • Adds Enable truncation of headers that exceed the max header length limit option to capture partial headers instead of skipping them.

    3 details in Everything

43. Cortex Cloud Runtime Security: July 2026 Jul 2026 · release notes

    Cortex Cloud Runtime Security July 2026 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks for Alibaba, Debian, Ubuntu; updates Windows SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally./AI/GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. rules

    • Adds CIS Alibaba Cloud Foundation Benchmark - Level 1 and Level 2 (v2.0.0) to the Standards Catalog
    • Adds CIS Amazon Elastic Kubernetes Service (EKS) Benchmark (v1.8.0) to the Standards Catalog
    • Adds CIS Amazon Web Services Foundations Benchmark - Level 1 and Level 2 (v7.0.0) to the Standards Catalog
    • Adds CIS Debian Linux 13 benchmarks for Server/Workstation Levels 1/2 (v1.0.0) to the Standards Catalog
    • Adds CIS Microsoft Azure Foundations Benchmark - Level 1 and Level 2 (v6.0.0) to the Standards Catalog

    +10 more show less

    • Adds CIS Red Hat Openshift Container Platform Benchmark - Level 1 and Level 2 (v1.9.0) to the Standards Catalog
    • Adds CIS Ubuntu Linux 24.04 LTS benchmarks for Server/Workstation Levels 1/2 (v1.0.0) to the Standards Catalog
    • Adds NIST SP 800-190 compliance standard to the Standards Catalog
    • Updates CIS Microsoft Windows Server 2019 Benchmark with new network scanning rules for hardened configurations
    • Updates CIS Microsoft Windows Server 2016 Benchmark with new network scanning rules for hardened configurations
    • Maps SaaS-specific security configuration rules to existing standards including CIS Critical Security Controls v8, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., NIST Cybersecurity Framework (CSF) v1.1, NIST SP 800-53 Rev. 5, PCI DSS v4.0.1, and SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria.
    • Maps AI-focused cloud security posture managementcloud security posture managementCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. rules to EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., ISO/IEC 42001:2023, NIST AI 600-1, OWASP Top 10 for LLM Applications 2025, and OWASP Top 10 for Agentic Applications 2026
    • Maps AI-focused Application Security rules to EU AI Act, ISO/IEC 42001:2023, NIST AI 600-1, OWASP Top 10 for LLM Applications 2025, and OWASP Top 10 for Agentic Applications 2026
    • Expands workload security ruleset with direct mappings to NIST SP 800-53 Rev. 5 framework
    • Maps workload security ruleset to General Data Protection Regulation (GDPR) requirements

    15 details in Everything

44. PAN-OS 12.2: SD-WAN Bandwidth-Based Path Selection Jul 2026 · release notes

    PAN-OS 12.2 adds bandwidth thresholds and sensitivity to SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. Path Quality profiles for path selection

    • Adds configurable bandwidth threshold and sensitivity settings to SD-WAN Path Quality profiles to qualify paths based on link capacity during session setup.
    • Enables real-time bandwidth usage evaluation across all dataplanes as a path quality metric alongside jitter, latency, and packet loss.

    2 details in Everything

45. PAN-OS 12.2: Prevent Traffic Disruptions from Persistent Discard Sessions Jul 2026 · release notes

    PAN-OS 12.2 adds no-refresh-on-discard session setting to stop UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. discard loops via CLI.

    └──▷ USE IT
    Prevent legitimate DNS or DHCP traffic from being silently dropped due to persistent discard sessions on a PAN-OS firewall.
    shell copy

    set session no-refresh-on-discard yes

    • Adds the operational setting no-refresh-on-discard (CLI: set session no-refresh-on-discard yes) to prevent stale DISCARD sessions from refreshing, fixing silent drops of legitimate UDP traffic.
    • Enables natural expiration of discarded UDP sessions by stopping incoming packets from resetting their timeout counter.

    2 details in Everything

46. PAN-OS 12.2: Secure Your OT Environment with Intra-VLAN Microsegmentation Jul 2026 · release notes

    PAN-OS 12.2 adds OT Intra-VLAN Microsegmentation using Proxy ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. and DHCP Relay Overwrite to inspect Layer 2 traffic.

    • Adds OT Intra-VLAN Microsegmentation capability to redirect intra-VLAN traffic through the firewall for inspection
    • Adds support for Proxy ARP on Layer 3 VLAN aggregate interfaces to force local traffic to the firewall
    • Adds support for DHCP Relay Overwrite to assign each client a /32 host mask and ensure the firewall remains the gateway

    3 details in Everything

47. Cortex Xpanse Expander: Release 2.14 (July 2026) Jul 2026 · release notes

    Cortex Xpanse Expander 2.14 adds on-demand ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. rescans, bulk business unit mapping, and AI-informed detections.

    • Adds on-demand attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rescan triggered directly from an AST alert to validate remediation without waiting for scheduled scans
    • Introduces bulk business unit assignment for IP addresses and domains to organize asset ownership
    • Deploys frontier AI-informed detection coverage based on Mythos attack research to identify exploitable external weaknesses

    3 details in Everything

48. Cortex XSOAR 8 SaaS: July 2026 Jul 2026 · release notes

    Cortex XSOAR 8.15 SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. adds Azure Blob Storage incident export and auto-auth for Strata Logging

    • Adds Azure External Storage Support to allow exporting incident data (including war room entries and attachments) directly to Azure Blob Storage.
    • Enables Continuous Strata logging authentication which automatically manages secure background authentication for the Strata Logging Service across commercial and FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. environments.
    • Updates the AWS Cloud Security content pack to Unified AWS Cloud Security, consolidating support for CloudWatch Logs, Systems Manager, and Network Firewall into a single pack.

    3 details in Everything

49. PAN-OS 12.2: IPv6 DNS Proxy Jul 2026 · release notes

    PAN-OS 12.2 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. DNS Proxy support with mixed-version forwarding and failover

    • DNS Proxy now supports mixed IPv4/IPv6 forwarding across all transport protocols (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring., DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows., UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.)
    • Cross-version server failover allows the firewall to fail over between primary and secondary DNS servers of different IP versions
    • Cross-version encrypted-to-cleartext fallback enables falling back to cleartext DNS on a different IP version when encrypted attempts fail
    • DNS-over-TCP connection timeout reduced from 2 minutes to 4 seconds, with data transfer timeout set to 30 seconds

    4 details in Everything

50. PAN-OS 12.2: Cloud Credential Phishing Prevention Jul 2026 · release notes

    PAN-OS 12.2 now supports multiple credential bloom filters per virtual system for multi-domain cloud phishing prevention.

51. PAN-OS 12.2: Enterprise DLP Inspection of WebSocket Traffic Jul 2026 · release notes

    PAN-OS 12.2 introduces WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. traffic inspection for Enterprise DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., covering Microsoft Copilot and Perplexity, enabling real-time detection in continuous bidirectional streams beyond traditional HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. cycles.

    • Enables Enterprise DLP to inspect persistent bidirectional streams in Microsoft Copilot and Perplexity via WebSocket connections
    • Expands non-file traffic inspection beyond discrete HTTP/HTTPS request-response cycles to cover continuous data flows

    2 details in Everything

52. PAN-OS 12.2: Configuration Improvements for Subscriber-ID and Equipment-ID Jul 2026 · release notes

    PAN-OS 12.2 adds Subscriber and Equipment objects for mobile network identities in security policy.

    • Adds Subscriber and Equipment address objects to reference mobile identities (IMSIIMSIA unique 15-digit number that globally identifies a subscriber on a cellular network, stored on the SIM card. Cyber tools target or capture it to track devices or correlate identities across mobile networks./IMEI) in security policies.
    • Adds Subscriber Groups and Equipment Groups to aggregate subscribers or devices for policy matching.
    • Expands IMSI range support to digits 4-15 and allows variable-length prefixes starting from the 4th digit.
    • Expands IMEI range support to 6-16 digits and allows variable-length prefixes starting from the 6th digit.
    • Requires enabling GTP Security via Device > Setup > Management > General Settings to make these objects available.

    5 details in Everything

53. PAN-OS 12.2: TLSv1.3 Support for Authentication Portal Jul 2026 · release notes

    PAN-OS 12.2 adds TLSv1.3 and PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. support for the Authentication Portal

    • Authentication Portal now supports TLSv1.3 to secure redirected web traffic with modern security standards.
    • Allows applying SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS service profiles that support TLSv1.3 or PQC-TLSv1.3 to the Authentication Portal configuration.

    2 details in Everything

54. PAN-OS 12.2: Multiple APN and DNN Support for 5G-Integrated Firewalls Jul 2026 · release notes

    PAN-OS 12.2 adds support for multiple concurrent APN and DNN sessions on 5G-integrated firewalls

    • Adds the ability to configure up to eight concurrent APN sessions (4G) or four concurrent DNN sessions (5G) on a single cellular interface.
    • New central management under Network > Network Profiles > Cellular > APN/DNN Profile for provisioning multiple APNsAPNsApple Push Notification service, Apple's cloud messaging infrastructure that delivers push notifications to iOS, macOS, and watchOS devices; cyber tools use it to alert users or exfiltrate data over a trusted Apple channel. or DNNs.
    • Allows each additional APN or DNN to be provisioned as a distinct cellular subinterface with its own IP context, routing domain, and security policy.

    3 details in Everything

55. Prisma Access 6.2 Preferred Innovation: ZTNA Connector Private Application Tagging Jul 2026 · release notes

    Prisma Access 6.2 adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector application tagging to automate dynamic address group updates.

    • Supports application tagging for ZTNA Connector, letting you assign tags to FQDN targets, IP subnet targets, and wildcard targets to automate security policy enforcement through dynamic address groups.

    1 detail in Everything

56. PAN-OS 12.2: PAN-OS Shield Support for Vulnerability Protection Jul 2026 · release notes

    PAN-OS 12.2 adds PAN-OS Shield for automatic vulnerability protection on GlobalProtect gateways and portals.

    • Introduces PAN-OS Shield, a built-in feature that uses Advanced Threat Prevention to provide inline protections against critical vulnerabilities targeting the firewall.
    • Delivers vulnerability protection signatures via a dedicated PAN-OS Shield module integrated into the standard Applications and Threats Content Package for automatic updates without NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. restarts.

    2 details in Everything

57. PAN-OS 12.2: Enhanced Content Cloud Analysis Transport Support Jul 2026 · release notes

    PAN-OS 12.2 adds Advanced Forwarding discovery service to enable direct TLS transport for MICA services.

    • Introduces Advanced Forwarding discovery service that dynamically assigns advanced service addresses based on NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. location and configuration.
    • Allows the NGFW to establish TLS connections directly from the data plane to cloud analysis services when Advanced Forwarding is enabled.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The NGFW does not automatically fall back to the legacy transport method; users must manually disable Advanced Forwarding to use the legacy transport instead.
58. PAN-OS 12.1: Per-Policy NAT DIPP Address Pool Scale Increase Jul 2026 · release notes

    PAN-OS 12.1.8 raises per-policy NAT DIPP pool limit to 32,768 addresses and system-wide capacity to match on PA-7500.

    • DIPP per-policy translated IP address limit increases from 256 to 32,768 on the PA-7500 Series.

    1 detail in Everything

59. PAN-OS 12.2: Advanced Threat Prevention Local Deep Learning Support for Command Injection Jul 2026 · release notes

    PAN-OS 12.2 adds Local Deep Learning for command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. with per-profile enable/disable and local PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.

    • Enables automatic content updates that deliver the latest command injection models to supported NGFWs without manual intervention
    • Adds a local packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. option for retaining forensic evidence when detections are made during cloud unavailability

    2 details in Everything

60. Cortex XDR 3.x: July 2026 Jul 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.19 adds Broker VM programmatic API management, TLS 1.3 enforcement, independent applet upgrades, new Extended Analytics detections, and Strata Device Security co

    • Adds Public API endpoints to programmatically manage Broker VMs (retrieve details/health, manage applets, register/remove/reboot/upgrade/download logs)
    • Adds independent deployment of Broker VM applets without full VM upgrade
    • Enforces TLS 1.3 communication between Broker VM and server
    • Adds Windows Authentication support to the MSSQL Database collector applet (KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent., SQL internal auth)
    • Adds LOLBIN Execution Analytics detection suite

    +9 more show less

    • Adds NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Unmanaged Subnet Analytics detection
    • Adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Linux Sensitive Information Theft Analytics detection
    • Adds SSM Remote Management Analytics detection for AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. activity
    • Adds Cloud Log Tampering Analytics detection for AWS, Azure, and GCP log modifications
    • Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. (Oracle Cloud Infrastructure) Analytics detection
    • Adds Extended EDR macOS AppleScript Analytics detection
    • Introduces Device Security data collector for Strata Device Security alerts (requires new Strata Cloud Manager auth method; replaces legacy IoT Security collector)
    • Enables parsing rule stages to resume data flow when datasets exceed the 2,000-field limit
    • Adds Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. Policy for ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. to control access based on identity/device/risk context

    14 details in Everything

61. PAN-OS 12.2: Layer 2 Switching on Next-Generation Firewalls Jul 2026 · release notes

    PAN-OS 12.2 adds Layer 2 switching capabilities (VLANs, MSTP, LAG, Storm Control) to NGFWs.

    • Adds layer-2 mode to enable the firewall to operate as a fully functional Layer 2 switch with per-port access and trunk VLAN configuration
    • Adds support for Multiple Spanning Tree Protocol (MSTP) within the new Layer 2 switching interface for robust loop avoidance
    • Adds Link Aggregation Group (LAG) support on the new Layer 2 interfaces to combine multiple physical ports
    • Adds Storm Control capability on Layer 2 interfaces to mitigate excess broadcast, unknown unicast, and multicast traffic

    4 details in Everything

62. PAN-OS 12.2: Basic Authentication for Explicit Web Proxy Jul 2026 · release notes

    PAN-OS 12.2 adds Basic Authentication support for Explicit Web Proxy with configurable realm and IP Surrogate Minutes cache

    • Adds basic authentication method to Explicit Web Proxy to validate users against Local Database, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure., TACACS+, or KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Pre-Authentication without SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider./Kerberos SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. infrastructure
    • Adds configurable authentication realm string (default: Explicit Proxy) for browser credential prompts
    • Adds IP Surrogate Minutes setting (max 600 minutes) to cache authenticated user IP and bypass subsequent auth challenges

    3 details in Everything

63. Cortex Analytics: 2026.05.28 Jun 15, 2026 · release notes

    Cortex Analytics 2026.05.28 adds 29 new detectors focusing on AI security, cloud storage mass deletion, and OAuth token theft.

    • Adds Suspicious AI model usage from a Tor exit node detector for high-severity AI infrastructure abuse
    • Adds ML artifacts destruction and Unusual ML artifacts destruction detectors for model integrity monitoring
    • Adds Potential denial of wallet abusing AI services and Possible denial of wallet abusing AI services variations for crypto/AI threats
    • Adds Suspicious AI Dataset Download and Suspicious First-Time AI Dataset Download by Identity detectors
    • Adds Suspicious ML Model Download and Suspicious First-Time AI Model Download by Identity detectors

    +14 more show less

    • Adds Unusual AI Knowledge Base Modification and Suspicious AI Knowledge Base Modification detectors
    • Adds AI model discovery detector for reconnaissance activity
    • Adds AI safeguards deletion attempt and AI safeguards were successfully deleted detectors
    • Adds AWS Bedrock model invocation logging deletion and related variations
    • Adds Abnormal increase in network-related alerts on the same host detector
    • Adds Bedrock model shared with a foreign account detector for data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. risk
    • Adds Cloud AI agent was modified and Unusual modification of AI agent detectors
    • Adds massive file deletion detectors for Box, Dropbox, Google Drive, and Microsoft SharePoint/OneDrive
    • Adds Modification of the AD FS IdentityServer configuration file detector
    • Adds Multiple network-related alerts of different MITRE tactics on the same host detector
    • Adds Possible ConsentFix - OAuth Token Theft Detected and OAuth Token Theft - Potential Session Hijacking Detected from new ASN detectors
    • Adds Suspicious AI Dataset Label Modification, Unusual AI RAG Knowledge Base Modification, and Unusual AI dataset modification detectors
    • Adds An RDS snapshot containing sensitive data was exported detector for cloud database exposure
    • Adds Unusual AI model invocation, Unusual AWS Bedrock model access request, and Unusual AWS SageMaker notebook access detectors

    19 details in Everything

64. Prisma Access 6.2 Preferred Innovation: Serviceability Commands Support for Remote Networks—High Performance Jun 2026 · release notes

    Prisma Access 6.2 Preferred Innovation adds Serviceability Commands for Remote Networks—High Performance

    • Supports serviceability commands against Remote Networks—High Performance termination nodes from Strata Cloud Manager
    • Routing Information command now available for viewing routing tables, including BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes., static, and OSPF routes, on High Performance connections
    • Service IP Address command retrieves FQDN or IP address of the High Performance service endpoint for CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. configuration
    • Clear Security Associations command allows forcing IPSec tunnel renegotiation by clearing IKE/IPSec security associations

    4 details in Everything

65. Cortex Cloud Posture Management: June 2026 Jun 2026 · release notes

    Adds CRI Profile v2.1, K-ISMS for Finance, NZISM v3.9, NIST SP 800-172 standards; updates AI and KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. rules.

    • Adds Cyber Risk Institute (CRI) Profile v2.1 to the Standards Catalog
    • Adds Korea – Information Security Management System (ISMS) For Finance to the Standards Catalog
    • Adds 'New Zealand Information Security Manual (NZISM) v3.9' to the Standards Catalog
    • Adds NIST SP 800-172 to the Standards Catalog
    • Updates EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001:2023, NIST AI 600-1, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Applications 2025, and OWASP Top 10 for Agentic Applications 2026 with new AI-focused rules

    +1 more show less

    • Adds KSPM-specific security configuration rules to CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Amazon EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Benchmark v1.4, CIS Azure AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Benchmark v1.5, and other existing benchmarks

    6 details in Everything

66. Prisma Access 6.2 Preferred Innovation: Multiple Colo-Connects per Region Jun 2026 · release notes

    Prisma Access 6.2 allows up to eight Colo-Connects per region for redundancy

    • Supports deploying up to eight Colo-Connects per region
    • Adds support for GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. and non-GRE tunnel solutions with multiple Colo-Connects

    2 details in Everything

67. Prisma Access 6.2 Preferred Innovation: BGP Filtering and Route Metric Support on Service Connections in Prisma Access Strata Cloud Manager Jun 2026 · release notes

    Prisma Access 6.2 introduces BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. filtering and route metric configuration for service connections in Strata Cloud Manager.

    • Adds support for creating custom BGP policies on regular and Colo-Connect service connections to control routing behavior
    • Enables setting route metrics on service connections via the Strata Cloud Manager UI to influence traffic flow

    2 details in Everything

68. Prisma Cloud: Features Introduced in June 2026 Jun 2026 · release notes

    Prisma Cloud adds detection for 15 new cloud services and fixes false negatives in Azure Cosmos DB and AWS API Gateway policies

    • Adds aws-bedrock-agentcore-agent-runtime-endpoint integration to detect Amazon Bedrock AgentCore agent runtime endpoints
    • Adds aws-bedrock-agentcore-memory integration to detect Amazon Bedrock AgentCore memory resources
    • Adds aws-bedrock-agentcore-policy integration to detect Amazon Bedrock AgentCore policy engines
    • Adds aws-bedrock-agentcore-gateway integration to detect Amazon Bedrock AgentCore gateways
    • Adds aws-bedrock-agentcore-agent-runtime integration to detect Amazon Bedrock AgentCore agent runtimes

    +10 more show less

    • Adds aws-athena-prepared-statement integration to detect Amazon Athena prepared statements
    • Adds aws-ecr-repository-creation-template integration to detect Amazon ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. repository creation templates
    • Adds aws-opensearch-vpc-endpoint integration to detect Amazon Elasticsearch Service VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoints
    • Adds gcloud-network-connectivity-policy-based-route integration to detect Google Cloud Network Connectivity Center policy-based routes
    • Adds gcloud-gke-backup-backup-channel integration to detect Google Backup For GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. backup channels
    • Adds gcloud-gke-backup-restore-channel integration to detect Google Backup For GKE restore channels
    • Adds gcloud-managed-kafka-clusters-acl integration to detect Google Managed Kafka Clusters ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.
    • Adds gcloud-gcp-managed-kafka-connect-cluster integration to detect Google Managed Kafka Connect Clusters
    • Adds gcloud-vertex-ai-aiplatform-reasoning-engine integration to detect Google Vertex AI AIPlatform reasoning engines
    • Updates the 'AWS API gateway request authorisation is not set' policy logic to exclude OPTIONS HTTP methods from authorization checks

    15 details in Everything

69. Cortex Cloud Runtime Security: June 2026 Jun 2026 · release notes

    Cortex Cloud Runtime Security adds CRI, K-ISMS, NZISM, NIST SP 800-172 standards and AI/KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. rule mappings for existing benchmarks.

    • Adds Cyber Risk Institute (CRI) Profile v2.1 to the Standards Catalog
    • Adds Korea – Information Security Management System (ISMS) For Finance to the Standards Catalog
    • Adds 'New Zealand Information Security Manual (NZISM) v3.9' to the Standards Catalog
    • Adds NIST SP 800-172 to the Standards Catalog
    • Updates EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001:2023, NIST AI 600-1, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Applications 2025, and OWASP Top 10 for Agentic Applications 2026 with AI-focused cloud security posture managementcloud security posture managementCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. rules

    +1 more show less

    • Adds Kubernetes security posture management rules to CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Amazon EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Benchmark v1.4, CIS Amazon EKS Benchmark v1.7, CIS Azure Kubernetes Service (AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations.) Benchmark v1.5, CIS Azure Kubernetes Service (AKS) Benchmark v1.8, CIS Docker Benchmark v1.7.0, CIS Google Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) Benchmark v1.6, CIS Google Kubernetes Engine (GKE) Benchmark v1.8, CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. Benchmark v1.11.0, CIS Red Hat OpenShift Container Platform v1.7.0, HIPAA, and PCI DSS v4.0.1

    6 details in Everything

70. Prisma Access 6.2 Preferred Innovation: Prisma Access Explicit Proxy Infrastructure Scaling Jun 2026 · release notes

    Prisma Access 6.2 adds SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support and scales trusted source IP capacity to one million

    • Adds SOCKS5 proxy support on port 1080 with Basic Authentication for connecting to non-web TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. applications

    1 detail in Everything

71. Prisma Access 6.2 Preferred Innovation: Inline Prevention of AI-Generated Malware with Prisma Access Explicit Proxy and Advanced WildFire Jun 2026 · release notes

    Prisma Access 6.2 Preferred Innovation introduces inline prevention of AI-generated malware using Advanced WildFire's Code Genome technology.

72. Prisma Access 6.2 Preferred Innovation: New Zealand Compute Location and Remapped Ukraine Location Jun 2026 · release notes

    Prisma Access 6.2 adds New Zealand compute location and remaps Ukraine to Poland

    • Adds a dedicated New Zealand compute location for Prisma Access users previously mapped to Australia.
    • Remaps the existing Ukraine Prisma Access location from Germany Central to Poland compute infrastructure.

    2 details in Everything

73. Prisma Access 6.2 Preferred Innovation: Native IPv6 Support for Prisma Access Remote Networks Jun 2026 · release notes

    Prisma Access 6.2 introduces native IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for remote networks.

74. Cortex XDR 5.x: June 2026 Jun 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. adds CRI Profile v2.1, K-ISMS Finance, NZISM v3.9, NIST 800-172 standards and AI/KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. rule mappings.

    • Adds Cyber Risk Institute (CRI) Profile v2.1 to the Standards Catalog
    • Adds Korea – Information Security Management System (ISMS) For Finance to the Standards Catalog
    • Adds New Zealand Information Security Manual (NZISM) v3.9 to the Standards Catalog
    • Adds NIST SP 800-172 to the Standards Catalog
    • Maps Kubernetes security posture management rules to existing cloud workload protection standards including CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.4 and others

    +1 more show less

    • Maps AI-focused cloud security posture managementcloud security posture managementCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. rules to existing AI standards including EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. and others

    6 details in Everything

75. Prisma Access 6.2 Preferred Innovation: Native IPv6 Support for Prisma Access Service Connections Jun 2026 · release notes

    Prisma Access 6.2 adds native IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for service connections via dual-stack capabilities and dedicated BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. sessions.

    • Service connections now function as dual-stack entities processing both IPv4 and IPv6 traffic simultaneously
    • Enables secure implementation using IKE gateways configured specifically for IPv6 on customer premises edge devices
    • Adds support for dual BGP routing sessions to dynamically exchange routing information between service connections and CE devices

    3 details in Everything

76. Prisma Access 6.2 Preferred Innovation: CDSS Enhancements in Prisma Access Jun 2026 · release notes

    Prisma Access 6.2 adds CVE Insights dashboard, Sliver C2 detection in TLS 1.3, and bulk enablement for advanced services.

    • Adds CVE Insights dashboard in Strata Cloud Manager for native CVE mapping and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. status visibility
    • Enables Encrypted Sliver C2 Detection over TLS 1.3 via Advanced Threat Prevention Inline Cloud Analysis without decryption
    • Provides Bulk Enable Advanced Services wizard to activate Inline Cloud Analysis for Anti-Spyware, Advanced URL Filtering, Advanced WildFire, and Vulnerability Protection across custom profiles
    • Upgrades default profiles to include advanced protection by default for new greenfield setups
    • Introduces Threat Insights Dashboard with Blocked Threats metric and Platform Effect visualization

    +1 more show less

    • Reimagines Operator Dashboards for Advanced URL Filtering, Advanced WildFire, Advanced Threat Prevention, and Advanced DNS Security with real-time efficacy widgets

    6 details in Everything

77. Prisma Access 6.2 Preferred Innovation: Context-Driven IP Address Manager Jun 2026 · release notes

    Prisma Access 6.2 adds Context-Driven IP Address Manager for dynamic, policy-based source IP assignment using user geo-location, gateway location, and identity role.

    • Introduces Context-Driven IP Address Manager to dynamically assign source IP addresses based on real-time dimensions: User Geo-Location, Prisma Access Location, and Identity & Role
    • Enables granular, policy-driven access controls that automate compliance by replacing static rules with dynamic IP assignment logic

    2 details in Everything

78. Prisma Access 6.2 Preferred Innovation: Remote Network Support for SASE Private Location Using Local Inspection Nodes Jun 2026 · release notes

    SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. Private Location now supports remote branch network connectivity via Local Inspection Nodes.

    • Introduces Local Inspection Nodes to bring Prisma Access managed data plane processing (virtual or hardware) into customer infrastructure, enabling low-latency inspection without routing through external cloud infrastructure.

    1 detail in Everything

79. Cortex XSIAM: June 2026 Jun 2026 · release notes

    Cortex XSIAM June 2026 adds CRI, ISMS, NZISM, NIST SP 800-172 standards; updates AI and KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. rule coverage

    • Adds Cyber Risk Institute (CRI) Profile v2.1, Korea – Information Security Management System (ISMS) For Finance, 'New Zealand Information Security Manual (NZISM) v3.9', and NIST SP 800-172 to the Standards Catalog.
    • Updates EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001:2023, NIST AI 600-1, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Applications 2025, and OWASP Top 10 for Agentic Applications 2026 with new AI-focused cloud security posture managementcloud security posture managementCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. rules.
    • Maps Kubernetes security posture management (KSPM) rules to CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., Docker, Kubernetes, OpenShift benchmarks, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., and PCI DSS v4.0.1 for the first time.

    3 details in Everything

80. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: 8.13 GA 2026-05-22 May 22, 2026 · release notes

    Cortex XSOAR 8.13 On-prem adds Info mode in playbook editor and auto storage expansion via TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency.

    • Adds Info mode in the playbook editor to view task and section details directly in workflow context

    1 detail in Everything

81. Cortex Analytics: 2026.05.06 May 18, 2026 · release notes

    Cortex Analytics adds new detection detectors and variants for Google Workspace, Azure, AWS, and Kubernetes environments.

    • Adds 'MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. was disabled for a Google Workspace user' detector with Medium and Low severity variations
    • Adds 'Large volume of files potentially containing credentials accessed in Google Drive' detector with Low severity variation for credential harvesting
    • Adds Cloud penetration testing tool activity detector (High) to detect cloud pentesting tools
    • Adds 'Suspicious API call from a Tor exit node' detector (High) for Tor-based API access
    • Adds 'Suspicious objects encryption in an AWS bucket' detector (High) for ransomware-like S3 activity

    +4 more show less

    • Adds 'A Kubernetes API operation was successfully invoked by an anonymous user' detector (Medium) to detect anonymous K8s access
    • Adds 'Logging was impaired via external encryption key' detector (Medium) for log tampering
    • Adds AWS Guard-Duty detector deletion detector (Low) to monitor GuardDuty integrity
    • Adds Azure Event Hub Deletion detector (Low) and Azure Network Watcher Deletion (Low) for monitoring Azure resource destruction

    9 details in Everything

82. Cortex XDR 3.x: May 17, 2026 May 17, 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.18 adds Broker VM upgrade enhancements and fixes static route management.

    • Broker VM upgrade enhancements improve reliability and stability of the upgrade process with reduced downtime.
    • The restart_routes command is now fully functional for static route management on Broker VM versions older than 31.0.58.
    • The legacy route command is deprecated and no longer supported.

    3 details in Everything

83. Cortex Cloud Posture Management: May 17, 2026 May 17, 2026 · release notes

    Cortex Cloud Posture Management adds Broker VM upgrade enhancements and fixes static route management in v31.0.58.

    • Improves reliability and stability of the Broker VM upgrade process with reduced downtime.
    • Makes the restart_routes command fully functional for configuring or restarting static routes.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The legacy route command is deprecated and no longer supported on Broker VM versions older than 31.0.58.
84. Cortex Analytics: 2026.04.29 May 10, 2026 · release notes

    Cortex Analytics adds detection for multiple failed AWS assume role attempts and refines LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. traffic detection logic.

    • Adds Suspicious multiple failed AWS assume role attempts detector to identify potential credential abuse via AWS STSAWS STSAWS Security Token Service, an Amazon Web service that issues short-lived credentials for IAM roles, letting tools authenticate to AWS APIs without storing long-term secrets..
    • Adds LDAP traffic from an injected thread within a non-standard process variation for deeper LDAP activity analysis.
    • Adds LDAP traffic from non-standard process executed under an unsigned causality actor in a commonly abused directory variation to detect suspicious lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. patterns.

    3 details in Everything

85. Cortex Xpanse Expander: Release 2.13 (May 2026) May 2026 · release notes

    Cortex Xpanse Expander 2.13 adds ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. alert generation, AI surface coverage expansion, and XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. lookup datasets.

    • Generates alerts from positive Attack Surface Testing (AST) results to drive faster response
    • Expands AI Infrastructure Coverage with new AI Attack Surface Rules for OpenClaw, Hugging Face, and more
    • Enables creation and management of lookup datasets in XQL for correlating custom data sources with environment events

    3 details in Everything

86. Cortex XDR 5.x: May 2026 May 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 5.1 May 2026 adds FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification., CaaS support, new analytics suites, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. API triggers, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.-based vuln mgmt for CaaS, and Graph Search SBAC.

    • Adds File Integrity Monitoring (FIM) for XDR to Windows and Linux via the Cortex XDR agent
    • Adds Container as a Service (CaaS) support for AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. Fargate via Cloud Runtime Security add-on
    • Adds ciImage and imageRegistry triggers and blockCiImage action to Application Security Policy API (/public_api/appsec/v1/policies) for pre-runtime scanning
    • Adds unified findingTypes values (CICD_RISKS, VULNERABILITY, SECRETS, IAC_MISCONFIGURATION, CODE_WEAKNESS, LICENSES, OPERATIONAL_RISK, MALWARE, DRIFT) to Application Security Policy API
    • Adds optional userSbac field to POST method of Application Security Policy API for scoped access control

    +31 more show less

    • Introduces Billing Contributors API endpoint to retrieve unique active contributors for billing transparency
    • Adds CaaS resource visibility in Asset Inventory under Compute assets, organized by ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Azure Container Instances
    • Adds granular per-object access control for report templates, playbooks, scripts, and saved queries
    • Expands Scope-Based Access Control (SBAC) with Account Name attribute for asset groups alongside existing Realm (Account ID)
    • Adds Malicious Emails Inventory view and AI-based phishing analysis in Advanced Email Security add-on
    • Adds single-click remediation quick actions from email investigation view
    • Adds new mailbox inventory in Unified Asset Inventory with mailbox metrics in Email Command Center
    • Adds detailed WildFire analysis reports accessible directly from the email causality card
    • Adds Scheduled Tasks, NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Insights, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Federation Services, Google Workspace, Linux Discovery, and Kubernetes Credentials analytics suites
    • Adds real-time query management for saving, refining, or stopping XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. queries mid-execution
    • Introduces new mathematical and analytical functions in Cortex Query Language (XQL)
    • Adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. local application profiles for SSH, FTP, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. clients like FileZilla, PuTTY, and Windows Remote Desktop
    • Enables shared objects file examination to block malicious code via non-standard loading on Linux
    • Adds on-write detection for mach-o files, non-native macOS binaries (Windows PEs, Linux ELFs), and all Java files
    • Consolidates Vulnerability & Exposure Management into a unified module with quick links and pivot capabilities
    • Adds Refine your risk accuracy feature to recalibrate risk scores using custom/third-party security controls
    • Enables Tenable.sc vulnerability ingestion directly into Cortex Exposure Management
    • Introduces Vulnerability Ingest API for third-party scanner integration
    • Extends SBOM-based vulnerability evaluation to CaaS assets via Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. analysis
    • Adds Contextual Asset ID column in Vulnerabilities and Packages tables with direct navigation to nested asset tabs
    • Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. Version 4 support in Cortex Vulnerability Management
    • Adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. v2/v3 authenticated scan support for Cortex Network Scanner
    • Adds Policy Compliance Assessment scan type for CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Benchmarks in Network Scanner
    • Enables selection of saved Asset Groups as targets in new network scans
    • Migrates Network Scanner functionality from Settings->Configurations to Modules->Vulnerability & Exposure Management
    • Introduces Cloud NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. (CNGFW) data source connector for cross-region and cross-account log ingestion
    • Adds SBAC enforcement in Graph Search with User Groups and Asset Groups scoping
    • Adds Case Timeline view, integrated asset context, SLAs for issue resolution, and issue exceptions in Investigation and Response
    • Adds centralized Identity Security profile for Windows Domain Controllers via ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on
    • Adds Chat with Cortex Agentic Assistant in Slack and natural language visualization capabilities
    • Allows administrators to remove unused or outdated saved views and filters

    36 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries now enforce granular per-object access; default access for new objects is Restricted instead of open.
    • !Only object Owners or Administrators can delete custom objects; Editors no longer have deletion rights.
    • !Enhanced application logs (EAL) are moved to non-billable status; EAL data volume is excluded from Data Collection (GB) license consumption totals and removed from the NGFW Ingestion Rate graph.
    • !NGFW behavioral alerts previously displayed as High severity now correctly display as Critical, potentially triggering different automation rules or notifications based on severity.
87. Cortex Cloud Posture Management: May 2026 May 2026 · release notes

    Cortex Cloud Posture Management v2.1 adds CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. playbooks, Snyk integration, Alibaba Cloud support, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. policy API, CLI updates, Data Security Command Center and more.

    • Adds Unified AppSec policy engine with new /public_api/appsec/v1/policies API endpoints for unified finding types, CI build/registry scan triggers, pipeline blocking, and SBAC during creation
    • Adds CNGFW (Cloud NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports.) as a new external data source connector for streaming traffic and application logs to Cortex Cloud
    • Adds Alibaba Cloud as a supported CSPM onboarding target with automated asset discovery and out-of-the-box policies
    • Adds Natively Snyk integration for ingesting SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings into Cortex Cloud
    • Adds Unified Human Identities feature creating single virtual identities linking accounts across directories, cloud IdPs, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps

    +54 more show less

    • Adds GCP Vertex Model Garden support for AI visibility tracking usage patterns and maintaining an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.)
    • Adds on-premise database support for Expanded DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. governance across hybrid infrastructure
    • Introduces Data Security Command Center (Beta) as a centralized dashboard for monitoring data discovery, classification, and security across connected stores
    • Expands CSPM automation with new playbooks and quick actions for remediation of internet-exposed compute instances and cloud misconfigurations across AWS, Azure, GCP
    • Enables manual AWS account onboarding flow allowing administrators to provision resources and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions directly without vendor templates
    • Enables manual GCP project onboarding flow allowing administrators to provision resources, service accounts, and permissions directly without vendor templates
    • Adds Bring your own Azure EventHub capability for routing cloud audit log collection through customer-owned EventHubs
    • Allows connecting Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. independently of tenant-level onboarding to enable CIEM, identity posture, and sign-in logs
    • Normalizes OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. audit logs into the cloud_audit_logs dataset for unified cross-cloud investigation via XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform.
    • Adds new public API endpoint Billing Contributors to retrieve unique active contributors factored into billing for seat transparency
    • Extends SBAC (Scope-Based Access Control) to allow defining Asset Groups scoped by Account Name attribute in addition to existing Realm/Account ID scoping
    • Enforces granular per-object access permissions across report templates, playbooks, scripts, and saved queries in Access Management
    • Automatically detects AWS Web Application Firewall (AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.) instances to improve visibility of internet-exposed cloud assets
    • Adds AI associated insight to instantly locate compute assets deploying AI models or containing AI software in their SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Identifies Hugging Face open-source models found on virtual machines as self-managed and open-source for complete AI-BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. tracking
    • Displays Security Drift Detected highlight and dedicated Security Drift tab on Container Instances asset cards in Asset Inventory
    • Shows base image visibility for Build, Registry, or Runtime container images via has base reference and is base reference for relationships in Security Graph
    • Enables filtering the ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. Command Center by one or more applications and a time range
    • Allows drilling down into ASPM Command Center prioritization funnel insights to view supporting evidence such as blocked findings
    • Enhances Urgency scoring coverage by extending calculations to active VM images and instances
    • Evaluates compensating controls (e.g., XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Agent coverage) to automatically lower Urgency scores for detected assets
    • Correlates detected AWS API keys with their associated identity to improve impact assessment in Urgency scoring
    • Adds 'Chat with the Agentic Assistant directly in Slack' allowing users to trigger tasks and get results within Slack
    • Enables Natural language visualizations via Cortex Agentic Assistant to turn questions into charts without coding
    • Allows associating out-of-the-box config, identity, and AI cloud security rules with custom controls
    • Consolidates CaaS resources from Amazon ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., Google Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Azure Container Instances into a dedicated section of the Asset Inventory under Compute assets
    • Expands notification forwarding fields for S3, SQS, Webhook, Splunk, and email to include asset name, cloud resource name, tags, account name, region, and evidence
    • Allows administrators to remove unused or outdated saved views and filters created by other users
    • Achieves Event-based Asset Ingestion (EAI) parity with Prisma Cloud for real-time monitoring via improved data processing speeds
    • Adds Support for importing configurations from existing Broker VM 31.x versions to the new Debian 13 based image during migration
    • Adds Advanced Settings in Broker VM web interface for legacy SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. renegotiation and accepting certificates without an Authority Key Identifier (AKID)
    • Presents a centralized Compliance Overview Dashboard showing compliance performance against industry standards and internal frameworks
    • Updates compliance score calculation to reflect the status of all assessed controls for all assessed assets
    • Allows querying OCI audit logs alongside AWS, Azure, and GCP activity using a unified schema via XQL
    • Enforces SBAC in Graph Search by assigning users to User Groups and Asset Groups to control visibility of graph nodes
    • Detects inactive identities for Google Cloud Platform users to help revoke unnecessary access
    • Enhances OCI effective permission calculations with Identity Domain support, additional dynamic group sources, and pseudo-resource handling
    • Introduces Case Timeline view capturing every action, artifact, and evidence in an end-to-end investigation lifecycle
    • Connects asset data directly to cases and issues for richer investigation context
    • Centers all remediation actions (recommended/pending actions, playbooks, CLI commands) in the Resolution tab and syncs to the case's Resolution Center
    • Adds Service Level Agreements (SLAs) for issue resolution to ensure critical issues are resolved within consistent timeframes
    • Formalizes risk deferrals using Exception Management for Issues with snooze capabilities, documented justifications, and approval workflows
    • Consolidates Kubernetes controls into a unified management interface accessible from the Kubernetes Clusters page
    • Enables pulling images directly from private container registries in Enhanced Kubernetes Connector security
    • Supports GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. workflows for standalone Kubernetes Connectors via installer updates
    • Restricts connector management to specific namespaces instead of the entire cluster and removes unnecessary secret creation permissions
    • Associates XDR security profiles with specific connectors using new Tag support during Kubernetes configuration
    • Improves KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Graph design to streamline exploration of relationships between workloads, nodes, and cloud resources
    • Adds Failure Policy setting to choose whether to allow or block requests if the Kubernetes admission controller is unreachable
    • Adds Request Scan button and API support to trigger on-demand Kubernetes cluster scans for inventory, containers, and nodes
    • Optimizes resource usage by having the KSPM posture module handle Adaptive Vulnerability Assessment (AVA) scans when a connector is deployed, disabling the XDR agent's AVA
    • Sets default access for newly created custom objects to Restricted so only the creator can access them initially
    • Changes Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries to manage access at the individual custom object level
    • Restricts deletion of custom objects to only the Owner or an Administrator, removing Editor delete rights

    59 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Newly created custom objects default to Restricted access instead of Public.
    • !Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries now manage access at the individual custom object level rather than a global setting.
    • !Deletion of custom objects is restricted to the Owner (creator) or an Administrator; Editors no longer have delete permission.
88. Cortex Cloud Runtime Security: May 2026 May 2026 · release notes

    Cortex Cloud Runtime Security May 2026 adds GCP Vertex AI detection, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Object Storage DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores., NLP viz in Slack, Snyk integration, and on-demand K8s scans.

    • Adds has base reference and is base reference for relationships in Security Graph to trace container image lineage from the asset details page
    • Enables triggering on-demand Kubernetes cluster scans via a new API and UI button to evaluate newly deployed resources instantly
    • Introduces a public Billing Contributors API endpoint to retrieve unique active contributors factored into billing
    • Adds GCP Vertex Model Garden discovery to track AI models as assets with activity data even without specific endpoints
    • Supports Alibaba Cloud account onboarding for unified security visibility across AWS, Azure, GCP, and OCI environments

    +3 more show less

    • Integrates Snyk SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. and SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings into Cortex Cloud via a new marketplace integration to centralize visibility
    • Adds Unified AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. policy engine with /public_api/appsec/v1/policies API updates for unified finding types and pipeline blocking
    • Enables OCI Object Storage discovery and classification within the Data Security Platform module

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !All newly created custom objects are now Restricted by default, meaning only the creator can access them until changed to Public.
    • !Only the object Owner or an Administrator can delete a custom object; Editors can no longer delete them.
89. Prisma Cloud Compute Edition: 34.04 (Build 34.04.160) May 2026 · release notes

    Prisma Cloud Compute Edition 34.04 adds per-image cluster caps, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. compartment OCID support for agentless scanning, and PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. augmentation for binary packages.

    • Adds configurable cap for the number of clusters stored per image in MongoDB to prevent excessive document growth
    • Expands agentless scanning configuration to accept OCI compartments by OCID in addition to compartment name
    • Augments binary packages with Package URLs (PURLs) to improve software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. accuracy

    3 details in Everything

90. Cortex XSIAM: May 2026 May 2026 · release notes

    Cortex XSIAM 3.5 (May 2026): New APIs, detections, integrations, and Agentic Assistant capabilities

    • Adds Application Security Policy API with new triggers.ciImage, triggers.imageRegistry, blockCiImage action, unified findingTypes, and optional userSbac field for scoped access
    • Introduces new Billing Contributors API endpoint to retrieve active contributors for billing transparency
    • Adds SBAC enforcement in Graph Search allowing users to assign user groups and asset groups for granular control
    • Enables Container as a Service (CaaS) support for AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. Fargate within Endpoint Security via XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Agent
    • Deploys advanced macOS kernel behavioral monitoring for near-real-time privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. prevention

    +15 more show less

    • Adds on-write detection for mach-o, non-native binaries (Windows PE, Linux ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code.), and Java files in Endpoint Security
    • Examines and blocks malicious shared object files on Linux in the Cortex XDR agent
    • Launches new analytics suites: Scheduled Tasks, NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Insights, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Federation Services, Google Workspace, Linux Discovery, and Kubernetes Credentials
    • Adds new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. mathematical/analytical functions and autosave/personalized view persistence in Query Builder
    • Expands notification forwarding fields to include asset name, cloud resource name, tags, account name, region, and evidence for S3, SQS, Webhook, Splunk, and email
    • Enables Slack integration for Cortex Agentic Assistant to trigger tasks directly from the application
    • Adds Scope-Based Access Control (SBAC) with Account Name attribute support in Access Management
    • Introduces Refine your risk accuracy feature in Exposure Management to recalibrate risk scores based on custom controls
    • Provides Vulnerability ingest API and Tenable.sc integration for third-party vulnerability data
    • Adds Compliance Policy Audit scan type and SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. v2/v3 authentication support in Network Scanner
    • Enables near-real-time Salesforce event collection and new CNGFW data source for cloud-native visibility
    • Supports CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. V4 framework in Vulnerability Management and adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.-based evaluation for CaaS assets
    • Adds Contextual Asset ID column in Vulnerabilities and Packages tables to trace finding origins
    • Allows import of configuration to Debian 13 broker image via Import Configuration tool enhancements
    • Adds Granular Per-Object Access control for user groups across report templates, playbooks, scripts, and saved queries

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries now manage access at the individual custom object level instead of broad role settings
    • !All newly created custom objects are now Restricted by default (owner-only access) until explicitly set to Public
    • !Only the object Owner or an Administrator can delete a custom object; Editors lose deletion rights for objects they do not own
    • !Enhanced application logs (EAL) are moved to non-billable status and excluded from Data Collection quota calculations and the NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. Ingestion Rate graph
    • !NGFW behavioral alerts previously mapped to High severity are now mapped to Critical severity in Cortex XSIAM, potentially triggering different automation or notification rules
91. Cortex XDR 3.x: May 2026 May 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.18 adds macOS/Linux kernel prevention, on-write detection, scheduled query management, and several new analytics suites.

    • Adds macOS and Linux kernel behavioral monitoring to prevent privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. attempts in near-real-time
    • Adds Device guardrails for SD cards to block devices connected via the PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. Bus
    • Adds Real-time query management allowing users to refine, validate, or stop running queries before completion
    • Adds on-write detection for malicious mach-o files, non-native macOS binaries, Windows PEs, and Linux ELFs the moment they are saved
    • Adds Android zero-touch installation support via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. providers like Workspace ONE and Intune

    +9 more show less

    • Adds Scheduled Tasks Analytics to identify malicious persistence through scheduled task installation and execution
    • Adds NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Insights Analytics to correlate low-fidelity network signals with existing alerts
    • Adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Federation Services Analytics to detect suspicious behavior within AD FS
    • Adds Google Workspace Analytics to detect attack attempts including brute force, phishing, and credential harvesting
    • Adds Linux Discovery Analytics to identify reconnaissance and host environment mapping activities
    • Adds Kubernetes Credentials Analytics to identify credential harvesting techniques such as kubelet impersonation
    • Adds Identity Profile in Centralized Identity Security for Domain Controllers to monitor LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. protection and AD misconfigurations
    • Adds Broker VM Advanced Settings options for legacy SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. renegotiation and accepting certificates without Authority Key Identifier (AKID)
    • Enhances Import Configuration tool to support migration of existing Broker VMs to the new Debian 13 based image

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !EAL data is no longer displayed on the Data Ingestion dashboard or NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. Ingestion Rate graph, as EAL logs are now non-billable and excluded from quota totals.
    • !NGFW behavioral alerts previously mapped to High severity by the Detection & Mapping Service now display as Critical; existing automation rules or notification profiles based on alert severity require adjustment.
92. Cortex XSOAR 8 SaaS: May 2026 May 2026 · release notes

    Cortex XSOAR 8.14 SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. adds multi-tenant name renaming, content workspace separation, expanded audit logs, and new CrowdStrike/AzureWAF integrations

    • Adds the ability to rename child tenants from within Cortex Gateway for simplified tenant management
    • Introduces a dedicated workspace structure that moves all content pack items to the Content Pack Items page, reserving the Content Items page exclusively for custom creations
    • Enhances audit logs with expanded auditing for notification forwarding configuration changes and high-stakes content lifecycle events such as pushing content to production in the Management Audit log
    • Adds Identity and privilege-based SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. response via CyberArk Endpoint Privilege Manager integration available through Cortex Marketplace
    • Adds new data collection type to the CrowdStrike Falcon integration to capture additional security events

    +1 more show less

    • Adds support for ingesting and analyzing Azure Front Door WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. policy data in the AzureWAF integration

    6 details in Everything

93. Cortex Analytics: 2026.03.18 Apr 13, 2026 · release notes

    Cortex Analytics adds detection logic for macOS process communication, AWS export events, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. errors, and Okta admin actions.

    • Adds 15 new detector variations across High, Medium, Low, and Informational severities, including 'Uncommon macOS process communication to a rare external host' (High) and 'An unsigned process created scheduled task and performed an injection' (Medium)
    • Adds detection for Invalid SAML errors with the [Informational] Invalid SAML Detected detector
    • Adds 'Possible an unsigned installer created scheduled task and performed an injection' (Low) variation under the existing scheduling/detection category
    • Adds 'Discovery of accounts with pre-authentication disabled via LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.' (Low) detector for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enumeration monitoring

    4 details in Everything

94. Cortex Cloud Runtime Security: April 2026 Apr 2026 · release notes

    Cortex Cloud Runtime Security adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS/Azure v6/v5, HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance. 11.7, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Agentic, DPDP 2023 standards and updates SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally./endpoint/network scanning rules.

    • Adds CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1 to the Standards Catalog for AWS security hygiene.
    • Adds CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 2 for advanced defense-in-depth configurations in AWS environments.
    • Adds CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1 for specialized Azure configurations handling highly sensitive data.
    • Adds CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 2 to harmonize global security and privacy standards into a unified assessment model.
    • Adds HITRUST CSF 11.7.0 as a baseline security roadmap for Azure tenants focusing on identity and access controls.

    +18 more show less

    • Adds OWASP Top 10 for Agentic Applications 2026 to manage risks associated with autonomous AI agents and goal manipulation.
    • Adds The Digital Personal Data Protection Act 2023 to establish a legal framework for digital privacy and user consent rights.
    • Introduces SaaS-specific security configuration rules for CIS Critical Security Controls v8 benchmarks.
    • Appends new rules to CIS GitLab Benchmark 1.0.1 to detect insecure repository settings and access controls.
    • Appends new rules to CIS GitHub Benchmark 1.0.0 to provide automated oversight of GitHub security settings and supply chain protection.
    • Introduces network scanning rules for CIS Microsoft Windows Server 2022 Benchmark v3.0.0 to audit OS-level configuration drifts.
    • Introduces network scanning rules for CIS Microsoft Windows 11 Enterprise Benchmark v.4.0.0 to audit endpoint security baselines.
    • Introduces workload security rules mapped to Cloud Security Assurance Program (CSAP) - IaaS for South Korean public sector services.
    • Introduces attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management controls for cloud-native applications in CSA Cloud Controls Matrix (CCM) 4.0.12.
    • Introduces application-layer security rules to the HITRUST framework in version 11.2.0.
    • Appends new AI governance and management rules to ISO/IEC 42001:2023.
    • Introduces workload security rules mapped to Korea – Information Security Management System (ISMS) for private sector compliance.
    • Appends data security and privacy control rules to NIST SP 800-53 Rev. 5.
    • Appends rules to NIST AI 600-1 for managing generative AI risks and safety.
    • Introduces attack surface management and CI/CD-specific rules in OWASP TOP 10 CI/CD Security Risks 2025.
    • Appends rules to OWASP Top 10 for LLM Applications 2025 to defend against prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and training data poisoning.
    • Introduces application-layer security rules to the Secure Controls Framework (SCF) 2024.2.
    • Introduces SaaS-specific security configuration rules for SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. benchmarks.

    23 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Rule CUSTOMIZE: Non-corporate accounts have access to Google Cloud Platform (GCP) resources. is removed from all applicable compliance standards.
95. Cortex XDR 5.x: April 2026 Apr 2026 · release notes

    Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Applications and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS/Azure benchmarks to Compliance Catalog

    • Adds OWASP Top 10 for Agentic Applications 2026 standard to the Standards Catalog
    • Adds CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1 to the Standards Catalog
    • Adds CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 2 to the Standards Catalog
    • Adds CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1 to the Standards Catalog
    • Adds CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 2 to the Standards Catalog

    5 details in Everything

96. Cortex XSIAM: April 2026 Apr 2026 · release notes

    Cortex XSIAM adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Applications, DPDP Act standards and expanded CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. rules.

    • Adds OWASP Top 10 for Agentic Applications 2026 standard to the Compliance Catalog
    • Adds The Digital Personal Data Protection Act 2023 to the Standards Catalog
    • Adds 'CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1' and Level 2 support
    • Adds 'CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1' and Level 2 support
    • Adds HITRUST CSF 11.7.0 standard to the Compliance Catalog

    +16 more show less

    • Updates CIS Critical Security Controls v8 with SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.-specific security configuration rules
    • Appends new rules for GitLab repository management in CIS GitLab Benchmark 1.0.1
    • Appends new rules for GitHub developer workflows in CIS GitHub Benchmark 1.0.0
    • Introduces network scanning rules for CIS Microsoft Windows Server 2022 Benchmark v3.0.0
    • Introduces network scanning rules for CIS Microsoft Windows 11 Enterprise Benchmark v.4.0.0
    • Introduces workload security rules mapped to CSAP-IaaS standard
    • Adds attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management controls for CSA Cloud Controls Matrix (CCM) 4.0.12
    • Appends new application-layer security rules to HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance. CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 11.2.0
    • Appends new AI governance rules to ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 42001:2023
    • Introduces workload security rules for Korea – Information Security Management System (ISMS)
    • Appends data security and privacy controls to NIST SP 800-53 Rev. 5
    • Appends generative AI risk management rules to NIST AI 600-1
    • Adds attack surface management and CI/CD rules for OWASP TOP 10 CI/CD Security Risks 2025
    • Appends LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. vulnerability defenses to OWASP Top 10 for LLM Applications 2025
    • Introduces application-layer security rules for Secure Controls Framework (SCF) 2024.2
    • Adds SaaS-specific configuration rules for SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. benchmarks

    21 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes 'CUSTOMIZE: Non-corporate accounts have access to Google Cloud Platform (GCP) resources' rule from all applicable compliance standards.
97. Cortex Cloud Posture Management: April 2026 Apr 2026 · release notes

    Cortex Cloud adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Apps, DPDP Act 2023 standards and new detection rules for GitLab, GitHub, Windows 11 and more.

    • Adds CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1 to the Standards Catalog for foundational AWS security hygiene.
    • Adds CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 2 to cover advanced defense-in-depth configurations for sensitive workloads.
    • Adds CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1 to provide specialized, high-security configurations for Azure environments handling sensitive data.
    • Adds CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 2 to harmonize global security and privacy standards into a unified assessment model.
    • Adds HITRUST CSF 11.7.0 as a baseline security roadmap for Azure tenants focusing on identity and access controls.

    +18 more show less

    • Adds OWASP Top 10 for Agentic Applications 2026 as a dedicated security framework for managing risks of autonomous AI agents.
    • Adds The Digital Personal Data Protection Act 2023 to establish a legal framework for digital privacy and user consent rights.
    • Updates CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Critical Security Controls v8 with first SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.-specific security configuration rules to identify SaaS misconfigurations.
    • Appends new rules to CIS GitLab Benchmark 1.0.1 to detect insecure repository settings and protect CI/CD workflows.
    • Appends new rules to CIS GitHub Benchmark 1.0.0 to provide automated oversight of GitHub security settings and supply chain protection.
    • Introduces network scanning rules for CIS Microsoft Windows Server 2022 Benchmark v3.0.0 to audit OS-level configuration drifts.
    • Introduces network scanning rules for CIS Microsoft Windows 11 Enterprise Benchmark v.4.0.0 to audit security baselines for endpoints.
    • Adds workload security rules mapped to Cloud Security Assurance Program (CSAP) - IaaS for South Korean public sector mandates.
    • Introduces attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. management controls for cloud-native applications in CSA Cloud Controls Matrix (CCM) 4.0.12.
    • Adds application-layer security rules in HITRUST CSF 11.2.0 to strengthen data protection within the HITRUSTHITRUSTA US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance. framework.
    • Appends AI governance and risk management rules to ISO/IEC 42001:2023 for international safety alignment.
    • Adds workload security rules mapped to Korea – Information Security Management System (ISMS) for private sector compliance.
    • Appends data security and privacy controls to NIST SP 800-53 Rev. 5 for robust audit trails.
    • Appends generative AI risk management rules to NIST AI 600-1 to mitigate transparency and bias risks.
    • Adds attack surface management and pipeline security rules in OWASP TOP 10 CI/CD Security Risks 2025.
    • Appends LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. vulnerability defenses to OWASP Top 10 for LLM Applications 2025 covering prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and data poisoning.
    • Adds application-layer security rules in Secure Controls Framework (SCF) 2024.2 to reduce software-based regulatory failures.
    • Introduces SaaS-specific security configuration rules in SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. for real-time compliance visibility.

    23 details in Everything

98. Prisma Cloud: Features Introduced in April 2026 Apr 2026 · release notes

    Prisma Cloud adds AWS SDK for Java 2.x support, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. compartment OCID for agentless scanning, nginx_unit detection, and FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. env var config

    • Adds FIPS_ENABLED environment variable to twistlock.cfg to toggle FIPS mode without UI interaction.
    • Adds OCI compartment support in Agentless Scanning via the OCID field (in addition to compartment name) for programmatic configuration.
    • Adds vulnerability detection for nginx_unit application server binaries.
    • Adds Package URLPackage URLA standardized string format for uniquely identifying software packages across ecosystems (npm, PyPI, Maven, etc.), letting cyber tools reference and correlate dependency data without ecosystem-specific logic. (PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously.) augmentation for binary packages to improve software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. accuracy.
    • Adds configurable cap on the number of clusters stored per image in MongoDB to prevent excessive document growth.

    +3 more show less

    • Adds block login capability via feature flag for access key logins in the CWP UI.
    • Supports CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. AWS Foundations Benchmark v6.0.0 (Levels 1 and 2).
    • Supports CIS Microsoft Azure Foundations Benchmark v5.0.0 (Levels 1 and 2).

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The retention period for audit events stored in the Prisma Cloud database changed from 120 days to 30 days, impacting features relying on historical audit data such as Audit Trail & Investigation and Alert Details older than 30 days.
    • !AutoFocus Anomaly policies are removed due to AutoFocus End of Life, affecting traffic-based anomaly detection and any custom policies using AutoFocus attributes.
99. Prisma Cloud Compute Edition: 34.04 (Build 34.04.156) Mar 29, 2026 · release notes

    Prisma Cloud Compute Edition 34.04 adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. via env var, nginx_unit vuln detection, and UI access key restriction

    • Adds FIPS_ENABLED environment variable support in twistlock.cfg to configure FIPS mode
    • Adds vulnerability detection for nginx_unit application server binaries
    • Adds feature flag capability to restrict UI login via access keys for the CWP login page

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Defenders below release v31 will disconnect from the Console
    • !Support is no longer available for Defender versions previous to 31.00
100. Cortex Analytics: 2026.03.04 Mar 15, 2026 · release notes

     Cortex Analytics 2026.03.04 adds detectors for cloud database exfiltration and Microsoft Teams phishing.

     • Added detector [Low] Data exfiltration from cloud database
     • Added detector '[Low] Possible phishing attack via Microsoft Teams'
     • Added detector [Medium] Azure Privilege Escalation Using an Application
     • Added detector [Low] Possible Insider Threat Activity
     • Added detector '[Low] Potential extraction of NAA Account Credentials in Microsoft Configuration Manager'

     +3 more show less

     • Added detector '[Low] Suspicious LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. queries followed by shared folder access'
     • Added detector '[Informational] Windows CGO, actor process and action module with anomalous characteristics'
     • Added detector '[Informational] A Cloud DB instance was exported to an unknown destination'

     8 details in Everything

101. PAN-OS 12.1: High Availability Active/Passive Support for PA-7500 Firewalls Mar 2026 · release notes

     PAN-OS 12.1 adds High Availability active/passive support for PA-7500 firewalls using HSCI.

     • Enables traditional High Availability active/passive configurations on PA-7500 Generation 5 hardware
     • Supports High Speed Chassis Interconnect (HSCI) for HA1 and HA2 session and configuration synchronization

     2 details in Everything

102. Prisma Access 6.1 Preferred Innovation: NGFW Connector: Automated Private Application Access Mar 2026 · release notes

     Prisma Access 6.1 introduces NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. as ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector automation and Server Initiated Traffic for automated private app onboarding.

     • Enables configuring an existing Next-Generation Firewall (NGFW) as a Zero Trust Network Access (ZTNA) Connector to automate connectivity, NAT configurations, and application onboarding.
     • Adds Server Initiated Traffic support for the NGFW Connector, allowing data center application servers to initiate outbound TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., and ICMP sessions to GlobalProtect users and Remote Network hosts.

     2 details in Everything

103. Cortex Analytics: 2026.02.18 Mar 1, 2026 · release notes

     Cortex Analytics content release adds detections for uncommon net group/localgroup execution and /etc/passwd access.

     • Adds detection capability for Uncommon net group command execution patterns including high-severity unsigned administrator command variants
     • Adds detection capability for Uncommon net localgroup command execution patterns via web server or scripting engines
     • Adds detection capability for Uncommon access to /etc/passwd by potential webshells, credential dumpers, or security testing tools
     • Adds low-severity detection for LOLBAS executable injects into another process under an uncommon CGO

     4 details in Everything

104. PAN-OS 12.1: Capacity Settings Mar 2026 · release notes

     PAN-OS 12.1 adds customizable capacity settings in Panorama to scale SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. VIFs up to 16 members

     • Panorama allows customization of firewall capacity settings for flexible and efficient SD-WAN deployments
     • Supports scaling to up to 16 members per VIF while maintaining optimal system performance
     • Enables balancing of system resources between SD-WAN rules, interfaces, and members based on deployment needs

     3 details in Everything

105. Prisma Access 6.1 Preferred Innovation: Customizable Authentication Timers for Dynamic Privilege Access Mar 2026 · release notes

     Prisma Access 6.1 adds customizable re-auth frequency (10h–30d), warning timers and aggressive auth for Dynamic Privilege Access.

     • Adds a configurable re-authentication frequency setting to control user refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. lifetime globally across your deployment, with intervals ranging from 10 hours to 30 days
     • Adds customizable warning timers that notify users before re-authentication is required, preventing unexpected disconnections and workflow disruption
     • Enables aggressive authentication to force immediate re-authentication when users connect or extend gateway sessions for stricter security enforcement
     • The gateway session timeout setting has been renamed for clarity

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The gateway session timeout setting name has changed, requiring updates to any existing configuration references or documentation pointing to the old name
106. Prisma Access 6.1 Preferred Innovation: Brazil Southeast and UK West Locations and Compute Locations Mar 2026 · release notes

     Prisma Access 6.1 adds compute locations in Brazil Southeast and UK West

     • Adds new compute locations for Brazil Southeast and UK West to reduce latency and meet data residency requirements.
     • Introduces IP pool group 13 as the mapping target for the Brazil Southeast location.
     • Introduces IP pool group 4 as the mapping target for the UK West location.

     3 details in Everything

107. Prisma Access 6.1 Preferred Innovation: Post-Quantum Cryptography (PQC) Support for TLS Traffic Mar 2026 · release notes

     Prisma Access 6.1 Preferred Innovation adds Post-Quantum CryptographyPost-Quantum CryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA.) support for TLS traffic inspection.

     • Supports hybrid post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. encryption schemes combining ECC with NIST-standardized ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake. algorithms for TLS key establishment

     1 detail in Everything

108. Prisma Cloud Compute Edition: 34.04 (Build 34.04.145) Mar 1, 2026 · release notes

     Prisma Cloud Compute Edition 34.04 adds Debian 13, TLS 1.3, GCP Gen 2, Nftables and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Bottlerocket support.

     • Adds Debian 13 (Trixie) as a supported operating system for Defenders
     • Adds TLS 1.3 protocol support for secure communications
     • Adds support for GCP Cloud Function Gen 2 discovery and protection via the Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service.
     • Adds Nftables support for Cloud Native Network Firewall in Defenders to replace iptables on modern Linux systems
     • Adds CIS Bottlerocket Benchmark controls 1.3.1, 1.4.3, and 1.4.4 compliance checks

     5 details in Everything

109. Cortex Analytics: 2026.02.11 Feb 23, 2026 · release notes

     Adds 6 new detectors and modifies logic for 70 detectors in Cortex Analytics content release 2026.02.11.

     • Adds the AWS Security Service Enumeration detector (Low) to detect AWS security service discovery.
     • Adds the Machine Account NTLM Relay detector (Low) to identify NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay attacks using machine accounts.
     • Adds the 'Sensitive browser credential files accessed by a rare non browser process' detector (Informational/Low) for file access anomalies.
     • Adds the A cloud storage configuration was modified detector (Informational) to track cloud storage config changes.
     • Adds the 'An RDS snapshot was exported to an unknown bucket' detector (Informational/Failed attempt) for unauthorized RDS data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. attempts.

     +1 more show less

     • Adds the 'Unusual internal access to network device management interface' detector (Informational) for anomalous network admin access.

     6 details in Everything

110. Cortex XDR 5.x: February 22, 2026 Feb 22, 2026 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. February 2026 release introduces Broker VM upgrade reliability improvements for version 30.0.63.

     • Broker VM upgrade process reliability and stability improved in version 30.0.63 to reduce downtime during upgrades.

     1 detail in Everything

111. Cortex Analytics: 2026.01.28 Feb 9, 2026 · release notes

     Cortex Analytics adds detection for kubelet impersonation and uncommon process communication to rare hosts; modifies logic for cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. and email alerts.

     • Adds Potential kubelet impersonation attempt by an unusual process detector (Medium severity) to detect when a non-standard process attempts to impersonate the kubelet
     • Adds Suspicious access to Kubernetes API with kubelet credentials from unusual pod detector (Medium severity) for unauthorized API access using kubelet identity
     • Adds Unrecognized sender domain detector (Informational) to flag emails originating from domains not previously seen in the organization's traffic
     • Removes Uncommon process communication to a rare external host detection suite including variants for automated penetration testing tools, crypto mining, and exfiltration
     • Modifies logic for A process is masquerading as a common Microsoft product to include new high-severity case for unsigned actors with uncommon characteristics

     +5 more show less

     • Modifies logic for Rare scheduled task created to detect rare tasks created by injected actors and uncommon remote scheduled tasks
     • Modifies logic for Uncommon driver loaded to detect globally rare and unsigned drivers, and uncommon drivers with rare vendors loaded as services
     • Modifies logic for An identity attached an administrative policy to an IAM user or role to detect failed attachment attempts and suspicious attachments by unusual identities
     • Modifies logic for cloud object download detections to identify large volume downloads compared to project's or bucket's usual baseline
     • Updates Near-empty email from an external sender to add variants for blank emails with inline or attached files from external senders

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The detection coverage for Uncommon process communication to a rare external host and its variants (including LOTTunnels, crypto mining, exfiltration) is removed; alerts relying on these detectors will no longer fire
     • !Email was received from an unknown sender with an unrecognized domain variant under Unrecognized sender address has been removed
112. Cortex XSIAM: February 2026 Feb 2026 · release notes

     Cortex XSIAM adds 14 new compliance standards to the Standards Catalog for February 2026

     • Adds CIS AWS Storage Services Benchmark 1.0.0 to the Standards Catalog.
     • Adds CIS Microsoft Azure Storage Services Benchmark 1.0.0 to the Standards Catalog.
     • Adds CIS Microsoft Windows 11 Enterprise Benchmark 4.0.0 to the Standards Catalog.
     • Adds CIS Microsoft Windows Server 2016 Benchmark 3.0.0 to the Standards Catalog.
     • Adds CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.7.0 1.7.0 to the Standards Catalog.

     +7 more show less

     • Adds CIS Google Kubernetes Engine (GKE) Benchmark v1.8.0 1.8.0 to the Standards Catalog.
     • Adds ISO/IEC 42001:2023 2023 to the Standards Catalog.
     • Adds CIS Amazon Linux 2 STIG Benchmark 2.0.0 to the Standards Catalog.
     • Adds CIS Azure Kubernetes Service (AKS) Benchmark v1.8.0 1.8.0 to the Standards Catalog.
     • Adds Cloud Security Assurance Program (CSAP) - SaaS Standard to the Standards Catalog.
     • Adds Cloud Security Assurance Program (CSAP) - SaaS Simplified to the Standards Catalog.
     • Adds Cloud Security Assurance Program (CSAP) - Low SaaS to the Standards Catalog.

     12 details in Everything

113. Cortex Cloud Runtime Security: February 2026 Feb 2026 · release notes

     Cortex Cloud Runtime Security adds Azure AI Foundry support, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform.-based cloud security rules, and Agentix Assistant MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. interoperability.

     • Adds the Broker VM image running on Debian 13 for new deployments.
     • Adds native interaction with external environments via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) to Cortex Agentic Assistant.
     • Enables creation and editing of XQL-based Cloud Security rules in CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps..
     • Expands Non-Human Identity (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) protection to provide visibility into cloud-managed secrets and their security posture.
     • Adds an Allow connection to private registries toggle for discovering and scanning Azure Container Registries (ACRs).

     +17 more show less

     • Supports onboard Microsoft Azure tenant and management group scope using Terraform.
     • Adds Code-to-Cloud traceability to Virtual Machines built from VM images in ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most..
     • Integrates with OpenShift Internal Registry for container image scanning in KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them..
     • KSPM Kubernetes Connector now supports K3s, RKE, and RKE2 clusters (Rancher).
     • Adds support for deploying the Kubernetes Connector onto AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Fargate environments.
     • Enables ingestion of Snyk Software Composition Analysis (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.) findings into Cortex Cloud Application Security.
     • Provides a dedicated KSPM Graph visualization in Beta to map Workload-to-Image relationships.
     • Allows configuring custom cadence for data classification of on-premise file shares.
     • Expands Azure Cloud Scan deployment mode to include storage blobs and self-managed databases.
     • Adds new forwarding destinations (Splunk, Amazon SQS, Amazon S3, Webhook) for cases and issues.
     • Adds Support for Asset-level rule configuration (Exclusion, Starring, Scoring, Playbook rules) per asset object.
     • Adds support for Infrastructure-as-Code (IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.) drift detection in Application Security.
     • Adds IaC compliance checks as part of the Posture Management Compliance platform.
     • Integrates with JFrog Artifactory to enhance Software Composition Analysis (SCA).
     • Expands Asset-level rule configuration support to include asset-based rules.
     • Adds resolution actions suggested quick actions in Vulnerability Management.
     • Adds Conflict-free playbook editing with automatic lock release and manual unlock permissions.

     22 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Broker VM Pathfinder applet is deprecated.
     • !Marketplace page has moved to Settings > Configurations > Marketplace.
114. Cortex XDR 5.x: February 2026 Feb 2026 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 5.x Feb 2026 adds Endpoint DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., Exposure Management add-on, Agentic Assistant with MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., and macOS USB block

     • Endpoint Data Loss Prevention now blocks data leakage on endpoints even when offline (requires additional license)
     • Exposure Management and ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. add-on integrates Cortex Network Scanner and third-party vulnerabilities into Cortex XDR console (requires additional license)
     • Natural language querying generates and runs XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. queries via AI prompts without specialized query expertise
     • AgentiX Platform for XDR introduces Cortex Agentic Assistant with prebuilt agents (Endpoint Investigation, Email Investigation, Network Security) for autonomous triage, enrichment, and containment
     • New on-write protection automatically scans ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code., PE, and Mach-O files to block malicious binaries from being stored on Linux systems

     +24 more show less

     • New detection suite profiles network baselines for Linux and macOS to identify anomalous Command and Control behavior
     • Enhanced behavioral analytics now highlights and blocks unauthorized attempts to access sensitive files or execute brute-force attacks on Linux/macOS
     • Cortex Agentic Assistant supports native interaction with external environments via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP)
     • Automation Engineer Agent builds and refines secure Python scripts through conversational natural language prompts using the Agentix Automation SDK
     • Administrator restriction setting for Secure, personalized queries streamlines the Query Center for non-admin users by preventing unauthorized access to private data
     • Standardized Issued by field in query accountability clearly distinguishes between who owns a query and who ran it (person, system, or API key)
     • New interactive Email Security Command Center assesses and manages security posture for Advanced Email Security add-on users
     • Malicious Device Prevention module on macOS identifies and blocks tools like the USB Rubber Ducky via USB hardware attacks
     • Network Shield allows isolation of compromised supervised iOS devices directly from the management console, cutting off all network access instantly
     • Amazon ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. agent installer provides expanded runtime protection for AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. EC2 workloads using the XDR agent
     • API capability to permanently remove unused endpoint tags simplifies endpoint tag management
     • Unified Data Sources & Integrations page merges existing Data Sources and Integrations portals into a single location for managing ingestion and automation
     • Asset-level rule configuration allows Exclusion, Starring, Scoring, and Playbook rules to be configured for specific asset objects or account groups
     • Process Anomaly Analytics suite detects malicious processes by monitoring process history on Windows environments
     • Enhanced RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. Analytics automatically flags unusual remote desktop activity by combining session data with behavior analysis
     • Webshell Analytics expanded to cover more server types using network protocol inspection for both managed and unmanaged servers
     • Expanded Child Process Protection supports User Mode on Linux, providing broader coverage without kernel-level access
     • Conflict-free playbook editing locks playbooks during edits and adds new permission for manual unlocking by designated users
     • Granular Playbooks and Scripts access control allows administrators to set permissions to None in certain scenarios
     • Object-based permissions for dashboards allow sharing specific dashboards as Viewer or Editor via the unified Objects approach
     • New optional SBAC setting configures separate access for cases/issues lacking asset references, with manual admin enablement required to restore prior default visibility
     • Secure issue exclusion access restricts Issue Exclusions page visibility to authorized users only
     • Expanded Management Audit Logs now track all changes related to asset-led Scope-Based Access Control (SBAC)
     • Broker VM image updated to Debian 13 for new deployments, improving security and stability

     29 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Broker VM Pathfinder applet is deprecated and no longer supported in this release.
     • !The Marketplace page is relocated to Settings > Configurations > Marketplace; the Automation & Feed Integrations page is replaced by the Data Sources & Integrations page at Settings > Data Sources & Integrations.
     • !Microsoft Office 365 data collector now uses the Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint. v2 GA endpoint instead of Legacy Alerts (v1); instances using the Legacy checkbox must switch to Use Microsoft Graph API v2 (Beta) before April 2026 to avoid ingestion failure.
115. Cortex Xpanse Expander: Release 2.12 (February 2026) Feb 2026 · release notes

     Expanded asset attribution logic and cloud observation thresholds to reduce false positives.

116. Cortex Cloud Posture Management: February 2026 Feb 2026 · release notes

     Cortex Cloud Posture Management February 2026 adds Azure AI Foundry, Okta integration, ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. cases, and XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform.-based rules.

     • Adds Azure AI Foundry support for centralized visibility into all AI assets and supply-chain risks.
     • Adds new Okta integration to ingest identities and groups for deeper identity risk visibility.
     • Adds Expanded DSPM coverage for Databricks across AWS, Azure, and GCP to identify unsecured notebooks and risky downloads.
     • Adds support for forwarding cases and issues to Splunk, Amazon SQS, Amazon S3, and Webhook destinations.
     • Adds FedRamp/Government Cloud support for tenants on AWS GovCloud, Azure Government, and Google Public Sector.

     +39 more show less

     • Adds ability to onboard Microsoft Azure using Terraform via the automated infrastructure provisioning flow.
     • Adds autodetection of Palo Alto Networks VM-Series firewalls deployed using Gateway Load Balancers (GWLB) in isolated mode on AWS.
     • Enables a new toggle, Allow connection to private registries, by default for improved discovery and scanning of private Azure Container Registries (ACRs).
     • Adds support for asset-level rule configuration, allowing Exclusion, Starring, Scoring, and Playbook rules to be configured for specific asset objects.
     • Adds Strengthen security for open-source AI models capability with dashboard tracking and direct links to reputation databases on the model asset card.
     • Adds visibility into AI agents collaboration via Graph Search and on each agent's Asset Card.
     • Adds Infrastructure-as-Code (IaC) drift detection within Application Security to detect configuration changes made directly in runtime.
     • Adds Compliance support for Infrastructure-as-Code (IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.) checks as part of the Posture Management Compliance platform.
     • Adds direct integration with JFrog Artifactory for Software Composition Analysis (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.).
     • Adds ability to ingest Snyk SCA vulnerability findings into Cortex Cloud Application Security.
     • Expands Code-to-Cloud traceability to Virtual Machines built from VM images in the ASPM module.
     • Adds a new Broker VM image running on Debian 13 for improved security and system stability.
     • Adds detailed asset attribution evidence including IP address/domain registration, domain redirects, and ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. records.
     • Adds a compliance standard filter when constructing Misconfiguration policies in Cloud Workspace Rules (CWP).
     • Releases newer versions of CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Kubernetes Service (AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations.) Benchmark and CIS Amazon Elastic Kubernetes Service (EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.) Benchmark.
     • Adds an Asset card compliance tab displaying overall compliance score and compliance against individual controls.
     • Improves Compliance Assessment CSV reports to include remediation guidance for failed rules, tags, and cloud account IDs.
     • Renames the Data Sources page to Data Sources & Integrations.
     • Adds support for native interaction with external environments via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) in Cortex Agentic Assistant.
     • Adds an Automation Engineer Agent to build and refine secure Python scripts via conversational chat.
     • Enables natural language querying to generate and run XQL queries using AI prompts.
     • Adds support for creating Custom XQL-based cloud security rules with an XQL free form editor in the CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. module.
     • Allows customization of the cadence for data classification of on-premise file shares.
     • Expands Azure Cloud Scan deployment to include storage blobs and self-managed databases.
     • Adds a new Okta data source for deep visibility into identities and permissions.
     • Adds Secure OpenShift with container image scanning via integration with the OpenShift Internal Registry.
     • Adds an Interactive KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. Graph (Beta) to visualize Kubernetes security posture.
     • Adds Container image security scanning capability powered by the lightweight KSPM connector.
     • Adds KSPM support for AWS EKS Fargate clusters and Rancher-managed Kubernetes clusters (K3s, RKE, RKE2).
     • Creates a dedicated navigation section for Kubernetes Security under Modules in KSPM.
     • Exposes consumption details via the Public API for internal financial tracking in Cortex Cloud licensing.
     • Adds Conflict-free playbook editing with automatic locking during edits and a manual unlock permission.
     • Enables setting Playbooks or Scripts permissions to None for enhanced access control granularity.
     • Adds object-based permissions for managing individual instances of dashboards.
     • Expands Management Audit Logs to include all changes related to asset-led Scope-Based Access Control (SBAC).
     • Allows restricting access to the Issue Exclusions page when defining user roles.
     • Adds a new optional setting to configure separate access for cases and issues without inventory assets or endpoints.
     • Adds Resolution Actions as suggested quick actions in Vulnerability Management, executable via UI, AI, automation, or APIs.
     • Makes Vulnerability findings accessible via XQL queries.

     44 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Data Sources page is renamed to Data Sources & Integrations, merging permissions: users with View/Edit access to either original section now have full access to the unified page.
     • !Administrators must manually enable a new optional setting in user role configuration to restore visibility into cases and issues that lack an asset reference or are not in All Assets/All Endpoints inventories.
117. Prisma Cloud: Features Introduced in February 2026 Feb 2026 · release notes

     Prisma Cloud February 2026 adds Debian 13 and TLS 1.3 runtime support, GCP Gen 2 serverless coverage, nftables for CNNF, and new AWS/GCP API ingestions.

     └──▷ USE IT
     Configure the security audit role to ingest AWS Service Catalog data.
     text copy

     servicecatalog:SearchProvisionedProducts

     • Adds Debian 13 (Trixie) support to Secure the Runtime.
     • Adds TLS 1.3 protocol support for Secure the Runtime.
     • Adds CIS Bottlerocket Benchmark Support covering controls 1.3.1, 1.4.3, and 1.4.4 to Secure the Runtime.
     • Adds GCP Cloud Function Gen 2 support via Cloud Run Admin API for serverless scanning discovery.
     • Adds Nftables support for Cloud Native Network Firewall to Defenders for modern Linux systems using NFTables.

     +6 more show less

     • Adds API ingestion for aws-servicecatalog-provisioned-product, aws-pinpoint-apns-sandbox-channel, aws-pinpoint-gcm-channel, aws-sagemaker-flow-definition, aws-pinpoint-app, aws-pinpoint-apns-channel, aws-docdb-db-cluster-snapshot, aws-xray-sampling-rule, aws-xray-group, aws-redshift-endpoint-access, aws-code-deploy-application-deployment-group, aws-docdb-subnet-group, aws-guardduty-publishing-destination, and aws-docdb-db-global-cluster.
     • Adds API ingestion for gcloud-dataform-repository-workspace, gcloud-dataform-repository, gcloud-dataform-configuration, gcloud-conversational-insights-analysis-rule, gcloud-netapp-active-directory, gcloud-netapp-backup, gcloud-netapp-backup-vault, gcloud-netapp-kms-config, gcloud-netapp-storage-pool, gcloud-netapp-volume, and gcloud-dataplex-glossary.
     • Updates aws-rds-db-subnet-group to convert JSON values SupportedNetworkTypes and tags.TagList.Tag from object to array.
     • Updates aws-xray-encryption-config to include regionId key:value in ingested resources.
     • Updates aws-servicecatalog-portfolios API ingestion to capture additional attributes TagOptions and Tags.
     • Updates multiple existing APIs (aws-glue-dev-endpoint, aws-vpc-nat-gateway, aws-ec2-describe-network-acls, aws-ec2-describe-internet-gateways, aws-ec2-describe-flow-logs, aws-glue-job) to include regionId key:value.

     11 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Resources affected by Azure Storage accounts restricted by a read scope lock can no longer be ingested and are marked as deleted.
118. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: 8.12 GA 2026-01-25 Jan 25, 2026 · release notes

     Cortex XSOAR 8.12 adds conflict-free playbook editing and syslog forwarding for Management Audit logs

     • Enables centralized monitoring and satisfies log retention requirements by allowing the tool to forward Management Audit, Integration, and Guard Rails logs to a configured syslog server
     • Displays unique logos and content pack indicators for playbook tasks to distinguish between integration commands, custom scripts, and system actions

     2 details in Everything

119. Cortex Analytics: 2025.12.03 Jan 4, 2026 · release notes

     Cortex Analytics adds 12 new detection detectors for AWS enumeration and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. activity, plus updated logic for IMDS access.

     • Adds detection for AWS EBS discovery operation
     • Adds detection for AWS EC2 discovery operation
     • Adds detection for AWS EC2 infrastructure enumeration activity
     • Adds detection for AWS IAM account discovery operation
     • Adds detection for AWS IAM permission groups discovery operation with variant Unusual AWS IAM permission groups discovery operation

     +7 more show less

     • Adds detection for AWS Lambda discovery operation
     • Adds detection for AWS Lambda infrastructure enumeration activity
     • Adds detection for AWS S3 Buckets enumeration activity
     • Adds detection for AWS S3 discovery operation
     • Adds detection for Cloud storage object discovery
     • Adds detection for Local user enumeration via SAMR with variant [Low] Local user enumeration via SAMR on an internet facing server
     • Modifies logic for Unusual cloud Instance Metadata Service (IMDS) access to raise severity to Medium for unusual known shell or web service processes

     12 details in Everything

120. Cortex Cloud Runtime Security: December 22, 2025 Dec 22, 2025 · release notes

     XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Collectors 1.5.1 update with adjusted health reporting and removed real-time status column.

     • Updated XDR Collectors to version 1.5.1 (Windows 1.5.1.2048, Linux 1.5.1.1950) for reduced noise in health reporting
     • Removed real-time status updates from the Status column on the XDR Collectors Administration page

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Status column on the XDR Collectors Administration page no longer displays real-time status updates for individual collectors.
121. Cortex XDR 5.x: December 22, 2025 Dec 22, 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. collectors update health reporting logic.

122. Cortex Analytics: 2025.11.26 Dec 8, 2025 · release notes

     Adds Possible multistage attack in Microsoft Teams alert and seven new Informational Analytics BIOCs to Cortex Analytics.

     • Added a new Low severity Analytics Alert for detecting possible multistage attacks involving Microsoft Teams.
     • Added seven new Informational Analytics BIOCs covering backup storage access, cloud object read activity, S3 block public access changes, AMI creation, Linux user creation, RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. group enumeration, and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. user data retrieval.
     • Added a new Informational Analytics Alert for detecting when an identity downloads multiple cloud objects.

     3 details in Everything

123. Cortex Analytics: 2025.11.19 Dec 1, 2025 · release notes

     Cortex Analytics adds new Low and Informational alerts/BIOCs for cloud-native email abuse, S3 bucket misconfigs, Kubernetes activity, and persistent storage.

     • Added a new Low Analytics Alert: 'Suspicious activity indicating a potential abuse of a cloud-native email service' to detect cloud email exploitation.

     1 detail in Everything

124. Prisma Cloud: Features Introduced in December 2025 Dec 2025 · release notes

     Prisma Cloud adds native API ingestion for dozens of AWS SageMaker, Backup, and Google Dialogflow resources in December 2025.

     • Adds support for ingesting aws-sagemaker-model-package-group resource type via sagemaker:ListModelPackageGroups API
     • Adds support for ingesting aws-sagemaker-image resource type via sagemaker:ListImages API
     • Adds support for ingesting aws-sagemaker-feature-group resource type via sagemaker:ListFeatureGroups API
     • Adds support for ingesting aws-sagemaker-app resource type via sagemaker:ListApps API
     • Adds support for ingesting aws-batch-scheduling-policy resource type via batch:ListSchedulingPolicies API

     +47 more show less

     • Adds support for ingesting aws-sagemaker-project resource type via sagemaker:ListProjects API
     • Adds support for ingesting aws-sagemaker-pipeline resource type via sagemaker:ListPipelines API
     • Adds support for ingesting aws-sagemaker-data-quality-job-definition resource type via sagemaker:ListDataQualityJobDefinitions API
     • Adds support for ingesting aws-redshift-cluster-subnet-group resource type via redshift:DescribeClusterSubnetGroups API
     • Adds support for ingesting aws-rds-db-subnet-group resource type via rds:DescribeDBSubnetGroups API
     • Adds support for ingesting aws-configservice-aggregator-authorization resource type via config:DescribeAggregationAuthorizations API
     • Adds support for ingesting aws-mq-configuration resource type via mq:ListConfigurations API
     • Adds support for ingesting aws-backup-backup-selection resource type via backup:GetBackupSelection API
     • Adds support for ingesting aws-backup-report-plan resource type via backup:DescribeReportPlan API
     • Adds support for ingesting aws-backup-framework resource type via backup:DescribeFramework API
     • Adds support for ingesting aws-quicksight-vpc-connection resource type via quicksight:ListVPCConnections API
     • Adds support for ingesting aws-redshift-serverless-snapshot resource type via redshift-serverless:ListSnapshots API
     • Adds support for ingesting aws-redshift-serverless-namespace resource type via redshift-serverless:ListNamespaces API
     • Adds support for ingesting aws-redshift-serverless-endpoint-access resource type via redshift-serverless:ListEndpointAccess API
     • Adds support for ingesting aws-ssm-resource-data-sync resource type via ssm:ListResourceDataSync API
     • Adds support for ingesting aws-imagebuilder-image resource type via imagebuilder:GetImage API
     • Adds support for ingesting aws-imagebuilder-distribution-configuration resource type via imagebuilder:GetDistributionConfiguration API
     • Adds support for ingesting aws-ecs-capacity-provider resource type via ecs:DescribeCapacityProviders API
     • Adds support for ingesting aws-comprehend-entity-recognizer resource type via comprehend:ListEntityRecognizers API
     • Adds support for ingesting aws-msk-clusterV2 resource type via kafka:ListClustersV2 API
     • Adds support for ingesting aws-glue-ml-transform resource type via glue:GetMLTransforms API
     • Adds support for ingesting aws-ds-log-subscription resource type via ds:ListLogSubscriptions API
     • Adds support for ingesting aws-apigateway-usage-plan resource type via apigateway:GET API
     • Adds support for ingesting aws-athena-capacity-reservation resource type via athena:GetCapacityReservation API
     • Adds support for ingesting aws-athena-namedquery resource type via athena:GetNamedQuery API
     • Adds support for ingesting aws-athena-workgroup resource type via athena:GetWorkGroup API
     • Adds support for ingesting aws-athena-database resource type via athena:GetDatabase API
     • Adds support for ingesting aws-quicksight-user resource type via quicksight:DescribeUser API
     • Adds support for ingesting aws-code-build-report-group resource type via codebuild:BatchGetReportGroups API
     • Adds support for ingesting aws-code-deploy-deployment-config resource type via codedeploy:GetDeploymentConfig API
     • Adds support for ingesting aws-code-deploy-application resource type via codedeploy:GetApplications API
     • Adds support for ingesting aws-securityhub-finding-aggregator resource type via securityhub:GetFindingAggregator API
     • Adds support for ingesting gcloud-ai-applications-datastore resource type via discoveryengine.dataStores.list API
     • Adds support for ingesting gcloud-cloud-task-queue resource type via cloudtasks.queues.list API
     • Adds support for ingesting gcloud-cloud-task-cmek-config resource type via cloudtasks.cmekConfig.get API
     • Adds support for ingesting gcloud-compute-healthcheck resource type via compute.healthChecks.list API
     • Adds support for ingesting gcloud-dialogflow-es-agent resource type via dialogflow.agents.search API
     • Adds support for ingesting gcloud-dialogflow-es-encryption-spec resource type via dialogflow.encryptionspec.get API
     • Adds support for ingesting gcloud-dialogflow-cx-agent resource type via dialogflow.agents.list API
     • Adds support for ingesting gcloud-dialogflow-cx-securitysettings resource type via dialogflow.securitySettings.list API
     • Adds support for ingesting gcloud-cloud-firestore-backup resource type via datastore.backups.list API
     • Adds support for ingesting gcloud-conversational-insights-settings resource type via contactcenterinsights.settings.get API
     • Adds support for ingesting gcloud-logging-bucket-log-views resource type via logging.views.list API
     • Adds support for ingesting gcloud-dlp-discovery-scan-configuration resource type via dlp.jobTriggers.list API
     • Adds support for ingesting gcloud-dataplex-entry-type resource type via dataplex.entryTypes.list API
     • Adds support for ingesting gcloud-dataplex-entry-group resource type via dataplex.entryGroups.list API
     • Adds support for ingesting gcloud-dataplex-aspect-type resource type via dataplex.aspectTypes.list API

     52 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Azure onboarding Terraform script no longer requires Microsoft.MixedReality/ObjectAnchorsAccounts/read permission; existing scripts retaining this permission may fail on new deployments.
125. Cortex Analytics: 2025.11.12 Nov 26, 2025 · release notes

     Cortex Analytics 2025.11.12 adds detection coverage for ClickFix, Teams Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. abuse, and AWS resource modifications

     • Adds a new Low Analytics BIOC for 'ClickFix - PowerShell executed through the run application'
     • Adds a new Low Analytics Alert for 'Suspicious activity indicating a potential abuse of a cloud-native email service'
     • Adds 22 new Informational Analytics BIOCs, including AWS Backup recovery point deletion and AWS S3 object deletion
     • Adds 4 new Informational Analytics Alerts detecting Microsoft Teams conversations with suspicious operations via external users
     • Improved logic for High Analytics BIOC 'Suspicious SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API call from a Tor exit node'

     +1 more show less

     • Improved logic for Medium Analytics BIOC Kubernetes vulnerability scanning tool usage

     6 details in Everything

126. Prisma Cloud Compute Edition: 34.03 (Build 34.03.138) Nov 23, 2025 · release notes

     Prisma Cloud Compute Edition 34.03 adds Alma Linux 8/9 CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. improvements, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 support, and CISA secondary score fallback.

     • Adds full support for RedHat Enterprise Linux 10 as a scanable platform.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !Defenders from release v30.03 or earlier will disconnect from the Console if not upgraded to v31.xx or later.
127. Cortex Analytics: 2025.11.05 Nov 18, 2025 · release notes

     Cortex Analytics adds 82 new BIOCs and 7 alerts covering AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution., Teams Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. abuse, and cloud identity enumeration.

     • Added new detection for AWS SSM parameters discovery to flag identities enumerating Systems Manager parameters.
     • Added new detection for AWS SSM parameters retrieval to identify secrets access via Systems Manager.
     • Added new detection for User installed an application in Microsoft Teams via Graph API.
     • Added new detection for A cloud identity started a Cloud Shell session.
     • Added new Informational Analytics Alerts for Microsoft Teams activity including External user created a Microsoft Teams conversation with suspicious operations, User exported multiple messages in Microsoft Teams via Graph API, and User sent messages in Microsoft Teams to multiple conversations via Graph API.

     5 details in Everything

128. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: 8.11 GA 2025-11-13 Nov 13, 2025 · release notes

     Cortex XSOAR 8.11 adds advanced playbook/script search, queue clearing for incidents, and enhanced Generic Webhook integrations

     • Adds advanced text-based search functionality across playbooks and scripts to locate specific content, task names, and integration references quickly.
     • Introduces the ability to clear incidents stuck in the ingestion queue to resolve bottlenecks during high-volume incident floods.
     • Enhances the Generic Webhook integration with support for header-based authentication and a simplified setup flow for connecting external services.

     3 details in Everything

129. Cortex Analytics: 2025.10.22 Nov 12, 2025 · release notes

     Cortex Analytics adds detections for cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, AWS Storage Gateway enumeration, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. hijacking and log enumeration.

     • Adds new low-severity BIOC: Uncommon attempt to clear shell history
     • Adds 20 new informational analytics BIOCs including AWS Storage Gateway enumeration and GCP sensitive role grants
     • Adds new informational analytics alert: Log enumeration via cloud native logging service
     • Adds detection for Unsigned DLL Hijack into a Microsoft process

     4 details in Everything

130. Cortex XDR 3.x: November 2025 Nov 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.16 adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Windows agent, Linux forensics, JScript ML protection, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. blocking, customizable analytics severity, Broker VM ENS config, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. query limits, and

     • Extends XDR Agent deployment to Windows devices on ARM64 architecture, including Microsoft Surface devices
     • Adds ML-based detection module for the XDR Agent on Windows to analyze and block malicious JScript files before execution or when written to disk
     • Adds real-time prevention against malicious LDAP queries (e.g., SharpHound) targeting Windows Domain Controllers for customers with the ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on
     • Enables complete forensic investigations across Windows, macOS, and Linux with deeper artifact collection from Linux endpoints
     • Aligns detection rules with organizational risk profile by allowing adjustment of alert severity for built-in analytics rules

     +10 more show less

     • Updates Broker VM to comply with Spain’s ENS National Security Framework; requires enabling Only use recommended cipher suites in Advanced Settings via URL
     • Adds new Replace Storage Method option for Snapshot datasets in the Database Collector applet, overwriting existing data for static/reference data use cases
     • Introduces expanded XQL query governance: monitor all sources, cancel running queries, set user query limits, and automatic stop after 60 minutes (overridable via max_runtime_minutes command)
     • Adds new default query retention aligned with issue retention in Query Center
     • Adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows Disguised Processes, EDR Linux Credential Grabbing, EDR macOS Generic Persistence, and Microsoft Teams analytics detection suites
     • Expands DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Hijacking Analytics coverage for process hijacking and DLL sideloading
     • Adds File examination on-load for macOS to detect/prevent malicious Mach-O files during loading
     • Adds Child Process Protection for Linux (KM mode) examining parent-child process relations
     • Supports Goggle Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) Autopilot for CaaS distribution
     • Groups all data collector errors into a single non-dismissible notification instead of multiple alerts

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Simulated Compute Units field has been deprecated in Query Center.
     • !Due to the deprecation of AutoFocus, the AutoFocus integration option is removed from the Threat Intelligence screen under Settings.
     • !AutoFocus data will no longer appear in incidents or alerts.
131. Prisma Access 6.1 Preferred Innovation: Response Page Customization and Context Passing Nov 2025 · release notes

     Prisma Access 6.1 introduces customizable response page upload and context passing for blocked content.

     • Expands response page size limits and adds an intuitive upload interface for custom HTML templates including variables, stylesheets, images, and JavaScript
     • Adds context passing to response pages so that user identity, URL category, and rule details are passed when users encounter blocked content or need to acknowledge policies

     2 details in Everything

132. Cortex Cloud Runtime Security: November 2025 Nov 2025 · release notes

     Cortex Cloud Runtime Security 1.3 adds Agentic Assistant, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support, new SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. for PHP/Rust, Git hook secrets scanning, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. dataset fixes, and broker VM c

     • Cortex Agentic Assistant allows autonomous agent execution based on playbook history with governed guardrails.
     • Native MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. (Beta) enables trusted LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. applications to securely connect to Cortex Cloud via natural language prompts.
     • New support for self-hosted OpenShift clusters in cloud runtime security and Kubernetes posture management.
     • XQL lookup dataset queries now exclude _time by default unless explicitly added via the fields stage, improving flexibility.
     • Agentless Disk Scan (ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware.) extends to Windows (NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT.) disk images in OCI before deployment for zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. security.

     +61 more show less

     • Agentless Scanning integrates directly with Docker Hub, GitLab Container Registry, Harbor Registry, and Sonatype Nexus Repository Manager.
     • Registry Scanning for OCI Artifact Registry allows enabling scanning during or post-onboarding of cloud accounts.
     • New Trusted Images policy wizard defines trust criteria (source, base image, scan status) to alert on or block untrusted images.
     • Code Scanners now support SCA for PHP (composer.json/composer.lock) and Rust (Cargo.toml/Cargo.lock).
     • Application Security scanners can be integrated as pre-commit or pre-receive Git hooks for secrets scanning.
     • Role chaining permissions allow creating policies permitting one role to assume another, enabling lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. analysis.
     • New Identity Detection rules can be created to customize identity and permissions scenarios.
     • Azure AI Search support provides visibility into AI datasets, sensitive data identification, and risky misconfiguration detection.
     • AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. dashboard unifies AI posture and threat detection by integrating AI-DR capabilities.
     • Full visibility into AI software packages, SDKs, and development dependencies creates an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI BoM).
     • Databricks integration delivers enhanced visibility into data, configurations, and risks in collaborative analytics environments.
     • DSPM Fileshare applet on Broker VM supports classification of NFS and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. file shares for on-premise environments.
     • New Backup Discovery and Risk Analysis automatically discovers cloud backups, maps them to original assets, and classifies contents.
     • Scanning settings now allow setting classification cadence for assets according to asset type.
     • Expanded Asset Group scoping allows defining Asset Groups with the Business Application Names attribute for Scope-Based Access Control (SBAC).
     • New SBAC support manages access to Cloud Workload Policies, ensuring scoped users only view permitted policies.
     • Cortex Cloud supports viewing and onboarding unmanaged OCI services in Cloud ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them..
     • Support for existing AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and S3 buckets allows onboarding environments without data duplication.
     • User and role APIs allow managing user roles, updating API keys, and adding/removing role/scope assignments programmatically.
     • New XQL view-only feature for CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. and CIEM rules simplifies policy management and tracking.
     • Unified Kubernetes onboarding wizard discovers capabilities based on license and configures the solution in one flow.
     • Kubernetes support for ARM nodes extends posture management coverage to ARM architecture environments.
     • Kubernetes proxy support allows installation behind HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy gateways with no or basic authentication.
     • New filters (Scanners, Last Scan) on Container Images, VM Instances, and VM Images tabs identify scanning gaps.
     • CWP Collections Groups support streamlines policy definition, asset grouping, and multi-rule selection.
     • Support for scanning Azure legacy images enhances image scanning coverage compliance.
     • Supply Chain Catalog provides a centralized registry of recognized supply chain tools with risk factors and PAN Insights.
     • Automated bulk application creation uses cloud tags to automatically group assets into applications.
     • Application-based scope enforces granular access control (blacklisting) and policy enforcement by Application Name.
     • Issue severity SLAs allow defining overdue days and approaching status, with a new sortable/filterable SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Status column in tables.
     • Runtime-context policies create rules based on repository context like deployment status, internet exposure, and privileged access.
     • New Urgency metric prioritizes issues using code-to-cloud data, with side-card sections for urgency details and Code-to-Cloud graph.
     • File examination on-load detects malicious Mach-O files on macOS endpoints.
     • ML-based JScript file examination blocks malicious JScript files on Windows via the XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent.
     • Malicious LDAP Query Protection identifies and blocks reconnaissance targeting Windows Domain Controllers (ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on).
     • Child Process Protection for Linux examines parent-child process relations to detect suspicious activity.
     • Agent deployments extend to Windows devices running on ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. architecture, including Microsoft Surface devices.
     • Connecting API Endpoints to ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. shows which applications APIs belong to via agent-deployed mappings.
     • Sensitive Data Detection identifies PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations./PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. in API traffic using Cortex Cloud DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. scanning engine profiles and patterns.
     • Enhanced API Endpoint Relations in Search Graph visualize connections between endpoints, servers, and gateways.
     • Improved Issue Investigation Experience provides pre-built XQL queries and filters for rapid root cause analysis.
     • In-product support case creation records screen, logs, and tenant details automatically.
     • Expanded cloud security playbooks provide automated multi-step responses with human approval options.
     • New one-click automations resolve risks like publicly accessible S3 buckets across AWS, GCP, and Azure.
     • Recommended Quick Actions provide contextual automation recommendations in issue response workflows.
     • Auto-populate command and Quick Action parameters use Unified Asset Inventory (UAI) attributes dynamically.
     • Automation Exclusion Center enhancements allow asset group references, dynamic matching operators, and policy overrides.
     • Dismiss alerts for non-configured playbook components reduces visual noise in system and custom playbooks.
     • Streamlined playbook development uses drag-and-drop functionality to build automation flows.
     • Choose integration instance for Quick Actions enables selecting specific instances for on-demand or automated rules.
     • Enhanced automation commands/Quick Actions available for AWS, GCP, and Azure integrations.
     • New compliance standards: CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Amazon Linux 2 STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against., CIS Microsoft Windows 11 Enterprise, CIS Windows Server 2016.
     • Updated compliance standards: CIS AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. Benchmark, CIS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Benchmark, CIS GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Benchmark.
     • Immediate initial view of compliance results displays posture via default policy without configuration.
     • New policy generates issues for all workload security rules with Critical & High severity automatically.
     • Enhanced error visibility/auditing for Broker VM applets (FTP, Netflow, Network Mapper, Kafka) in collection_auditing dataset.
     • Broker VM updated for Spain's Esquema Nacional de Seguridad (ENS) requiring Only use recommended cipher suites setting.
     • Database Collector applet introduces new Storage Method options: Append or Replace for Snapshot datasets.
     • Unified integration error notifications group all data collector errors into a single non-dismissible notification.
     • Cortex CLI CA configuration now uses global --ca-cert flag and CORTEX_CA_CERTIFICATE environment variable.
     • Cortex CLI supports skipping SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. validation with --no-cert-verify flag or $CORTEX_NO_CERT_VERIFY environment variable.

     66 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The AutoFocus integration option has been removed from the Threat Intelligence screen under Settings due to deprecation.
     • !AutoFocus data will no longer appear in cases or issues due to AutoFocus deprecation.
     • !Support for old Azure DevOps authorization methods is deprecated; you must re-authorize using Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. or a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) or applications will no longer function.
     • !The Cortex CLI CA configuration path code.ca-cert is removed and broken; CA definitions must now be placed at the root level as ca-cert, causing Application Security scans to fail if not updated.
133. Cortex Cloud Posture Management: November 2025 Nov 2025 · release notes

     Cortex Cloud Posture Management November 2025 introduces AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud., MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. fixes, CA config migration, PHP/Rust SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and more.

     • Adds Cortex Agentic Assistant with native MCP support for connecting LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. applications to Cortex Cloud in beta.
     • Adds Unified AI Security Posture Management (AI-SPM) including an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AI BoM) and a central dashboard.
     • Adds Backup Security Posture Management (BSPM) to discover and analyze backups for sensitive data and risks.
     • Adds new Databricks integration for enhanced visibility into configurations and data flows.
     • Adds Google Workspace IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. integration for user, group, and organizational unit visibility.

     +21 more show less

     • Enables onboarding of existing AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and S3 buckets to avoid data duplication.
     • Adds Cortex Vulnerability Block Grace Period with configurable per-severity grace periods for prevention policies.
     • Introduces Cortex Vulnerability Risk Score (CVRS) for dynamic vulnerability prioritization.
     • Enables one-click automations to resolve critical risks like publicly accessible S3 buckets across AWS, GCP, and Azure.
     • Adds User and role APIs for managing user roles, API keys, and scope assignments.
     • Adds support for scanning Windows VM disk images (NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT.) in OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. using agentless scanning.
     • Adds Agentless Scanning for Container Registries including Docker Hub, GitLab, Harbor, and Sonatype Nexus.
     • Enables Registry Scanning for OCI Artifact Registry during or after cloud account onboarding.
     • Adds Trusted Images policy wizard to define trust criteria for container images.
     • Adds Support of self-managed OpenShift in Kubernetes Security Posture Management.
     • Adds Unified Kubernetes onboarding wizard and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. node support.
     • Adds automated bulk application creation using cloud tags with a dedicated Criteria page.
     • Introduces Issue severity SLAs with an Approaching status and sortable SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Status column.
     • Enables Runtime-context policies based on deployment, exposure, and privilege capabilities.
     • Introduces the Urgency metric for prioritizing SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCA, Secrets, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. issues with a Code-to-Cloud graph.
     • Adds SCA support for PHP and Rust languages detecting dependencies via composer.json/Cargo.toml.
     • Enables integration of Secrets scans into Git Pre-Commit and Pre-Receive hooks.
     • Adds new compliance standards: CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Amazon Linux 2 STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against., CIS Microsoft Windows 11 Enterprise, and CIS Windows Server 2016.
     • Updates Cortex CLI to use a global CA configuration via --ca-cert flag or $CORTEX_CA_CERTIFICATE env var.
     • Adds --no-cert-verify flag and $CORTEX_NO_CERT_VERIFY environment variable to skip SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. validation in CLI.
     • Allows creation of custom identity detection rules for identity and permissions scenarios.

     26 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Azure DevOps authorization: Must re-authorize Cortex Cloud applications or onboard new ones using Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. or a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.).
     • !Cortex CLI CA configuration: The previous configuration path code.ca-cert is removed and CA definitions must now be placed at the root level.
134. Cortex XDR 5.x: November 2025 Nov 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. November 2025 adds Cortex MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Beta, Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Agent, ML JScript Detection, Linux Forensics, and more.

     • Adds Cortex MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server (Beta) enabling LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
     • Adds XDR Agent support for Windows on ARM64 architecture
     • Introduces ML-Based JScript File Examination to detect malicious scripts before execution
     • Enables Malicious LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Query Protection with ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. add-on for real-time prevention against BloodHound-style attacks
     • Extends Forensic investigation capabilities to Linux endpoints with deeper artifact collection

     +20 more show less

     • Adds Cortex Agentic Assistant (AgentiX AI Agent Workforce) for autonomous security response
     • Expands Asset Group scoping in SBAC to include Business Application Names attributes
     • Provides new User and role APIs for managing user roles, API keys, and scope assignments
     • Enables installing content packs directly from Marketplace via Automation workflows
     • Allows dismissing alerts for non-configured playbook components (sub-playbooks, scripts, commands)
     • Adds drag-and-drop functionality to streamline playbook development in the UI
     • Introduces AI Script Generator with built-in testing panel for Python script creation
     • Enables choosing a specific integration instance for Quick Actions
     • Enhances Automation Exclusion Center with asset group reference, role-based list permissions, and condition-based policies using dynamic matching operators
     • Adds enhanced error visibility and auditing for Broker VM applets (FTP, Netflow, Network Mapper, Kafka collectors) logged in collection_auditing dataset
     • Adds Broker VM support for Spain's ENS National Security Framework via Only use recommended cipher suites setting
     • Introduces new Storage Method options (Append and Replace) for Database Collector applets
     • Enhances XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. query monitoring with real-time tracking, cancel capability, and a new default 60-minute runtime limit overridable by max_runtime_minutes command
     • Improves Lookup dataset handling so _time is not included by default in target stage unless explicitly added via fields stage
     • Adds four new Analytics tags/suites: EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows Disguised Processes, EDR Linux Credential Grabbing, EDR macOS Generic Persistence, and Microsoft Teams Analytics
     • Improves DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Hijacking Analytics coverage for process hijacking and sideloading
     • Launches New Advanced Email Security response engine for automated policy-driven remediation
     • Enables File examination on-load for Mach-O files on macOS endpoints
     • Adds Child Process Protection for Linux (KM mode) to examine parent-child process relations
     • Supports CaaS distribution to Google Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) Autopilot

     25 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The AutoFocus integration option has been removed from the Threat Intelligence screen under Settings
     • !Autofocus data will no longer appear in cases or issues
     • !The Simulated Compute Units field has been deprecated in Query Center
135. Cortex Xpanse Expander: Release 2.11 (November 2025) Nov 2025 · release notes

     Cortex Xpanse Expander 2.11 adds attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. testing intrusiveness levels, AI infrastructure detections, and bulk IP paste.

     • Adds configurable Attack Surface Testing Intrusiveness Levels to control the intensity of exposure checks
     • Introduces new detections for AI Infrastructure items including MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers and MCP Inspector in the Unified Inventory
     • Enables filtering Services by software name and version with Service Version Enumeration
     • Adds misconfiguration and enumeration alerts to the Threat Response Center for prioritized response
     • Adds bulk actions for managing alerts and assets more efficiently in the UI

     +1 more show less

     • Supports pasting large IP address lists into Alerts, Unified Inventory, Services, Domains, Certificates, and Owned IPv4/Responsive IP views

     6 details in Everything

136. Cortex XSIAM: November 2025 Nov 2025 · release notes

     Cortex XSIAM Nov 2025 adds AgentiX AI agents, Federated Search in XDL via XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform., new SBAC for dataset rows, User/Role APIs, and Linux forensics.

     • Adds Cortex Agentic Assistant (native MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support in Beta) allowing trusted LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. apps to connect to XSIAM using natural language prompts
     • Adds Federated Search in Cortex Extended Data Lake (XDL) enabling seamless querying across external datasets in AWS, GCP, or Azure via XQL without ingestion
     • Adds Forensics for Linux support for complete investigations with deeper artifact collection from Linux endpoints
     • Allows adjusting the severity of alerts generated by built-in analytics rules through Flexible Customization for Analytics Rules
     • Enhances SBAC to define Asset Groups using the Business Application Names attribute for scoping definitions

     +36 more show less

     • Adds new SBAC support for dataset rows, granting SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams access only to relevant row data in XQL queries and custom widgets
     • Exposes User and role APIs to manage user roles, update API keys, and add or remove role/scope assignments programmatically
     • Adds Attack Surface Testing Intrusiveness Levels to adjust the intensity of exposure checks
     • Adds Alerts for Attack Surface Testing misconfiguration findings to identify risks from confirmed positive misconfigurations
     • Adds a new Attack Surface Management dashboard providing a visual overview of the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources.
     • Improves Global Lookup by allowing queries for certificate hashes (MD5, SHA1, SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.) in addition to IPs and domains
     • Enables auto-populating command and Quick Action parameters from any Unified Asset Inventory (UAI) attribute on demand
     • Allows dismissing alerts for non-configured playbook components (sub-playbooks, scripts, commands) without editing system playbooks
     • Adds Recommended Quick Actions providing contextual automation recommendations within issue response workflows
     • Enables drag-and-drop functionality for building and organizing automation flows in playbooks
     • Adds AI Script Generator with a built-in testing panel to validate Python code generated from natural language
     • Allows choosing an integration instance for Quick Actions when running them on demand or via automation rules
     • Adds Automation health issues to quickly identify and resolve potential automation configuration problems
     • Enhances Automation Exclusion Center with support for asset groups, dynamic matching operators, and role-based permissions for policy management
     • Enhances Broker VM with error visibility/logging in the collection_auditing dataset for FTP, Netflow, Network Mapper, and Kafka collectors
     • Adds a new Only use recommended cipher suites setting in Broker VM Advanced Settings to comply with Spain’s ENS
     • Adds a Replace Storage Method option for Database Collector Snapshot datasets to overwrite existing data
     • Sets a new default query limit of 60 minutes in XQL, overridable using the max_runtime_minutes command
     • Fixes lookup dataset queries so the _time field is not included by default unless explicitly added via the fields stage
     • Adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows Disguised Processes analytics suite to detect process masquerading
     • Adds EDR Linux Credential Grabbing analytics suite to identify uncommon access to sensitive credential files
     • Adds EDR macOS Generic Persistence analytics suite to detect unusual persistence mechanisms on macOS
     • Adds Microsoft Teams Analytics suite to detect attack attempts within Microsoft Teams using dynamic baselines
     • Expands DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Hijacking Analytics coverage to include Microsoft process hijacking and DLL sideloading detection logic
     • Adds New Advanced Email Security response engine for automated, policy-driven remediation of email threats
     • Adds File examination on-load for macOS to detect/prevent malicious Mach-O file execution
     • Adds JScript file examination for Windows to detect/prevent malicious JScript file execution/disk writes
     • Adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Query Protection for Windows using XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent for real-time prevention against domain controller reconnaissance
     • Adds Child Process Protection module for Linux to examine parent/child process relations
     • Adds support for Cortex XDR Agent on Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. devices including Microsoft Surface
     • Adds Cortex XDR Security Controls Detection to gain visibility into XDR agent profile configurations and exploit protection status
     • Enhances Cortex Network Scanner with Multi-scanner support, Target Groups management, Multiple credentials configuration, and Credential testing
     • Unifies integration error notifications for External Data Ingestion into a single non-dismissible alert
     • Adds Cortex Vulnerability Block Grace Period to temporarily override blocking actions for new vulnerabilities based on fixed dates or severity
     • Introduces Cortex Vulnerability Risk Score (CVRS) as a dynamic risk-scoring approach for prioritizing vulnerabilities
     • Enhances Vulnerability Management UI with side-panel insights, right-click quick actions, CSV export, and node-specific vulnerability tabs

     41 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Sample Analysis page under Threat Management > Threat Intelligence has been removed.
     • !The Sessions & Submissions page under Threat Management > Threat Intelligence has been removed.
     • !The Unit 42 Intel tab within the indicator details page has been removed and legacy Unit 42 library search is deprecated.
     • !The AutoFocus integration option has been removed from the Threat Intelligence screen under Settings due to deprecation.
     • !AutoFocus data will no longer appear in cases or issues.
     • !The Simulated Compute Units field has been deprecated in Query Center.
137. Prisma Access 5.0 Preferred Innovation: ZTNA Connector Wildcard and FQDN Support for Applications and Additional Diagnostic Tools Nov 2025 · release notes

     Prisma Access adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. app definitions using FQDN wildcards/IP subnets and new diagnostics (packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., dump overview)

     • Adds support for defining Prisma Access ZTNA applications using FQDN wildcards and IP subnets.
     • Adds dump overview, packet captures, and tech support diagnostic tools to the ZTNA Connector.
     • Enables application probes for FQDNs resolving to multiple private IPs to load balance across resolved addresses.

     3 details in Everything

138. Prisma Access 6.1 Preferred Innovation: CloudHSM Support on Prisma Access Nov 2025 · release notes

     Prisma Access 6.1 adds CloudHSM support to store SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. decryption CA private keys externally.

139. Prisma Access 6.1 Preferred Innovation: Audio Passthrough for Privileged Remote Access RDP Sessions Nov 2025 · release notes

     Adds audio passthrough for RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions in Prisma Access Privileged Remote Access profiles.

     • Enables audio passthrough in a Privileged Remote Access (PRA) profile to allow audio from the remote RDP server to be heard on the user's device

     1 detail in Everything

140. Prisma Access 6.1 Preferred Innovation: Remote Networks Enhanced with Non-IPsec Support Nov 2025 · release notes

     Prisma Access 6.1 adds SP Interconnect option for Remote Networks to enable native IP connectivity without IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnels

141. Prisma Access 6.1 Preferred Innovation: SASE Private Location Nov 2025 · release notes

     Prisma Access 6.1 adds SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. Private Location for deploying services within customer infrastructure

     • Adds SASE Private Location deployment model to run Prisma Access gateways locally behind load balancers while keeping the GlobalProtect portal in the cloud.
     • Enables agent-based Mobile Users deployment within a private data center environment for compliant processing of network traffic and security functions.

     2 details in Everything

142. Prisma Access 6.1 Preferred Innovation: Additional Prisma Access Locations Nov 2025 · release notes

     Prisma Access adds eight new global locations in 6.1 Preferred Innovation

     • Adds support for Colombia Central (Chia) Prisma Access location
     • Adds support for France South East (Marseille) Prisma Access location
     • Adds support for India South Central (Hyderabad) Prisma Access location
     • Adds support for Israel Central (Jerusalem) Prisma Access location
     • Adds support for Mexico Northeast (Monterrey) Prisma Access location

     +3 more show less

     • Adds support for Saudi Arabia West (Jeddah) Prisma Access location
     • Adds support for US Midwest (Chicago) Prisma Access location
     • Adds support for US West Central (Phoenix) Prisma Access location

     8 details in Everything

143. Cortex XSOAR 8 SaaS: November 2025 Nov 2025 · release notes

     Cortex XSOAR 8.12 adds conflict-free playbook editing, unique task logos, and a Unit 42 Threat Intelligence content pack.

     • Adds conflict-free concurrent playbook editing to prevent workflow conflicts during team collaboration
     • Introduces unique visual logos for playbook tasks to distinguish integration commands, custom scripts, and system actions with content pack indicators
     • Releases a new Unit 42 Threat Intelligence content pack providing high-value integrations, replacing deprecated AutoFocus and Unit 42 ATOMs Feed packs

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Sample Analysis tab on the Threat Intel page has been removed
     • !The Sessions and Submissions tab on the Threat Intel tab has been removed
     • !The Unit 42 Intel tab on the indicator details page has been removed
     • !Indicator search in the legacy Unit 42 library is deprecated
144. Prisma Cloud: Features Introduced in November 2025 Nov 2025 · release notes

     Prisma Cloud adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 support and improves Alma Linux CVE integration.

     • Adds full support for RedHat Enterprise Linux 10 in Secure the Runtime.
     • Uses CISA-ADP secondary scores as fallback when NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. primary scores are unavailable.

     2 details in Everything

145. Cortex Analytics: 2025.10.08 Oct 27, 2025 · release notes

     Cortex Analytics 2025.10.08 adds detections for impaired logging, hidden BCCs, and masquerading processes.

     • Adds 2 new Medium Analytics BIOCs for 'Logging was impaired via external encryption key' and Suspicious HTTP parameters detected.
     • Adds 20 new Informational Analytics BIOCs covering process masquerading, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshot creation, Windows system folder moves, hidden BCC emails, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. instance profile associations, and homograph characters in attachments.
     • Adds 2 new Informational Analytics Alerts for 'A compromised process accessed a rare cloud resource' and 'Abnormal connections to a dormant host from a newly seen endpoint'.
     • Removed the Possible Microsoft process masquerading Low Analytics BIOC.

     4 details in Everything

146. PAN-OS 10.2: Automatic Certificate Renewal for Passive HA Devices Oct 2025 · release notes

     PAN-OS 10.2 adds automatic certificate renewal on passive HA devices via the HA interface.

     └──▷ TRY IT
     Verify a passive device has successfully renewed its certificate after failover or automatic renewal.
     copy

     $ show device-certificate status

     • Passive HA devices now receive certificate updates and renewals through their HA interface connected to the active device when service routes are configured.

     1 detail in Everything

147. Prisma Access 6.1 Preferred Innovation: Selective Acceleration by Port Oct 2025 · release notes

     Prisma Access 6.1 adds selective port control to App Acceleration

148. PAN-OS 11.1: PPPoE Client for IPv6 Oct 2025 · release notes

     PAN-OS 11.1 adds PPPoE client support for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. on Ethernet Layer 3 interfaces.

     • Enables dynamic IPv6 address acquisition via stateful or stateless DHCPv6 on PPPoE interfaces

     1 detail in Everything

149. Prisma Cloud: Features Introduced in October 2025 Oct 2025 · release notes

     Prisma Cloud adds two new Azure policies for flow logs and Entra-only auth in the October 2025 release.

     └──▷ TRY IT
     Detect if an Azure Virtual Network has network flow logging disabled to prevent blind spots in traffic monitoring.
     copy

     $ config from cloud.resource where api.name = 'azure-network-vnet-list' AND json.rule = ['properties.provisioningState'] equal ignore case Succeeded AND flowLogs[*].id does not exist

     Check if an Azure SQL Server is configured to use Entra-only authentication, reducing the risk of legacy credential attacks.
     copy

     $ config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = ['sqlServer'].['properties.state'] equal ignore case ready and (['sqlServer'].['properties.administrators'].['azureADOnlyAuthentication'] is false or ['sqlServer'].['properties.administrators'].['azureADOnlyAuthentication'] does not exist)

     • azure-network-vnet-list API ingestions now expose properties.encryptionProtector and properties.encryptionProtectorAutoRotation fields for Azure SQL Database resource JSON.
     • azure-security-center-settings API ingestion removes deprecated permissions from the CFT template to align with latest Azure API requirements.
     • gcloud-ai-applications-cmek-config API ingestion adds new required permission discoveryengine.cmekConfigs.list for Google AI Applications service.
     • New policy check Azure Network Watcher virtual network flow log is disabled detects absence of network flow logging in Azure Virtual Networks using the azure-network-vnet-list API.
     • New policy check Azure SQL Server not using Entra-only authentication detects legacy authentication methods on Azure SQL Server by checking the sqlServer.properties.administrators.azureADOnlyAuthentication field.

     +9 more show less

     • Updated RQL for Azure Microsoft Defender for Cloud disk encryption monitoring now checks gcLinuxDiskEncryptionMonitoringEffect and gcWindowsDiskEncryptionMonitoringEffect parameters instead of diskEncryptionMonitoringEffect.
     • Updated RQL for Azure Microsoft Defender for Cloud system updates monitoring now checks systemUpdatesV2MonitoringEffect parameter instead of systemUpdatesMonitoringEffect.
     • Updated RQL for Azure Microsoft Defender for Cloud security contact additional email now correctly references securityContacts[?any(properties.emails is empty)] instead of properties.email.
     • Updated RQL for Azure App Service web apps with public network access now includes logic to consider privateLinkIdentifiers to reduce false positives and checks for IP rules allowing 0.0.0.0/0.
     • Updated RQL for Azure Network Watcher NSG flow logs retention now ensures flowLogsSettings.retentionPolicy.days exists before evaluating the 90-day threshold.
     • Updated RQL for Azure Network Watcher NSG flow logs disabled now requires flowLogsSettings.storageId to be non-empty before checking if logging is enabled.
     • Updated RQL for GCP Cloud Run function using default service account now uses state equals ACTIVE instead of status equals ACTIVE for the gcloud-cloud-function-v2 API.
     • Updated RQL for GCP PostgreSQL log_min_error_statement flag ensures the database flag exists before checking its value against allowed members.
     • Updated RQL for GCP PostgreSQL log_min_messages flag ensures the database flag exists before checking its value against allowed members.

     14 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The azure-security-center-settings API ingestion no longer includes the autoProvisioningSettings[*] field in the JSON resource as it is unsupported by the Azure API.
     • !Three Azure Defender policies (adaptive application controls, endpoint protection, and security configurations monitoring) have been deleted.
150. Prisma Access 6.1 Preferred Innovation: Static IP Address Allocation with User Geolocation Oct 2025 · release notes

     Prisma Access 6.1 introduces static IP assignment linked to user geolocation for tighter access control.

151. Cortex Analytics: 2025.09.03 Sep 17, 2025 · release notes

     Cortex Analytics adds detection for Mshta.exe spawning from browsers and rare domain access.

     • Adds 4 new Low severity Analytics BIOCs to detect suspicious executable behavior
     • Adds 14 new Informational Analytics BIOCs covering cloud identity and infrastructure activities
     • Decreases severity of the 'Modification of NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. restrictions in the Registry' BIOC from Medium to Informational

     3 details in Everything

152. Cortex Analytics: 2025.08.13 Sep 2, 2025 · release notes

     Cortex Analytics adds detection coverage for Right-to-Left Override in email attachments and BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..

     • Added a new Low Analytics BIOC to detect email attachments with Right-to-Left Override Unicode characters
     • Added a new Informational Analytics BIOC for BigQuery table or query results exfiltrated to a foreign project
     • Added a new Informational Analytics BIOC for an unusual cloud identity granted permissions to a BigQuery resource

     3 details in Everything

153. PAN-OS 11.2: IPv6 Support on Cellular Interface for PA-415-5G Firewall Sep 2025 · release notes

     PAN-OS 11.2 adds dynamic IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addressing and dual-stack support on the PA-415-5G cellular interface.

     • Supports dynamic IPv6 addressing on the cellular interface of the PA-415-5G firewall, allowing the device to obtain a dynamic IPv6 prefix from the provider.
     • Enables dual-stack configuration on the cellular interface for the PA-415-5G, supporting both IPv4 and IPv6 traffic over the same interface.

     2 details in Everything

154. PAN-OS 11.1: Inbound Policy Rule Recommendations for Device Security Sep 2025 · release notes

     PAN-OS 11.1 adds inbound policy rule recommendations for Device Security

     • Appends -inbound to the naming convention for generated inbound policy rule recommendations.

     1 detail in Everything

155. Cortex XSOAR 8 On-premises: Maintenance Releases in Cortex XSOAR 8.10: August 25, 2025 Aug 25, 2025 · release notes

     Cortex XSOAR 8.10 On-premises fixes multi-tenant incident tab issues and raises upload limit to 25MB

     • uploadfile command and upload API request now support file uploads up to 25MB.

     1 detail in Everything

156. Prisma Cloud Compute Edition: 34.02 (Build 34.02.133) Aug 10, 2025 · release notes

     Prisma Cloud Compute 34.02 adds COLLECT_POD_RESOURCE_LABELS env var for pod labels, multi-container CAAS support, and extends API field limits.

     • Adds COLLECT_POD_RESOURCE_LABELS environment variable to Orchestrator defenders for collecting pod labels alongside deployment/namespace labels
     • Adds support for multi-container CaaS deployments on ACI container groups, Google Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Amazon EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. on AWS Fargate with account ID attribution
     • Extends OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. tag-based filtering to compartment level

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Defenders prior to version 31.00 are no longer supported or functional; failure to upgrade Defenders below release v31 results in disconnection from the Console.
157. Cortex Analytics: 2025.07.16 Aug 4, 2025 · release notes

     Cortex Analytics adds new detection logic for ingress-nginx service-account token access and uncommon net localgroup execution

     • Adds a new High Analytics Alert detecting an unusual process in ingress-nginx accessing a service-account token file
     • Adds a new Informational Analytics BIOC detecting uncommon net localgroup command execution

     2 details in Everything

158. PAN-OS 12.1: PAN-OS System Certificates Aug 2025 · release notes

     PAN-OS 12.1 adds a centralized UI view for all internal PAN-OS system certificates under Device > Certificate Management.

     • Enables review of certificate details, expiration dates, and status for system certificates without navigating to multiple sections.
     • Adds automatic dynamic updates for the Certificate Authority Trust Store and PAN-issued certificates.

     2 details in Everything

159. Prisma Access 6.0 Preferred Innovation: ZTNA Connector: Scalability Improvements Aug 2025 · release notes

     ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector scalability enhancement for Prisma Access 6.0

     • Increases ZTNA Connector onboarding limit to 20,000 applications per tenant across all Connector Groups.

     1 detail in Everything

160. PAN-OS 12.1: Automatic Retrieval of Intermediate Certificates Aug 2025 · release notes

     PAN-OS 12.1 adds automatic intermediate certificate retrieval for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy connections.

     • Enables automatic fetching of missing intermediate certificates during SSL Forward Proxy TLS handshakes using the Authority Information Access (AIA) extension
     • Caches retrieved intermediate certificates for up to one week and allows recursive fetching of up to three levels to build a chain to a trusted root CA
     • Populates the Server Certificate Status field in decryption logs with visibility into certificate fetching results

     3 details in Everything

161. PAN-OS 12.1: Secure Authentication to Network Time Protocol (NTP) Servers with SHA-256 and SHA-512 Aug 2025 · release notes

     PAN-OS 12.1 adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. and SHA-512 symmetric key authentication for NTP servers.

162. PAN-OS 12.1: Advanced Device-ID Aug 2025 · release notes

     PAN-OS 12.1 adds Advanced Device-ID with legacy, hybrid, and advanced modes for granular asset grouping in policy rules

     • Adds Advanced Device-ID operational modes: legacy, hybrid, and advanced to transition from existing implementation
     • Enables creation of complex Device-ID objects using multiple asset categories, OS types, and attributes for precise policy targeting
     • Supports grouping multiple Device-ID objects together in security policy rules to streamline management

     3 details in Everything

163. PAN-OS 12.1: High Availability Firewall Pair Upgrade Orchestration from Panorama Aug 2025 · release notes

     PAN-OS 12.1 adds automated HA firewall pair upgrade orchestration from Panorama

     • Adds High Availability (HA) Firewall Pair Upgrade Orchestration feature in Panorama to automate the sequential upgrade and reboot of active/passive firewall pairs, supporting up to 200 pairs per workflow job.
     • Requires Panorama 12.1.2+ and HA firewalls running PAN-OS 10.2.0+ for the new orchestration capability.

     2 details in Everything

164. PAN-OS 12.1: Enhanced Packet Capture with Support for Range Filters Aug 2025 · release notes

     PAN-OS 12.1 adds range filters to custom Packet Captures for IPs, ports, and protocols

     • Adds IP address range filtering in custom PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. using a dash to specify source or destination subnets or specific IP ranges
     • Adds port range filtering in custom PCAPs using a dash to define source or destination port boundaries
     • Adds protocol range filtering in custom PCAPs using a dash to specify a contiguous block of protocols

     3 details in Everything

165. PAN-OS 12.1: Device Security Settings Aug 2025 · release notes

     PAN-OS 12.1 adds Device Security Settings to auto-enter maintenance mode on IMA violations.

     • Adds Device Security Settings feature to handle system-level security violations detected by Integrity Measurement Architecture (IMA).

     1 detail in Everything

166. PAN-OS 12.1: Simplified HA Device Configuration in SD-WAN Aug 2025 · release notes

     PAN-OS 12.1 introduces simultaneous HA peer addition in SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. device configuration UI

     • Adds option to add an HA peer simultaneously when adding a device to SD-WAN Devices via the console UI
     • Enables automatic configuration propagation from one SD-WAN device to its HA peer
     • Prevents separate configuration of HA devices in SD-WAN, guiding users to add them as pairs

     3 details in Everything

167. PAN-OS 12.1: Log Collector Scaling Optimization Aug 2025 · release notes

     PAN-OS 12.1 adds manual master node selection for Log Collector Groups to improve scaling and failover predictability.

     • Enables explicit configuration of master-eligible Log Collector nodes to replace dynamic election, improving performance in large deployments.
     • Supports log ingestion scaling up to over 1 million logs per second (lps) for Collector Groups using up to 16 M-700 appliances.

     2 details in Everything

168. PAN-OS 12.1: Post-Quantum Cryptography (PQC) Support for TLSv1.3 Inline Decryption Aug 2025 · release notes

     PAN-OS 12.1 adds post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA.) support for TLSv1.3 inline decryption in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy and Inbound Inspection profiles.

     • Adds support for PQ KEMs in decryption profiles to secure TLSv1.3 sessions for SSL Forward Proxy, SSL Inbound Inspection, Decryption Mirror, and Network Packet Broker features
     • Enables NGFWs to act as cipher translation proxies, translating between PQC and classical encryption for applications not yet post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. ready

     2 details in Everything

169. PAN-OS 12.1: Comprehensive Decryption Log Fields and Error Messages Aug 2025 · release notes

     PAN-OS 12.1 adds client/server-prefixed decryption log fields and new error messages for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy.

     • Decryption logs now distinguish between client-side and server-side sessions using client or server prefixed fields.
     • New log fields record decryption status, reasons for exclusion, and certificate revocation status (OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists./CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live.).
     • Simplified existing error messages and added new ones to help identify critical decryption issues.

     3 details in Everything

170. PAN-OS 12.1: Enhanced Shared Optimization Aug 2025 · release notes

     PAN-OS 12.1 adds Full optimization mode to streamline shared object management in Panorama.

     • Introduces Full optimization mode to move firewall objects into the shared location.

     1 detail in Everything

171. PAN-OS 12.1: Security Enhancements Aug 2025 · release notes

     PAN-OS 12.1 adds Integrity Measurement Architecture (IMA) to protect binaries and log violations, with options to continue or reboot on detection.

     • Adds Integrity Measurement Architecture (IMA) to enforce cryptographic signing of binaries and protect against runtime exploitation
     • Enables configuration of IMA violation response to either continue logging or reboot into maintenance mode via system settings

     2 details in Everything

172. PAN-OS 12.1: Optimized Global Find and Policy Management Aug 2025 · release notes

     PAN-OS 12.1 adds optimized Global Find with batched results and explicit UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide./Template filtering.

     • Adds Search UUIDs and Include Template References options to the Global Find UI for targeted searches
     • Policy Management columns (Rule Usage, App Usage) and Policy Optimizer are hidden by default after upgrade, fetching data only when explicitly made visible

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !After upgrading to PAN-OS 12.1, the Rule Usage, App Usage columns and Policy Optimizer in Policy Management are hidden by default
173. PAN-OS 12.1: Enhanced Application Logs for ICMPv6 Aug 2025 · release notes

     Adds ICMPv6 NDP Enhanced Application Logs for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. device visibility and Device-ID support

     └──▷ USE IT
     Disable ICMPv6 EAL logs to prevent log flooding in high-volume IPv6 environments.
     shell copy

     set deviceconfig setting logging enhanced-application-logging disable-global icmpv6-ndp

     • Enables set deviceconfig setting logging enhanced-application-logging disable-global icmpv6-ndp to disable ICMPv6 EAL logging in high-volume deployments
     • Enables delete deviceconfig setting logging enhanced-application-logging disable-global icmpv6-ndp to re-enable ICMPv6 EAL logging for IPv6 Device-ID classification

     2 details in Everything

174. Prisma Access 6.0 Preferred Innovation: New Region Support for ZTNA Connector Aug 2025 · release notes

     Prisma Access 6.0 Preferred Innovation adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector support for mainland China and South Africa regions.

     • ZTNA Connector now provides secure and compliant multi-national enterprise level communication within and across mainland China (requires Prisma Access China L2 add-on license).
     • South Africa is also added as a supported location for ZTNA Connector.

     2 details in Everything

175. Prisma Access 6.0 Preferred Innovation: Regional Support for ZTNA Connector Aug 2025 · release notes

     Prisma Access ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector now supports South Africa as a deployment region

     • Adds South Africa as a supported location for the ZTNA Connector

     1 detail in Everything

176. PAN-OS 12.1: Passwordless Authentication Aug 2025 · release notes

     PAN-OS 12.1 introduces passwordless authentication to delegate tickets and reduce login friction.

     • Enables passwordless authentication in PAN-OS 12.1 to delegate tickets on behalf of authenticated users

     1 detail in Everything

177. PAN-OS 12.1: Dedicated Tunnels for Panorama Connectivity Aug 2025 · release notes

     PAN-OS 12.1 adds Dedicated Tunnels for Panorama Connectivity via direct internet access interfaces.

     • Enables configuration of primary and secondary termination devices with preferred and secondary DIA interfaces for redundant connectivity paths when Panorama lacks a public IP address.

     1 detail in Everything

178. PAN-OS 12.1: Plugin Bundling Aug 2025 · release notes

     PAN-OS 12.1 introduces Plugin Bundling to automate plugin management during upgrades.

     • Automates plugin management by bundling compatible plugins with the base image to eliminate version mismatches and configuration loss during upgrades
     • Provides a unified Plugins interface to manage all bundled plugins, including sorting and installation options
     • Adds a dedicated section for managing Cloud Services within the Plugins interface if the required license is present

     3 details in Everything

179. Prisma Cloud: Features Introduced in August 2025 Aug 2025 · release notes

     Prisma Cloud adds COLLECT_POD_RESOURCE_LABELS env var, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. compartment filters, ACI/Run/Fargate support, new RQL, and API field length updates.

     • Adds COLLECT_POD_RESOURCE_LABELS environment variable to Orchestrator defenders for collecting pod labels via the Kubernetes API.
     • Adds account ID attribution and defended/undefended status detection for ACI container groups, Google Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Amazon EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. on AWS Fargate.
     • Extends OCI tag-based filtering to support compartment-level include/exclude filters for hosts.
     • Adds new API ingestion connectors for alibaba-cloud-network-attach-storage and aws-connect-outbound-campaign.
     • Updates RQL policies for Azure WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., Cosmos DB, Storage Account public access, AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. TLS policy, and GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. CMEK encryption.

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Prisma Cloud will no longer ingest metadata for azure-mysql-server and azure-postgresql-server APIs, removing these assets from the Investigate page and resolving existing alerts as Resource_Deleted.
180. PAN-OS 12.1: Server Certificate Verification Bypass for SSL Forward Proxy Aug 2025 · release notes

     PAN-OS 12.1 adds Bypass Server Certificate Verification to SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy decryption profiles.

181. PAN-OS 11.2: Dedicated Tunnels for Panorama Connectivity Aug 2025 · release notes

     PAN-OS 11.2 adds Dedicated Tunnels to Panorama for non-public IP deployments.

     • Allows configuration of primary and secondary termination devices with preferred and secondary DIA interfaces for redundant connectivity paths to Panorama.
     • Introduces a separate VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. address pool dedicated to tunnel IP address assignments that must not overlap with existing SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. overlay configurations.

     2 details in Everything

182. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: 8.10 GA 2025-07-30 Jul 30, 2025 · release notes

     Cortex XSOAR 8.10 adds new API capabilities for cloning playbooks, uploading files, and managing ROI widgets.

     • Adds clone action to the Playbook API to duplicate existing playbooks within automated incident workflows.
     • Adds file upload endpoint to the Integration API for pushing files directly into XSOAR instances.
     • Adds endpoints to reset the ROI widget and update or retrieve list configurations via API.

     3 details in Everything

183. Cortex Analytics: 2025.07.09 Jul 21, 2025 · release notes

     Palo Alto Cortex Analytics adds 9 new detections across Medium/ Low severity BIOCs and Alerts.

     • Adds the Suspicious dNSHostName attribute change to DC name BIOC to detect directory service manipulation attempts against domain controllers.
     • Adds five new low-severity Analytics BIOCs: A commonly abused process connected to a rare cloud resource, A commonly abused process connected to a rare external cloud resource, Rare binary connected to a rare cloud resource, Rare binary connected to a rare external host, and Unusual Process Spawned by Nginx in Ingress-Nginx pod.
     • Adds two new low-severity Analytics Alerts for Microsoft 365 storage services exfiltration activity and Multiple user accounts failed login due to account lockouts.
     • Adds two informational Analytics BIOCs detecting AppleScript interpreter dynamic library loaded into a process and Uncommon sensitive filesystem registry hive access.
     • Adds five informational Analytics Alerts covering IP Rotation Pattern in SSO Spray, Possible Impossible Travel Pattern - SSO, Possible Privilege Escalation using Delegated MSA account, SCCM log files enumeration, and Single account excessively locked out.

     5 details in Everything

184. PAN-OS 11.1: GRE Tunnel over a Cellular Interface Jul 2025 · release notes

     PAN-OS 11.1 adds GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnel support over cellular interfaces for dynamic IP connectivity

     • Adds GRE tunnel support over the PAN-OS cellular interface to connect remote IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. devices via mobile headends.
     • Enables GRE tunnel configuration with dynamic IP addressing for IPv4 endpoints on cellular networks.

     2 details in Everything

185. Cortex XSIAM: July 2025 Jul 2025 · release notes

     Cortex XSIAM 3.2 adds API Security scanning, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./VNET ingestion, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions, and more

     • Adds Create Distributions API support for Kubernetes installations to automate agent deployment
     • Introduces the Identity Security Access Table Data API for retrieving detailed access information with filters
     • Adds new public APIs for managing Cases and Issues, including creating and updating issues externally
     • Introduces Unified Asset Inventory APIs with powerful filtering capabilities for on-premises and cloud assets
     • Adds APIs to get, create, delete (including in bulk) API keys for granular key management

     +23 more show less

     • Adds new Application Security public APIs for programmatic management of data sources, rules, policies, and scans
     • Enhances API Security with automatic identification and extraction of API specifications from AWS and Azure API gateways
     • Adds F5 BIG-IP LTM as a new integration option for API security visibility
     • Integrates DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.'s unified cross-platform data sensitivity scanning engine into API endpoint traffic analysis
     • Supports IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. in Attack Surface Management to discover and protect IPv6 services
     • Enables full 65k port dynamic protocol detection for improved service discovery across all IPv4 ports
     • Adds new Attack Surface Rules to identify internet-facing applications leaking credential information
     • Adds Digital Risk Protection rules for leaked credential and brand risk domain discovery in ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.
     • Enables OCI support for visibility and governance over Oracle Cloud Infrastructure environments
     • Adds VNET flow log support for Azure Network Watcher
     • Allows exporting filter JSON directly from the UI to simplify public API integration calls
     • Introduces new XQL IP functions for validating IPv4/IPv6 addresses and checking if they are private IPs
     • Adds Automation Exclusion Center for centralized policies excluding assets from automated remediation
     • Streamlines cloud automation by integrating Terraform configuration into the AWS/GCP/Azure onboarding process
     • Adds new Network Scanner Broker VM applet for internal network security asset and vulnerability assessment
     • Adds Unified Identity Inventory with dedicated sections for investigating cloud, enterprise, and code domains
     • Enhances Graph Search (Beta) to track assets with internet exposure and their exposure paths
     • Adds EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Windows C2 Analytics detection suite for C2 and exfiltration traffic visibility
     • Adds EDR Linux Shell Analytics detection suite for abnormal Linux shell executions
     • Adds EDR MacOS Shell Analytics detection suite for unusual spawned macOS shells
     • Improves NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Lateral Movement Analytics with richer application logging and protocol-based context
     • Expands EDR macOS AppleScript Analytics to detect suspicious executions loading AppleScript dylibs
     • Supports header-based authentication in Generic Webhook Integrations for external data ingestion

     28 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Broker VM Pathfinder applet is deprecated and can no longer be activated in new tenants or existing tenants that have never implemented it before; if previously implemented, it remains available until January 25, 2026.
     • !Broker VM agent installer and content caching minimum requirements changed: processor must be at least 8-core and disk requirement increased to 1024 GB (previously 512 GB).
186. Cortex XDR 5.x: July 2025 Jul 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 4.2 adds Advanced Email Security, Linux kernel module scanning, macOS network inspection, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions, and several public APIs.

     • Introduces Advanced Email Security with an AI-driven analytics engine for real-time email attack detection and automated remediation.
     • Adds Kernel module examination in Linux to detect and prevent attacks by scanning Linux kernel modules at load time.
     • Enhances driver threat prevention for Windows to detect and block privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. attempts via user-to-kernel interactions.
     • Adds Network Packet Inspection for macOS to detect and prevent malicious network activity from macOS endpoints.
     • Allows setting automatic upgrade schedules for each endpoint profile to control agent upgrades.

     +23 more show less

     • Adds Extended Scope-Based Access Control (SBAC) to specify which groups of assets users can access and actions they can perform.
     • Adds Export filter JSON from the UI to ease writing API calls by exporting proprietary JSON filter objects directly from the interface.
     • Supports German healthcare data control with strict data privacy and service localization controls in the Cortex XDR cloud region for Germany.
     • Adds Cases and Issues public APIs for listing/updating cases, accessing related issues/assets/artifacts, and listing/creating/updating issues.
     • Updates Create Distributions API to support Kubernetes installations for agent deployment automation.
     • Introduces Identity Security Access Table Data API (CIEM Access Table Data API) to retrieve detailed access information using filters.
     • Adds Unified Asset Inventory APIs with powerful filtering capabilities for on-premises and cloud asset data.
     • Adds public API endpoints for managing API keys (get, create, delete in bulk).
     • Enhances Cortex API security with endpoint classification, automatic API spec extraction from AWS/Azure gateways, F5 BIG-IP LTM integration, and DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. unified data sensitivity scanning.
     • Introduces Automation Exclusion Center to configure centralized automation exclusion policies for assets.
     • Adds new analytics suites: EDR Windows C2 Analytics, EDR Linux Shell Analytics, and EDR MacOS Shell Analytics.
     • Improves NDR Lateral Movement Analytics and EDR macOS AppleScript Analytics with richer logging and expanded coverage.
     • Allows viewing the full list of detections behind analytics indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (BIOCs) in the console.
     • Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. support for visibility, compliance, and governance over Oracle Cloud Infrastructure assets.
     • Adds VNET flow log support for Azure Network Watcher.
     • Adds new XQL IP functions to verify valid IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses and identify known private IPs.
     • Adds ITDR Issues and Insights Navigation for reviewing ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions.-related issues with filtering and sorting.
     • Introduces Unified Identity Inventory with dedicated sections for cloud, enterprise, and code domains.
     • Enables cloud-based host policies based on cloud attributes like cluster name, region, and provider (requires agent 8.9+).
     • Adds detection of malicious VBScript files being written to disk (requires agent 8.9+).
     • Enhances Broker VM error visibility by logging applet status changes in the collection_auditing dataset.
     • Enforces licenses for Broker VM applets to ensure only purchased capabilities are available.
     • Deprecates the Broker VM Pathfinder applet (removal of activation for new tenants, existing support until 2026-01-25).

     28 details in Everything

187. PAN-OS 12.1: Zero Touch Provisioning Over Cellular Jul 2025 · release notes

     PAN-OS 12.1 adds Zero Touch Provisioning (ZTP) over cellular interfaces for remote deployments.

     • Enables ZTP to use cellular interfaces for automatic deployment and configuration of NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. devices in locations with limited or no traditional wired connectivity.
     • Supports multiple ZTP connectivity scenarios including cellular-only, ethernet-only, and hybrid connections.

     2 details in Everything

188. Cortex Xpanse Expander: Release 2.10 (July 2025) Jul 2025 · release notes

     Cortex Xpanse Expander 2.10 adds dynamic protocol detection for all 65k ports, new post-compromise detections, and AR attribution tags.

     • Adds dynamic port protocol detection across all 65k IPv4 ports to improve service discovery
     • Introduces Integrated Attack Surface Testing view in Threat Response Center for confirmed exploitability insights
     • Adds new post-compromise detections for Ransomware, Cryptojacking, and Webshells
     • Replaces Asset Tags and IPR Tags with automatic Attribution Reason (AR) tags
     • Enables new attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rules to identify internet-facing applications leaking credential information

     5 details in Everything

189. PAN-OS 11.1: Dedicated Tunnels for Panorama Connectivity Jul 2025 · release notes

     PAN-OS 11.1 adds Dedicated Tunnels for Panorama Connectivity via IPSec over DIA interfaces to eliminate SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. overlay dependency.

     • Adds Dedicated Tunnel to Panorama feature to establish persistent IPSec tunnels from branch devices to Panorama through designated termination devices using direct internet access (DIA) interfaces.

     1 detail in Everything

190. Cortex Cloud Runtime Security: July 2025 Jul 2025 · release notes

     Cortex Cloud Runtime Security 1.2 adds API security, CI/CD asset inventory, new APIs, and KSPMKSPMKubernetes Security Posture Management: a category of tooling that continuously audits Kubernetes clusters against configuration best practices and compliance policies to surface misconfigurations before attackers exploit them. support

     • Adds Kubernetes admission controller support to actively block deployments with malware or sensitive secrets.
     • Introduces Virtual Machine Image Scanning to detect vulnerabilities in x86-64 and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. VM disk images.
     • Expands Integrity monitoring via XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent to Linux, Windows, and Kubernetes environments for file/directory change detection.
     • Adds granular policy scoping using cluster-level scope and cloud metadata (name, region, provider).
     • Enables Container registry scanning via broker VM for self-hosted registries without external exposure.

     +39 more show less

     • Introduces Enhanced container image modeling to distinguish core, build, registry, and runtime images.
     • Expands KSPM coverage to managed OpenShift and self-managed Kubernetes (non-OpenShift) environments with built-in CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks.
     • Adds Agentless Scanning for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. and ARM64 Container Images and VM Instances.
     • Introducing Cloud Attack Surface Management (ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.) to discover unmanaged assets across AWS, Azure, and GCP.
     • Expands Amazon SageMaker support in AI Security for asset inventory and supply chain protection.
     • Adds datasets inventory for training and inference datasets.
     • Adds MIP label integration for data classification prioritization.
     • Supports CosmosDB and GCP Bigtable data classification.
     • Adds Microsoft 365 support (SharePoint, OneDrive) for sensitive data visibility.
     • Introduces Custom Data Patterns based on regex, context words, and proximity in Data Classification.
     • Allows enabling or disabling specific data profiles in Data Classification.
     • Adds new Application Security APIs to programmatically automate scan management, policies, operational risk assessment, and third-party ingestion.
     • Adds Cases and Issues public APIs for listing/updating cases and creating/updating issues.
     • Extends Create Distributions API to support Kubernetes installations.
     • Introduces Identity Security Access Table Data API for advanced integration with detailed access information.
     • Provides Unified Asset Inventory APIs with powerful filtering capabilities.
     • Adds Compliance report and assessment APIs for listing, downloading, and deleting reports.
     • Provides APIs for managing API keys (get, create, delete, bulk delete).
     • Integrates Cortex API security with F5 BIG-IP LTM integration option.
     • Enhances Cortex API security to classify endpoints/sub-types and extract specs from AWS/Azure API gateways.
     • Adds Streamlined cloud automation configuration via Terraform for AWS, GCP, and Azure onboarding.
     • Introduces Automation Exclusion Center to define assets excluded from automated remediation.
     • Supports OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. as a new cloud platform in External Data Ingestion.
     • Adds VNET flow log support for Azure Network Watcher.
     • Adds Out-of-the-box compliance assessment profiles that kick off on module onboarding.
     • Enables Direct Docker image scanning with CWP CLI without intermediate archive files.
     • Supports File integrity monitoring add-on for Windows, Linux, and Kubernetes.
     • Enables Cloud-based host policies based on cloud attributes (cluster name, region, provider) in Cortex XDR agent 8.9.
     • Adds Linux packages in use detection (GO packages) with Cortex XDR agent 8.9.
     • Expands Graph Search (Beta) to investigate real-time runtime events and internet-exposed assets.
     • Adds New XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions for IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. verification and private IP checks in Cortex Query Language.
     • Introduces VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. Organizations, Collaborators, and CI/CD instances as distinct assets in the Unified Asset Inventory (UAI).
     • Expands CI/CD rules coverage to GitLab and Bitbucket with CIS GitHub, CIS GitLab, and CI/CD OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 benchmarks.
     • Adds SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. Package Operational Risk insights for dependency maintenance status.
     • Supports CI tools integration for code scanning in CI/CD pipelines (Terraform Cloud/Enterprise Run Tasks included).
     • Introduces new ASPMASPMApplication security posture management, combining findings about applications from multiple tools and relating them to business context. It helps teams decide which fixes matter most. Command Center for centralized application security risk visibility.
     • Adds Application asset inventory side card with lifecycle risk overview.
     • Supports Relationship table view for Cortex Cloud Identity Security assets.
     • Introduces Review Unused Permissions feature for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy analysis.

     44 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Broker VM Pathfinder applet is deprecated and can no longer be activated in new tenants; it will remain available until January 25, 2026.
     • !When using the Broker VM for the agent installer and content caching, you must use a minimum of an 8-core processor and increase the disk requirement to 1024 GB, instead of the previous 512 GB minimum requirement.
191. PAN-OS 11.2: Encrypted DNS for DNS Proxy and the Management Interface Jul 2025 · release notes

     PAN-OS 11.2 adds encrypted DNS (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring./DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows.) support for the DNS Proxy and Management Interface.

     • Enables encrypted DNS via DNS Proxy, supporting DNS-over-HTTP (DoH) and DNS-over-TLSDNS-over-TLSA protocol that wraps DNS queries inside a TLS connection on port 853, preventing eavesdroppers from reading or tampering with hostname lookups. Cyber tools use it to keep reconnaissance and C2 traffic from leaking in plaintext. (DoT)

     1 detail in Everything

192. PAN-OS 11.2: HTTP/2 Network Support Jul 2025 · release notes

     PAN-OS 11.2 adds HTTP/2 protocol support for the NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. management plane via new CLI configuration.

     • Enables manual HTTP/2 activation through the CLI with automatic disabling of HTTP/1.1 and no fallback capability

     1 detail in Everything

193. Prisma Cloud: Features Introduced in July 2025 Jul 2025 · release notes

     Prisma Cloud July 2025 adds Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. auth, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. tag ingestion, new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline./AESCSF benchmarks, and expanded Azure flow log coverage.

     • Support for Entra ID Authentication allows Microsoft Entra ID as an authentication method for Azure flow log ingestion.
     • azure-app-container-apps-managed-environment API integration ingests Azure Container Apps managed environments.
     • azure-fluid-relay-server API integration ingests Azure Fluid Relay server data.
     • azure-network-watcher-flowlogs API integration ingests Azure Network Watcher flow logs.
     • azure-signalrservice-web-pub-sub-diagnostic-settings API integration ingests Azure Web PubSub diagnostic settings.

     +6 more show less

     • Updated azure-app-container-apps API now appends authConfigs details to existing container app data.
     • oci-iam-tag-default API integration ingests OCI IAM tag defaults.
     • Australian Energy Sector Cyber Security Framework (AESCSF) V2 - Lite Framework is available on the Compliance > Standards page for self-assessment.
     • Support for CIS Microsoft Azure Foundations Benchmark v4.0.0 (Level 1 and Level 2) as a built-in compliance standard.
     • Support for CIS Amazon Web Services Foundations Benchmark v5.0.0 (Level 1 and Level 2) as a built-in compliance standard.
     • Support for CIS Google Cloud Platform Benchmark v4.0.0 (Level 1 and Level 2) as a built-in compliance standard.

     11 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Policy 'Azure Microsoft Defender for Cloud automatic provisioning of log Analytics agent for Azure VMs is set to Off' is deleted, resolving all associated alerts.
194. Cortex Cloud Posture Management: July 2025 Jul 2025 · release notes

     Cortex Cloud Posture Management 1.2 adds Cloud ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them., OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./M365/SageMaker support, generic SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. ingestion, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. GA, AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. CLI, new APIs, and more.

     • Adds Cloud Attack Surface Management module to scan for unmanaged assets and external services across AWS, Azure, and GCP.
     • Adds OCI support for visibility, compliance, and governance over Oracle Cloud Infrastructure environments.
     • Adds Microsoft 365 support to gain visibility into SharePoint and OneDrive sensitive data and detect misconfigurations.
     • Adds Amazon SageMaker support for AI asset inventory, risk insights, and supply chain protection.
     • Adds Trusted IP support to define trusted public networks and suppress internet exposure alerts for approved sources.

     +33 more show less

     • Adds Expanded network visibility and detection to view network configurations and detect outbound/east-west exposure for AWS EC2s.
     • Adds Generic SARIF Ingestion for SAST to centralize AppSec visibility from third-party sources outputting SARIF.
     • Adds Software Composition Analysis (SCA) GA providing vulnerability detection, license compliance, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation, and package operational risk.
     • Adds Application Security (AppSec) CLI as part of Cortex CLI for local scanning and CI steps.
     • Adds Cortex Cloud IDE plugin integration with VSCode and JetBrains for in-code IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., SCA, secrets, and license scanning.
     • Adds Identify inactive AI models detection to detect stale AI models.
     • Adds Enhanced custom rule support to create custom detections across identity, data, and AI rules.
     • Adds MIP label integration to use Microsoft Information Protection labels for prioritizing remediation.
     • Adds Extended Scope-Based Access Control (SBAC) to specify which groups of assets users can access and what actions they can perform.
     • Adds Extended Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.) with new roles in AI Security, Data Security, and Identity Security.
     • Adds Datasets inventory under AI Security to discover, investigate, and trace training and inference datasets.
     • Adds Data Classification - Custom Data Profiles feature to define and manage sensitive data precisely for files and tables.
     • Adds Data Classification - Custom Data Patterns to create custom sensitive data definitions based on regex, context words, and proximity.
     • Adds Data Classification - Enable/Disable Data Profiles to turn off custom and out-of-the-box profiles.
     • Adds CosmosDB data classification, Azure SQL Managed Instance data classification, AWS Redshift data classification, and GCP Bigtable data classification under Data Security.
     • Adds Tables in object inventory to see all tables in structured and semi-structured data assets.
     • Adds Relationship table view for Identity Security assets to show connections like group membership and role assumption.
     • Adds Review Unused Permissions feature to analyze audit logs and identify excessive permissions.
     • Adds Supply Chain tools inventory and control over VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. and CI/CD tools.
     • Adds VCS Organizations, Collaborators, and CI/CD instances as distinct assets in the Unified Asset Inventory (UAI).
     • Adds CI/CD risk-based policy management to create policies based on CI/CD risks.
     • Adds Software Composition Analysis (SCA) Package Operational Risk insights for open source dependencies.
     • Adds New Application Security APIs and ASPM public APIs for programmatic automation of scan management, policies, and operational risk assessment.
     • Adds New XQL IP functions to verify valid IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses and check if they are known private IPs.
     • Adds Graph Search enhancements (Beta) to investigate real-time activity and track assets with internet exposure.
     • Adds Cases and Issues public APIs for managing cases, issues, assets, and artifacts.
     • Adds Identity Security Access Table Data API for retrieving detailed access information using filters.
     • Adds Unified Asset Inventory APIs for comprehensive API access to asset information with powerful filtering.
     • Adds Compliance report and assessment APIs for listing, downloading, deleting reports, and retrieving assessments by ID.
     • Adds APIs for managing API keys endpoints to get, create, delete, and bulk delete API keys.
     • Adds Out-of-the-box compliance assessment profiles that kick off automatically upon module onboarding.
     • Adds Virtual Machine Image Scanning to detect vulnerabilities and misconfigurations in VM disk images.
     • Adds Container Registry Scanning via Broker VM to secure self-hosted container registries without external exposure.

     38 details in Everything

195. Cortex XSOAR 8 SaaS: July 2025 Jul 2025 · release notes

     Adds advanced search for playbooks/scripts, manual termination of incident exports, and enhanced Generic Webhook integration in XSOAR 8.11

     • Adds advanced search for playbook names, task names, script names, and third-party integration names to help find existing automation assets.
     • Adds ability to manually terminate ongoing scheduled or on-demand incident exports via the UI.
     • Enhances Generic Webhook integration with support for header-based authentication.

     3 details in Everything

196. Cortex XDR 3.x: July 2025 Jul 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.15 adds Linux kernel module examination, macOS network packet inspection, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. IP functions, and unified identity inventory.

     • Kernel module examination detects attacks by scanning Linux kernel modules at load time.
     • Create Distributions API now supports Kubernetes installations via the API endpoint.
     • Unified Identity Inventory provides dedicated sections for investigating cloud, enterprise, and code identities.

     3 details in Everything

197. Cortex Analytics: 2025.06.11 Jun 24, 2025 · release notes

     Adds low and informational analytics BIOCs/Alerts for phishing, SCCM registration, and SQL commands.

     • Added two new Low Analytics BIOCs: 'Office process spawned with suspicious command-line arguments' and Okta FastPass reported phishing attack suspected
     • Added a new Informational Analytics BIOC: Uncommon SQL like command line
     • Added a new Informational Analytics Alert: 'Microsoft Configuration Manager device registration and policy request'

     3 details in Everything

198. Cortex Analytics: 2025.06.04 Jun 18, 2025 · release notes

     Adds Potential DCSync by an unusual user and Uncommon access to cloud platforms sensitive files by a scripting engine' BIOCs

     • Improved logic of 7 High Analytics BIOCs including Copy a process memory file and Memory dumping with comsvcs.dll
     • Improved logic of 35 Medium Analytics BIOCs including 'Execution of the Hydra Linux password brute-force tool' and PowerShell runs suspicious base64-encoded commands
     • Improved logic of 101 Low Analytics BIOCs covering techniques like SUID/GUID permission discovery and Unusual AWS credentials creation
     • Improved logic of 5 Low Analytics Alerts for scenarios like Failed Connections and Multiple discovery commands
     • Improved logic of 90 Informational Analytics BIOCs covering behaviors like 'A LOLBIN was copied to a different location' and 'Cloud Unusual Instance Metadata Service (IMDS) access'

     +5 more show less

     • Improved logic of 7 Informational Analytics Alerts for events such as Massive file activity abnormal to process and Port Scan
     • Changed metadata of 3 Low Analytics BIOCs related to email safety indicators
     • Changed metadata of a Low Analytics Alert for Risk indicators detected in email
     • Changed metadata of 19 Informational Analytics BIOCs for email URL and attachment checks
     • Changed metadata of an Informational Analytics Alert for Suspicious theme and sentiment in email

     10 details in Everything

199. Cortex Analytics: 2025.05.21 Jun 3, 2025 · release notes

     Cortex Analytics adds new Low and Informational BIOCs/Alerts for RDS, S3, VNC, and email detection.

     • Adds An RDS snapshot was exported to an unknown S3 bucket Low Analytics BIOC
     • Adds An S3 replication policy to an unknown bucket was created Low Analytics BIOC
     • Adds Conhost.exe spawned a suspicious cmd process Low Analytics BIOC
     • Adds Rare process created an SSH session to an uncommon external host Low Analytics BIOC
     • Adds Rare process with VNC server capabilities started Low Analytics BIOC

     +13 more show less

     • Adds Uncommon VNC server communication Low Analytics BIOC
     • Adds Abnormal RPC traffic to multiple hosts Low Analytics Alert
     • Adds A new Azure email domain verification was requested Informational Analytics BIOC
     • Adds Cloud email sending was enabled Informational Analytics BIOC
     • Adds Cloud snapshot created or modified Informational Analytics BIOC
     • Adds Suspicious certificate template modification Informational Analytics BIOC
     • Adds Uncommon macOS shell command execution Informational Analytics BIOC
     • Adds Uncommon service stop operation Informational Analytics BIOC
     • Adds User signed in to an application via Power Automate for the first time Informational Analytics BIOC
     • Adds Web server CGO executed an uncommon process Informational Analytics BIOC
     • Adds Abnormal SMB scanning activity to multiple hosts Informational Analytics Alert
     • Adds Cloud email infrastructure enumeration activity Informational Analytics Alert
     • Adds Unusual SSH Activity Informational Analytics Alert

     18 details in Everything

200. Prisma Cloud: Features Introduced in June 2025 Jun 2025 · release notes

     Prisma Cloud adds AESCSF V2 compliance benchmark and updates RQL policy coverage for AWS ElastiCache, Azure Storage, and GCP PostgreSQL.

     • Adds support for the Australian Energy Sector Cyber Security Framework (AESCSF) V2 as a new built-in compliance standard accessible via Compliance > Standards
     • Updates the AWS ElastiCache Redis cluster with Redis AUTH feature disabled policy RQL to include RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Auth exclusion logic
     • Updates the Azure Storage Account default network access is set to 'Allow' policy RQL to handle missing publicNetworkAccess attributes

     3 details in Everything

201. Prisma Cloud Compute Edition: 34.01 (Build 34.01.126) May 18, 2025 · release notes

     Prisma Cloud Compute 34.01 adds host mount path monitoring, PDF exports, new agentless APIs, and env var configuration

     • Adds HOST_FIM_MOUNTS environment variable to specify additional host mounted paths for runtime monitoring in the Defender deployment file
     • Adds IMAGE_EXTERNAL_LABELS_CAP environment variable (default 100, max 1024) to configure the maximum number of external labels per image on Console and Defenders
     • Allows downloading Monitor > Vulnerabilities > Images & Hosts data as PDF files from the UI
     • Allows downloading Monitor > Compliance > Containers, Images & Hosts data as PDF files from the UI
     • Adds Cloud Security Agent Hosts column to the Download Image Scan Results API CSV response

     +3 more show less

     • Adds new agentless API endpoints /agentless/max-scanners and /agentless/scan-statistics for managing scanner limits and retrieving statistics
     • Supports Oracle Linux as a container base image for runtime protection
     • Adds gcp-cloud-run-service enum value to the shared.ScanResultType schema

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Defenders previous to version 31.00 (e.g., v30.03) will disconnect from the Console if not upgraded
     • !Support removed for x86 operating systems: CentOS 7, RedHat Enterprise Linux 7, VMWare Photon OS 3.0
     • !Support removed for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based orchestrators: Elastic Container Service (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) 1.86.2 and 1.86.3
     • !The Cloud Native Network Segmentation (CNNS) feature is deprecated; recommended to disable all CNNS-based network monitoring
202. Cortex Analytics: 2025.04.23 May 14, 2025 · release notes

     Cortex Analytics adds new BIOCs for AWS storage changes, auth coercion, M365 access, and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. relay detection

     • Added A cloud snapshot of AWS database or storage was modified or shared as a new Informational Analytics BIOC to detect unauthorized AWS data exposure.
     • Added Possible authentication coercion as a new Informational Analytics BIOC to identify potential credential forcing attacks.
     • Added Unusual access to Microsoft 365 storage services as a new Informational Analytics BIOC for spotting anomalous M365 storage interactions.
     • Added Potential NTLM Relay Attack as a new Informational Analytics Alert for detecting NTLM relay attempts.

     4 details in Everything

203. Prisma Access 6.0 Preferred Innovation: Remote Network Site-Based Licensing and Simplified Onboarding May 2025 · release notes

     Prisma Access 6.0 introduces site-based licensing for Remote Networks and a simplified onboarding workflow

     • Introduces site-based licensing for Remote Networks with predefined bandwidth capacities ranging from 25 Mbps to 2.5 Gbps

     1 detail in Everything

204. Prisma Access 6.0 Preferred Innovation: Simplified Onboarding Workflow May 2025 · release notes

     Prisma Access 6.0 introduces a simplified guided onboarding workflow for SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. deployments

     • Introduces a new guided onboarding workflow that automates backend tasks and configures components for securing mobile users and private applications
     • Seamlessly integrates Cloud Identity Engine and Strata Cloud Manager with Prisma Access during the initial setup process

     2 details in Everything

205. Prisma Access 6.0 Preferred Innovation: Mexico Central Compute Region Support May 2025 · release notes

     Prisma Access 6.0 introduces Mexico Central region support.

206. Prisma Access 6.0 Preferred Innovation: IP Capacity Planning May 2025 · release notes

     Prisma Access 6.0 adds IP capacity planning to the GlobalProtect onboarding workflow for automated egress IP allocation.

     • Adds IP address capacity planning to the Prisma Access onboarding workflow for GlobalProtect deployments
     • Provides an interactive map to visualize global deployment and allocate egress IPs by city and user count

     2 details in Everything

207. Prisma Access 6.0 Preferred Innovation: ZTNA Connector: Streamlined Deployment and Expanded Regional Logging May 2025 · release notes

     ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector gets regional Strata logging support and streamlined onboarding in Prisma Access 6.0

     • Adds Strata Logging Service regional support for ZTNA Connector logs to Indonesia, Qatar, Saudi Arabia, and Taiwan.
     • Introduces a simplified Day 0 onboarding workflow with guided steps for configuring private apps, applying defaults, and integrating Cloud Identity Engine (CIE), Strata Cloud Manager, and Prisma Access.
     • Enables ZTNA Connector activation without a dedicated add-on license, granting 10 free connectors with base licensing and unlimited support with the Private Apps add-on.

     3 details in Everything

208. Prisma Access 6.0 Preferred Innovation: Visibility for ZTNA Connector May 2025 · release notes

     Adds clickable drill-down and bandwidth monitoring for ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector objects in Strata Cloud Manager

     • Adds ability to select Total Connector Groups, Total Wildcards, FQDN, or IP Subnet counts in Strata Cloud Manager to view details and status (UP, Partially Up, Down) for each ZTNA object.
     • Adds ability to monitor a Wildcard's bandwidth via the Action menu.

     2 details in Everything

209. Prisma Access 6.0 Preferred Innovation: Colo-Connect Inter-Region May 2025 · release notes

     Prisma Access 6.0 introduces Colo-Connect inter-region connectivity for high-performance disaster recovery between colo-based performance hubs.

     • Enables seamless Layer 2/3 connectivity from existing colo-based performance hubs to Prisma Access

     1 detail in Everything

210. Prisma Access 6.0 Preferred Innovation: RFC6598, iOS, and Android Support for Static IP Address Allocation May 2025 · release notes

     Prisma Access 6.0 adds static IP allocation for iOS/Android users and RFC6598 support.

     • Adds support for allocating static IP addresses to iOS and Android mobile devices
     • Adds support for RFC6598 (Shared Address Space) in static IP address allocation

     2 details in Everything

211. Prisma Access 6.0 Preferred Innovation: Region Support for Explicit Proxy May 2025 · release notes

     Prisma Access 6.0 now supports Explicit Proxy in Bahrain, Canada West, France North, Ireland, Sweden, South Africa West, and UAE.

     • Adds explicit proxy support to the Bahrain region
     • Adds explicit proxy support to the Canada West region
     • Adds explicit proxy support to the France North region
     • Adds explicit proxy support to the Ireland region
     • Adds explicit proxy support to the Sweden region

     +2 more show less

     • Adds explicit proxy support to the South Africa West region
     • Adds explicit proxy support to the United Arab Emirates region

     7 details in Everything

212. Prisma Access 6.0 Preferred Innovation: Extend Prisma Access User Group Policy Support with Short Form Format May 2025 · release notes

     Prisma Access 6.0 adds short form format support for user group policies

213. Prisma Access 6.0 Preferred Innovation: DNS Resolution for Mobile Users—Explicit Proxy Deployments May 2025 · release notes

     Prisma Access 6.0 Preferred Innovation adds DNS Proxy customization for Explicit Proxy mobile users to support custom and on-premises resolvers.

     • Adds comprehensive DNS Proxy customization for Explicit Proxy deployments, enabling integration with regional DNS, custom third-party resolvers, or existing on-premises DNS infrastructure.

     1 detail in Everything

214. Prisma Cloud: Features Introduced in May 2025 May 2025 · release notes

     Prisma Cloud adds HOST_FIM_MOUNTS env var for runtime path monitoring, Azure VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. flow log ingestion, SUSE RHEL10 support, PDF exports, and new REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services..

     • Adds HOST_FIM_MOUNTS environment variable to Defender deployment files to specify additional host mounted paths for runtime file system monitoring
     • Enables downloading Vulnerabilities and Compliance data as PDF files via the Monitor > Vulnerabilities > Images & Hosts and Monitor > Compliance > Containers, Images & Hosts pages
     • Adds ingestion support for Azure VNet flow logs alongside existing NSG flow logs for Microsoft Azure accounts
     • Adds AWS ca-west-1 (Canada/Calgary) to resource discovery in the Asset Inventory page
     • Adds new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints post-agentless-max-scanners and get-agentless-scan-statistics to configure agentless scanner limits and retrieve statistics

     +1 more show less

     • Extends runtime protection support to SUSE Linux Enterprise Server 15 SP6, Oracle Linux base images, Google GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. autopilot v1.31.6-gke.1064001, and Oracle OKE V.1.32.1

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removes support for CentOS 7, RedHat Enterprise Linux 7, and VMWare Photon OS 3.0 x86 operating systems
     • !Removes support for Elastic Container Service (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) 1.86.2 and ECS 1.86.3 ARM-based orchestrators
215. Cortex Analytics: 2025.04.16 Apr 28, 2025 · release notes

     Cortex Analytics 2025.04.16 adds detections for cloud exfiltration and public exposure.

     • Adds detection logic for 'A cloud storage object was copied to a foreign cloud account' (Medium Analytics BIOC)
     • Adds detection logic for A Backup vault policy was modified (Low Analytics BIOC)
     • Adds detection logic for 'AWS S3 bucket was exposed to public access' (Low Analytics BIOC)
     • Adds detection logic for Authentication attempt by a honey user (Low Analytics BIOC)
     • Adds detection logic for GCP data asset shared public (Low Analytics BIOC)

     +9 more show less

     • Adds detection logic for Unusual CIM repository file access (Low Analytics BIOC)
     • Adds detection logic for Unusual CertLog Remote File Write (Low Analytics BIOC)
     • Adds detection for 'User added to the SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. Admins local group' alert (Low Analytics Alert)
     • Adds detection logic for 'A process connected to rare external host' (Informational Analytics BIOC)
     • Adds detection logic for Key credential attribute modification (Informational Analytics BIOC)
     • Adds detection logic for Privileged certificate request via certificate template (Informational Analytics BIOC)
     • Adds detection logic for Suspicious successful RDP connection to localhost (Informational Analytics BIOC)
     • Adds detection logic for Vulnerable certificate template loaded (Informational Analytics BIOC)
     • Adds detection for 'Abnormal File Activity in SCCMContentLib Shared Folder by user' (Informational Analytics Alert)

     14 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removal of EMAIL BETA - Potential evasion techniques detected in email
     • !Removal of EMAIL BETA - Potentially dangerous URL(s) in email
     • !Removal of EMAIL BETA - Potentially dangerous sender
     • !Removal of EMAIL BETA - Potentially malicious attachment(s) spotted in an email
     • !Removal of EMAIL BETA - Email contains potentially malicious attachments that are not blocked by default
     • !Removal of EMAIL BETA - Email identified as potential fraud attempt
216. Cortex Analytics: 2025.03.26 Apr 21, 2025 · release notes

     Cortex Analytics adds detection coverage for Certipy enumeration and new cloud/email behavioral analytics

     • Adds Certipy AD CS enumeration via LDAP as a new Low Analytics BIOc
     • Adds 'Suspicious access of the System Management Container' as a new Low Analytics BIOc
     • Adds Cloud resource logging was disabled as a new Informational Analytics BIOc
     • Adds PKINIT TGT authentication request as a new Informational Analytics BIOc

     4 details in Everything

217. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: 8.9 GA 2025-04-07 Apr 7, 2025 · release notes

     Cortex XSOAR 8 On-prem 8.9 introduces collapsible playbook sections and new UI for playbooks.

     • Adds collapsible sections to playbook diagrams for better navigation of large workflows.
     • Introduces a new look and feel for the playbook editor interface.

     2 details in Everything

218. Cortex XSIAM: April 2025 Apr 2025 · release notes

     Cortex XSIAM 3.1 adds Graph Search, AI Detection dashboard, Cribl integration, Quick Actions, and ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. asset removal API

     • Adds Cross-region tenant pairing to pair parent and child tenants across geographic regions in multi-tenant architectures
     • Adds AI Detection & Response Beta feature with a dedicated dashboard and detectors for cloud audit logs from AWS, Azure, and GCP
     • Adds Cribl Stream integration (Beta) for data pipeline management and onboarding
     • Adds Graph Search feature in Query Builder to visualize attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and organizational posture
     • Introduces New Cortex Command Center for unified view of cloud security and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. insights

     +10 more show less

     • Replaces playbook triggers with Automation Rules that can trigger playbooks and Quick Actions
     • Adds Quick Actions capability for single commands that can be added to playbooks or run manually
     • Enables Automated script triggers to run when an issue field is updated
     • Introduces VBScript file examination module using ML-based protection in the XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent
     • Adds Webshell, SCCM, AD CS, and Cloud Data Asset Analytics detection suites
     • Updates XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. datasets with playbook_tasks, playbook_runs, scripts_and_commands_metrics, indicators, and indicator_relationships
     • Exposes ASM asset removal API for removing external IP ranges, domains, subdomains, and certificates
     • Enables Real-time API threat detection via Cortex XDR agent for malicious API requests/responses
     • Adds CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. vulnerability testing, default credential testing, and OS fingerprinting to Attack Surface Management
     • Enhances Dashboards with script widgets, Markdown text widgets, time-based result fields, and Series parameter in Chart Editor

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !From Cortex XDR agent version 8.8 and later, 32-bit Windows installers for Cortex XDR agent are not supported.
     • !K8s-based Cortex XDR agents cannot be upgraded automatically, and do not occupy a slot in the auto-upgrade pool.
     • !Cloud Inventory and Prisma Cloud data sources are deprecated or offer limited functionality in Legacy Asset Inventory.
219. Cortex Cloud Runtime Security: April 2025 Apr 2025 · release notes

     Cortex Cloud Runtime Security April 2025 adds API inventory, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. datasets, custom compliance scripts, dedicated IPs, and more.

     • Adds API specification inventory to surface API definitions and static analysis misconfiguration risks
     • Integrates Semgrep, SonarQube, and Veracode SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. data via SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. upload (UI/API) and Semgrep SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings
     • Enables custom compliance detection rules using Python-based scripts for workload adherence verification
     • Adds support for Internet Exposure Detection in AWS Lambda, AWS RDS, AWS Redshift, Azure SQL, Azure Cosmos DB, and Managed Kubernetes Clusters
     • Exposes dedicated IP address allocation in Azure, GCP, and AWS for secure cloud access with telemetry and audit logs

     +6 more show less

     • Introduces playbook_tasks, playbook_runs, and scripts_and_commands_metrics datasets for XQL queries and dashboards
     • Adds API testing capabilities to the Cortex CLI tool for seamless workflow integration
     • Enables granular exception handling in Detection Rules with automated recommendations
     • Allows creation of dataset views via XQL queries in Dataset Management for RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.-based data segregation
     • Introduces new Application Security APIs for managing data sources, rules, policies, and scans
     • Supports downloading Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.) in JSON or XML formats via the API

     11 details in Everything

220. Cortex Xpanse Expander: Release 2.9 (April 2025) Apr 2025 · release notes

     Cortex Xpanse Expander 2.9 adds CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. testing, default credential tests, OS fingerprinting, and an Asset Removal API

     • Attack Surface Tests now cover over 260 externally detectable CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. CVEs with benign exploitation for high-confidence confirmation
     • Adds roughly 40 new Attack Surface Tests to detect manufacturer default credentials on business operations systems, IT devices, and networking equipment
     • Enables OS identification by fingerprinting operating system and version details for internet-facing applications
     • New Asset Removal API endpoint allows removing IP address ranges, paid-level domains, subdomains, and certificates from inventory

     4 details in Everything

221. Cortex Cloud Posture Management: April 2025 Apr 2025 · release notes

     Cortex Cloud Posture Management 1.1 adds custom Python compliance rules, XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. playbook datasets, third-party SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. ingestion, API/CLI testing, and automated remediation playboo

     • Users can now create custom compliance detection rules using Python-based scripts for flexible security best practices enforcement
     • New RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Dataset Views allow virtual data subsets via XQL queries in the Dataset Management page for segregation and access control
     • Cortex Cloud Application Security ingests third-party SAST findings from Semgrep, SonarQube, and Veracode in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. format via UI or API
     • New API endpoints enable cloud onboarding, and list/create/update issues programmatically
     • SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. can now be downloaded for any asset in JSON or XML formats using the public API

     +35 more show less

     • Streamlined Application Security APIs allow automated management of data sources, rules, policies, and scans
     • API specification inventory provides detailed view of API definitions with automatic static analysis for misconfiguration risks
     • API testing capabilities are now available in the Cortex CLI tool to integrate into security workflows
     • New built-in automation includes executable commands, scripts, quick actions, and playbooks to accelerate issue resolution via automation rules
     • Internet Exposure Detection support extends to AWS Lambda, AWS RDS, AWS Redshift, Azure SQL, Azure Cosmos DB, and Managed Kubernetes Clusters (EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.)
     • Identification of exposed services in Kubernetes is now supported through ingress paths
     • Support for 30 new regulations including NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework., NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals., ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001/27002, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. allows workload verification against these standards
     • Secure Serverless functions in FaaS infrastructure are now monitored with agentless scanning for vulnerabilities and posture
     • XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. agent adds advanced detections of malicious Linux executables using local analysis with ML across cloud environments
     • New dashboards are available for Data, Identity, and AI Security Posture modules providing insights into sensitive data and identity issues
     • Container Instance Asset provides deep visibility for individual container instances with built-in drift detection
     • Kubernetes Connector supports automatic upgrade when new versions are released
     • Agentless scanning is now available for Cortex Cloud Runtime Security to assess cloud environments without agent installation
     • Dedicated IP addresses can be allocated in Azure, GCP, and AWS for secure cloud access with telemetry and audit logs
     • New dashboard widgets support dynamic calculations via script widgets, Markdown formatting, time-based filters, and on-demand refresh
     • Cortex Cloud AI Security dashboard updates provide key insights into AI ecosystem security issues
     • Visibility into AI models hosted on disks/volumes is added via Agentless Disk Scanning (ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware.)
     • Azure SQL data classification is supported to view findings and prioritize issues based on data patterns
     • AWS DynamoDB data classification allows reviewing findings from DynamoDB databases
     • Self-managed databases data classification is performed as part of Agentless Disk Scanning (ADS) for databases on disks/volumes
     • Data pattern inventory allows viewing all discovered data patterns (IPs, emails, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., etc.) with asset counts and risk levels
     • Error logging shows errors hindering data classification for supported assets with remediation steps
     • Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. permissions visibility allows identifying admins and assessing risk in Entra ID identities
     • Last access tracking for cloud identities helps reduce excessive privileges
     • Additional identity attributes include inactive human identity and last used cloud service accounts
     • Logging inactive human identity information is supported on Azure
     • Default Cortex Cloud Application Security policies enable immediate detection of SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. vulnerabilities
     • Cortex Cloud Application Security dashboard provides summary of assets and top associated risks with issue/policy widgets
     • Data source instance health status monitors the health of Application Security data source instances and repositories
     • Repository scan configurations allow customizing scans by enabling/disabling scanners, controlling PR security, and excluding file paths
     • Registry scanning supports all Docker V2-based registries and includes a dedicated connector for JFrog
     • XQL time picker adds last 5 minutes and last 3 hours options along with recent selections
     • XQL auto-suggestion improvements allow navigating suggestions with arrow keys and selecting with Enter/Tab
     • New XQL series based graph results in Widgets allow grouping chart results by a Series field in the Chart Editor
     • New XQL datasets for playbook tasks (playbook_tasks), playbook runs (playbook_runs), and scripts metrics (scripts_and_commands_metrics) are available

     40 details in Everything

222. Cortex XSOAR 8 SaaS: April 2025 Apr 2025 · release notes

     Cortex XSOAR 8.11 adds automatic incident export to external storage and expanded API support for ROI widgets, lists, files, and playbook cloning

     • Adds Automatically export incidents feature to store incidents in external storage beyond the retention period for indefinite access to historical data.
     • Expands supported APIs to reset the ROI widget, update existing lists, get a list, upload files, and clone playbooks.
     • Extends Guard Rails page coverage for new scenarios to help maintain a stable environment.

     3 details in Everything

223. Cortex XDR 3.x: April 2025 Apr 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.14 adds Webshell, SCCM, AD CS, Cloud Data Asset analytics; new RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Dataset Views and granular ingestion metrics.

     • Webshell Analytics detects webshells being installed and executed
     • Microsoft SCCM Analytics detects unusual or suspicious activity within Microsoft System Center Configuration Manager (SCCY) environments
     • Active Directory Certificate Services Analytics detects anomalous behavior within Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services (AD CS)
     • Cloud Data Asset Analytics detects anomalous behavior involving data assets as public exposure, exfiltration, protection tampering, configuration, and disaster recovery risks
     • Granular data ingestion metrics in metrics_source dataset and metrics_view preset

     +6 more show less

     • RBAC Dataset Views in the Dataset Management page
     • New Series parameter in the XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. Chart Editor Widgets
     • Enhanced XQL auto-suggestion keyboard navigation (arrow keys, Enter/Tab to select, Shift+Enter for new line)
     • XQL time picker includes last 5 minutes and last 3 hours options
     • ML-based protection model for VBScript files on Windows
     • Enhanced ML model for detecting malicious Linux executables

     11 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !32-bit Windows installers are not supported from Cortex XDR agent version 8.8 and later
     • !K8s-based Cortex XDR agents cannot be upgraded automatically
224. Prisma Cloud: Features Introduced in April 2025 Apr 2025 · release notes

     Prisma Cloud adds API ingestions for AWS Lex, Azure Arc, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., plus new config policies for AWS Lightsail, GCP AlloyDB, and Dataproc

     • Adds aws-lexv2-slots, aws-detective-member, aws-appfabric-app-bundle, aws-appfabric-app-authorization, aws-organizations-aws-service-access-for-organization, aws-organizations-delegated-services-for-account, and aws-keyspaces-table API ingestion connectors for AWS services
     • Adds azure-log-analytics-data-exports, azure-arc-machine-license-profile, azure-arc-machine, azure-arc-private-link-scope, azure-arc-license, azure-app-service-certificate-order, azure-api-management-service-private-endpoint-connection, azure-api-management-service-cache, and azure-event-grid-topic-event-subscription / azure-event-grid-domain-event-subscription API ingestion connectors for Azure services
     • Adds gcloud-backup-dr-backup-vault-data-source-backup, gcloud-backup-dr-backup-vault-data-source, gcloud-backup-dr-backup-vault, gcloud-backup-dr-backup-plan-association, and gcloud-backup-dr-backup-plan API ingestion connectors for Google Backup and DR
     • Adds oci-iam-user-db-credential API ingestion connector for OCI IAM database credentials
     • Adds new config policy 'AWS Lightsail Instance allows ingress from the internet' checking 0.0.0.0/0 or ::/0 inbound CIDRs

     +8 more show less

     • Adds new config policy 'AWS Lightsail Instance not configured with Instance Metadata Service v2 (IMDSv2)' checking metadataOptions.httpTokens for optional
     • Adds new config policy 'GCP AlloyDB Cluster instance allows direct unencrypted connection' checking clientConnectionConfig.sslConfig.sslMode equals ALLOW_UNENCRYPTED_AND_ENCRYPTED
     • Adds new config policy 'GCP AlloyDB instance with IAM authentication disabled' checking databaseFlags.alloydb.iam_authentication is not on
     • Adds new config policy 'GCP AlloyDB Instance with insecure password policy' validating complexity, expiration, and length flags
     • Adds new config policy 'GCP AlloyDB Cluster’s Continuous Backup not encrypted with CMEK' checking continuousBackupInfo.encryptionInfo.encryptionType equals GOOGLE_DEFAULT_ENCRYPTION
     • Adds new config policies for GCP Dataproc Serverless Batch, Session template, and Session instances using default network (networkUri or subnetworkUri ends with default)
     • Adds new config policy 'GCP Dataproc Cluster on GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. is using default network' cross-referencing Kubernetes cluster target
     • Adds new config policy 'GCP Dataproc Cluster on Compute Engine is using default network' checking network/subnetwork URI or absence thereof

     13 details in Everything

225. Cortex XDR 5.x: April 2025 Apr 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 4.1 adds Graph Search, new analytics suites, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. Dataset Views, playbook tracking datasets, and native automation capabilities.

     • Adds Graph Search in Query Builder (Beta) for visual threat hunting
     • Introduces pre-built and custom integrations and playbooks as part of full-featured automation
     • Enables automated quick actions and case investigation war rooms
     • Deploys an ML-based VBScript file examination module for Windows agent protection
     • Enhances exception handling with automated recommendations

     +8 more show less

     • Upgrades malicious Linux executable detection using a local analysis model
     • Adds new Analytics detection suites: Webshell, SCCM, AD CS, and Cloud Data Asset
     • Exposes granular data ingestion metrics in the metrics_source dataset and metrics_view preset
     • Introduces RBAC Dataset Views for virtualizing and segregating datasets
     • Extends XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. time picker with last 5 minutes and last 3 hours options
     • Improves XQL auto-suggestion with arrow key navigation and Enter/Tab selection
     • Adds playbook_tasks, playbook_runs, and scripts_and_commands_metrics datasets for XQL queries
     • Supports the Series parameter in Chart Editor for XQL widget graphs

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !32-bit Windows installers for Cortex XDR agent are not supported from version 8.8 and later
     • !K8s-based Cortex XDR agents cannot be upgraded automatically
226. Prisma Cloud Compute Edition: 34.00 (Build 34.00.141) Mar 30, 2025 · release notes

     Prisma Cloud Compute 34.00 adds agentless custom AMI env vars, CaaS API filters, ACI discovery, and Jira API token auth

     • AGENTLESS_USE_CUSTOM_AMI and AGENTLESS_CUSTOM_AMI_PER_REGION environment variables now enable on-prem users to supply custom Amazon Machine Images instead of the default scanner image.
     • hasCAASSpecReferences query parameter is available in Get Registry Scan Results, Download Registry Scan Results, and Get Registry Image Names APIs to filter registry images deployed as part of CaaS specifications.
     • images query parameter added to Get Discovered Cloud Entities API for filtering by container image names defined in CaaS specs; service parameter added to the same API response for GCP Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. service name.
     • Cloud Discovery now includes data for all containers in Azure Container Instances (ACI) groups, not just the first one.
     • Account ID attribution is now displayed for app-embedded defenders installed on ACI containers.

     5 details in Everything

227. Cortex Analytics: 2025.02.26 Mar 17, 2025 · release notes

     Cortex Analytics adds 6 new Medium, 1 new Low, and 4 new Informational email security alerts for phishing and impersonation detection.

     • Adds 'EMAIL BETA - Multiple risk indicators detected in email' (Medium) to detect combined threats
     • Adds 'EMAIL BETA - Potential brand impersonation in email' (Medium) for brand spoofing
     • Adds 'EMAIL BETA - Potential evasion techniques detected in email' (Medium)
     • Adds 'EMAIL BETA - Potentially dangerous URL(s) in email' (Medium)
     • Adds EMAIL BETA - Potentially dangerous sender (Medium)

     +4 more show less

     • Adds 'EMAIL BETA - Potentially malicious attachment(s) spotted in an email' (Medium)
     • Adds 'EMAIL BETA - Potential employee impersonation in email with financial or urgent context' (Low)
     • Adds Kubernetes environment enumeration activity (Informational) to detect K8s reconnaissance
     • Adds Azure audit - MFA fraud reported (Informational) for Azure identity protection

     9 details in Everything

228. Prisma Cloud: Features Introduced in March 2025 Mar 2025 · release notes

     Prisma Cloud March 2025 adds CaaS asset discovery, custom AMI env vars, API ingestion connectors, and Lightsail compliance policies.

     • Adds environment variables AGENTLESS_USE_CUSTOM_AMI and AGENTLESS_CUSTOM_AMI_PER_REGION to enable on-prem users to specify custom Amazon Machine Images for scanning
     • Introduces new API ingests for Amazon Cognito (aws-cognito-identity-pool-role), Amazon Connect (aws-connect-instance-user, aws-connect-instance-security-profile), and Amazon EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. Pipes (aws-event-bridge-pipe)
     • Adds new Amazon EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. API ingests for aws-ec2-instance-connect-endpoint, aws-ec2-image-block-public-access-state, and aws-ec2-snapshot-block-public-access-state
     • Adds new AWS Glue API ingests for blueprints (aws-glue-blueprint, aws-glue-blueprint-run) to discover blueprint configurations
     • Adds new Amazon RDS API ingests for proxies (aws-rds-db-proxy, aws-rds-db-proxy-target) and automated backups (aws-rds-db-instance-automated-backup)

     +8 more show less

     • Adds S3 Storage Lens configuration ingest via aws-s3-storage-lens-configuration and SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic subscription ingest via aws-sns-subscriptions-by-topic
     • Adds SQS message move task ingest (aws-sqs-message-move-task) and Lambda event invoke config/concurrency/runtime management ingests to discover function settings
     • Supports the CaaS Specification References field via a new hasCAASSpecReferences query parameter on registry scan APIs
     • Supports container image filtering in cloud discovery via a new images query parameter on GET /api/v1/discovery/entities
     • Adds a service parameter to discovered GCP Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. entities in the cloud discovery API response
     • Adds caasSpecReferencesTotal field across multiple APIs (host scans, image scans, vulnerability policies) to specify referenced CaaS specification counts
     • Extends shared.ScanResultType enum with aws-fargate-task-definition for new scan result types
     • Adds three new compliance policies for AWS Lightsail storage buckets: unmonitored access, public readability, and disabled object versioning

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Support removed for Azure Kubernetes Service (AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations.) v1.27-v1.30, Elastic Container Service (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) 1.86, Elastic Kubernetes Service (EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves.) v1.28-v1.30, Google Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) v1.27-v1.30, Lightweight Kubernetes (k3s) v1.30, OpenShift 4.14, RKE v1.30-v1.31, and RKE2 v1.29 for x86 orchestrators
     • !Support removed for Talos OS versions 1.3 through 1.8.2 and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) v1.26-v1.28 for x86 operating systems
     • !Support removed for Elastic Container Service (ECS) 1.86, Elastic Kubernetes Service (EKS) v1.29-v1.30 ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., Google Kubernetes Engine (GKE) v1.29-v1.30 ARM, and GKE autopilot on ARM v1.29-v1.30
     • !Support removed for Auto Defend (AWS) Node.js 16 and Python 3.8
     • !Support removed for Runtime Protection with Defender (AWS) Node.js 16 and Python 3.8
229. Cortex XDR 3.x: February 16, 2025 Feb 16, 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. adds XDRC 1.5.0 (OpenSSL 3+) and XDRC 1.4.3 support for specific Windows versions; fixes duplicate logs.

     • Adds XDRC 1.5.0 collector line supporting Windows 10+ and OpenSSL 3+
     • Adds XDRC 1.4.3 collector line supporting Windows 8 and Server 2012 R2

     2 details in Everything

230. Cortex Analytics: 2025.01.29 Feb 10, 2025 · release notes

     Cortex Analytics adds detection for Azure storage anonymous access and public sharing.

     • Adds 2 new Informational Analytics BIOCs: 'Azure storage account blob anonymous access is enabled' and Azure storage account was publicly shared
     • Increases severity to Medium for the Unusual process access to ld.so.preload file Analytics BIOC

     2 details in Everything

231. Cortex XDR 3.x: February 2025 Feb 2025 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.13 adds Prisma Browser integration, analytics detections, syslog/Auth APIs, and alert email fields.

     • Adds Prisma Browser data integration for Cortex XDR, allowing queries into browser activity and generation of detection/correlation rules
     • Introduces new Analytics detection suites on MacOS: Credentials grabbing, Sensitive information stealing, and AppleScript detection
     • Adds Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. Activity logs as a new data source with Microsoft Graph Activity logs anomalous activity detection
     • Expands public API to include endpoint for deleting Cortex XDR agent installation packages
     • Adds new APIs for syslog server management and IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration (Identity Provider and Single Sign-On) settings

     +3 more show less

     • Adds Name, Description, Severity, File path, and Timestamp fields to the body of forwarded alert emails
     • Allows defining Endpoint tags during the creation of an agent installation package, which are applied to new agents
     • Enables configuration in Windows endpoints to analyze ASP and ASPX files and prevent malicious ones from being written to the file system

     8 details in Everything

232. Cortex XSOAR 8 SaaS: February 2025 Feb 2025 · release notes

     Cortex XSOAR 8.9 adds ed25519 repo auth, upgrade.conf, Syslog forwarding, audit logging, engine APIs, and UI enhancements.

     • Supports the ed25519 algorithm to connect to private content repositories
     • Allows setting upgrade variables such as https_proxy using a new upgrade.conf file during engine upgrades
     • Adds RHEL version 9.5, Oracle Linux version 9.4, Amazon Linux 2023, and Ubuntu 24.04 to supported platforms for engine installation
     • Records analyst actions (commands entered in War Room and Playground) in audit logs
     • Allows forwarding integration logs to the Syslog server

     +4 more show less

     • Allows forwarding Guard Rail alerts and warnings to the Syslog Server
     • Adds new administration APIs for automating engine deployment, managing syslog servers at scale, and configuring IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
     • Adds support for Cortex API endpoints to edit indicators and delete batches of incidents
     • Enables bulk Retain/Undo Retain actions on incidents from the incidents table

     9 details in Everything

233. Prisma Access 5.2 Preferred Innovation: On-Premises Active Directory Support for RBI Feb 2025 · release notes

     Prisma Access 5.2 adds on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. support for Remote Browser Isolation policy targeting.

     • Enables Remote Browser Isolation (RBI) to evaluate security rules against users and user groups derived from on-premises Active Directory.

     1 detail in Everything

234. Prisma Access 5.2 Preferred Innovation: Enhanced Near-Native Experience for RBI Feb 2025 · release notes

     Prisma Access 5.2 RBI now supports Chromium widgets and context menus out-of-the-box.

     • RBI provides comprehensive out-of-the-box support for Chromium-based widgets and context menus

     1 detail in Everything

235. Prisma Access 5.2 Preferred Innovation: IoT Device-ID Based Policies for Mobile Users Feb 2025 · release notes

     Prisma Access 5.2 adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Device-ID based security policies for mobile users.

     • Enables creation of Device-ID based Security policies specific to mobile users
     • Allows extension of existing Device-ID based Security policies for remote networks to include mobile users

     2 details in Everything

236. Prisma Access 5.2 Preferred Innovation: Prisma SASE 5G Feb 2025 · release notes

     Prisma Access 5.2 introduces Prisma SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. 5G for agentless zero-trust security on enterprise 5G networks.

     • Integrates zero-trust security with 5G infrastructure to enable service providers to offer comprehensive SASE services for 5G-connected devices without agents or inline hardware.
     • Provides agentless authentication, flexible traffic routing, and intuitive multi-tenant management for bridging 5G authentication and SASE policy rules.

     2 details in Everything

237. Prisma Access 5.2 Preferred Innovation: Third-Party NDR Integration Feb 2025 · release notes

     Prisma Access 5.2 introduces Third-Party NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Integration via Traffic Replication.

     • Adds Traffic Replication capability for third-party Network Detection and Response (NDR) integration.

     1 detail in Everything

238. Prisma Cloud: Features Introduced in February 2025 Feb 2025 · release notes

     Prisma Cloud adds new CIEM/IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. RQL attributes and AWS S3 public access policies plus multiple API ingestions

     └──▷ TRY IT
     Investigate Azure permissions granted at the resource group level to identify broad entitlements.
     copy

     $ config from iam where grantedby.level.type = 'Azure Resource Group'

     • Adds grantedby.level.type, grantedby.level.name, and grantedby.level.id attributes to RQL queries for IAM filtering by userPrincipalName (UPN)
     • Adds new CIEM capability to filter Azure resource group permissions using grantedby.level.type = 'Azure Resource Group' in RQL
     • Introduces three new config policies: aws-s3api-get-bucket-acl block public access bucket policy, ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. setting, and ACL write permission checks
     • Adds support for ingesting 26 new AWS/Azure/GCP resources including aws-apigatewayv2-authorizer, azure-data-protection-backup-vaults, and gcloud-dataproc-serverless-batch
     • Updates Satellite API request body to require only clusterAssetId string and config object for cluster info addition

     +1 more show less

     • Deprecates GET /uve/api/v1/dashboard/vulnerabilities/overview (and v2, v3) in favor of POST /uve/api/v4/dashboard/vulnerabilities/overview

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !GET /uve/api/v1/dashboard/vulnerabilities/overview, GET /uve/api/v2/dashboard/vulnerabilities/overview, and GET /uve/api/v3/dashboard/vulnerabilities/overview endpoints have been deprecated in favor of POST /uve/api/v4/dashboard/vulnerabilities/overview.
239. Prisma Access 5.2 Preferred Innovation: IPv6 Support for Public Apps for IP Optimization Feb 2025 · release notes

     Prisma Access 5.2 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for public apps in IP Optimization deployments

     • Expands IP Optimization to support IPv6 addresses for public (internet-facing) applications in existing Prisma Access deployments.
     • Enables dual-stack (IPv4/IPv6) address resolution and connectivity for public app services under the IP Optimization feature set.

     2 details in Everything

240. Prisma Access 5.2 Preferred Innovation: Host Information Profile Support for Policy Enforcement Along with RBI Functionality (Innovation Release) Feb 2025 · release notes

     Prisma Access 5.2 adds Host Information Profile (HIP) support for Remote Browser Isolation policy enforcement

     • Enforces Remote Browser Isolation policies based on device identity and compliance posture using Host Information Profiles (HIP)
     • Dynamically routes traffic through isolation for untrusted or non-compliant endpoints identified by HIP

     2 details in Everything

241. Cortex Xpanse Expander: Release 2.8 (February 2025) Feb 2025 · release notes

     Cortex Xpanse Expander 2.8 adds bulk asset management, dynamic protocol detection, and new IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems./SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. APIs.

     • Simplified Self-Service Asset Management
     • New API capabilities

     2 details in Everything

242. Cortex Analytics: 2024.12.25 Jan 19, 2025 · release notes

     Cortex Analytics adds 2 Low and 6 Informational BIOCs plus 4 Informational Alerts for new threat coverage.

     • Adds 'NTDS.dit file written by an uncommon executable' (Low Analytics BIOC)
     • Adds 'User set insecure CA registry setting for global SANs' (Low Analytics BIOC)
     • Adds Access to Kubernetes configuration file (Informational Analytics BIOC)
     • Adds Cloud storage automatic backup disabled (Informational Analytics BIOC)
     • Adds Privileged role used by Azure application (Informational Analytics BIOC)

     +7 more show less

     • Adds 'Soft delete of cloud storage configuration was disabled' (Informational Analytics BIOC)
     • Adds 'Unusual SSH activity that resembles SSH proxy' (Informational Analytics BIOC)
     • Adds Unusual user account unlock (Informational Analytics BIOC)
     • Adds Abnormal RDP connections to multiple hosts (Informational Analytics Alert)
     • Adds Azure high-volume data transfer (Informational Analytics Alert)
     • Adds Microsoft OneDrive enumeration activity (Informational Analytics Alert)
     • Adds 'User accessed multiple O365 AIP sensitive files' (Informational Analytics Alert)

     12 details in Everything

243. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: GA 2025-01-05 Jan 5, 2025 · release notes

     Cortex XSOAR 8 On-prem introduces multi-tenant architecture and configuration/data backup capabilities.

     • Enables multi-tenant operation for Cortex XSOAR On-prem deployments
     • Adds backup and restore functionality for configurations and data

     2 details in Everything

244. Prisma Cloud: Features Introduced in January 2025 Jan 2025 · release notes

     Prisma Cloud 25.1.1 adds Enhanced Remediation views, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. build policy support, Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. visibility, new compliance benchmarks, and the get-remediation-for-policy API

     • Enhanced Remediation for Critical and High alerts introduces a new Saved View and How to Fix tab with AI-assisted steps and options to remediate via Terraform Template or CLI Command.
     • Adds ARM framework support to custom build policies, allowing shared arguments/syntax between ARM and Bicep or restricting the policy to ARM only, including explicit and implicit dependencies.
     • Adds Microsoft Entra ID visibility in CIEM using the grantedby.level.type attribute to investigate permissions and identify entities with roles like Global Administrator.
     • Adds last-connected field to Defender stats logs, recording the last confirmed connection time in epoch seconds (UTC) even when the Connected flag is false.
     • Supports CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Foundations Benchmark v3.0.0 (Levels 1 & 2) and CIS AWS Foundations Benchmark v4.0.0 compliance standards for automated governance.

     +10 more show less

     • Adds NCSC - Cyber EssentialsCyber EssentialsA UK government-backed certification scheme that defines a baseline set of technical controls organizations must implement to defend against common cyber threats, giving cyber tools a compliance benchmark to assess or report against. and NCSC - Cloud Security Principles compliance benchmarks to the built-in standards library.
     • Adds TISAXTISAXA vehicle-industry information-security assessment standard, maintained by the ENX Association, that lets automotive suppliers prove their data-handling practices to OEMs without each OEM running its own separate audit. (Trusted Information Security Assessment Exchange) compliance framework support with structured maturity model assessments.
     • Adds HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. policy mappings update, which may vary existing compliance scoring due to new mappings.
     • Excludes NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. runtime-specific dependencies unrelated to the application in scanning to reduce false positive vulnerability alerts.
     • Adds AWS CodePipeline pipeline resource updates (stages, Deploy, Source, Build fields) and Cognito user-pool updates (passwordPolicy, AdvancedSecurityMode, riskConfiguration).
     • Adds new API ingestions for Amazon Athena, Amazon Fraud Detector entities/labels/variables, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Vaults, Azure Load Testing, Google Identity Aware Proxy settings, and others.
     • Adds multiple new security policies including AWS Connect contact flow logs check, Azure Container Registry anonymous/local admin/repository-scoped token checks, GCP Memorystore encryption/auth requirements, and more.
     • Updates IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy 'System/User-assigned managed identity with critical Entra ID permissions' to detect critical Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. permissions for managed identities.
     • Adds new IAM policies identifying Entra ID users owning or impersonating service accounts with admin group privileges at subscription/management group level.
     • Implements rate limits on Config Search and Config Search v1 APIs (/search/config, /search/config/page, /search/api/v1/config) at 150 requests per minute.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Config Search APIs (/search/config, /search/config/page) and Config Search v1 API (/search/api/v1/config) now enforce a rate limit of 150 requests; exceeding this results in HTTP 429.
245. PAN-OS 11.1: Multi-VSYS Support for NGFW Clustering Jan 2025 · release notes

     Multi-VSYS support for NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. clustering on PA-7500 Series firewalls enables up to 25 virtual systems per cluster.

     • Adds support for assigning virtual systems at the interface level, including MC-LAG and Aggregate Ethernet interfaces, in clustered PA-7500 deployments.

     1 detail in Everything

246. Cortex Analytics: 2024.11.20 Dec 3, 2024 · release notes

     Cortex Analytics 2024.11.20 adds detection for Azure Service Principal creation, Azure application removal, Okta account unlock by admin, and potential Okta access limit brea

     • Adds new Medium Analytics BIOC: Suspicious Kubernetes pod token access
     • Adds new Low Analytics BIOCs: A process queried the ADFS database decryption key via LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., Potential SCCM credential harvesting using WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. detected, Unusual Encrypting File System Remote call (EFSRPC) to domain controller
     • Adds new Informational Analytics BIOCs: Service Principal was created in Azure, Azure application removed, Azure group creation/deletion, Azure permission delegation granted, Data encryption was disabled, Member added to a Windows local security group, Okta account unlock by admin, Potential Okta access limit breach
     • Adds new Informational Analytics Alert: Okta account unlock

     4 details in Everything

247. Prisma Access 5.2 Preferred Innovation: Route Table Visibility at Branch Sites and Service Connections Dec 2024 · release notes

     Prisma Access 5.2 adds routing visibility capabilities to help troubleshoot connectivity issues.

248. Prisma Cloud: Features Introduced in December 2024 Dec 2024 · release notes

     Prisma Cloud v24.12.1 adds Action Plans, Secrets asset search, AISPM AI benchmarks, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. v4.0.1, and APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. APIs

     • Adds Action Plans feature to programmatically group multiple alerts related to a single affected asset into one actionable plan with prioritization, execution delegation, detailed visibility, and security fix efficiency using machine learning.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The aws-polly-voices API is deprecated; Prisma Cloud will no longer ingest metadata for this API, and the api.name attribute auto-completion will not include it.
249. Prisma Cloud Compute Edition: 33.02 (Build 33.02.134) Nov 27, 2024 · release notes

     Adds scanning support for Red Hat UBI micro-images (v7-9) and improved GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure./OCP vulnerability detection.

     • Expands Google Kubernetes Engine (GKE) cluster vulnerability detection to include Autopilot mode and integrates with Google security bulletins.

     1 detail in Everything

250. Cortex Analytics: 2024.11.06 Nov 18, 2024 · release notes

     Cortex Analytics adds new detection rules for cloud identity anomalies, subdomain fuzzing, and Okta/SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. honeypot user activities.

     • Adds A cloud identity performed multiple unusual activities Medium Analytics Alert to detect anomalous cloud identity behavior
     • Adds Subdomain Fuzzing Low Analytics Alert to identify DNS subdomain enumeration attempts
     • Adds 7 new Low Analytics BIOCs including Abnormal Communication to a Rare IP, Login attempt by a honey user, and SSO authentication attempt by a honey user
     • Adds 5 new Informational Analytics BIOCs covering AWS database password changes, Linux network share discovery, Okta session impersonation, and device assignment events
     • Adds Okta device assignment Informational Analytics Alert to track when devices are assigned to Okta users

     5 details in Everything

251. Cortex Analytics: 2024.10.09 Nov 11, 2024 · release notes

     Cortex Analytics adds new low/info alerts/BIOCs for Okta, Azure, cloud metadata, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. activity.

     • Adds a new Low Analytics Alert: 'Logs were not collected from a data source for an abnormally long time'
     • Adds four new Informational Analytics BIOCs: A user accessed Okta's admin application, 'An Azure application reached a throttling API rate', Uncommon cloud CLI tool usage, and Unusual resource access by Azure application
     • Adds six new Informational Analytics Alerts: 'A user observed and reported unusual activity in Okta', 'An Azure identity performed multiple actions that were denied', 'Azure enumeration activity using Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint.', Mailbox enumeration activity by Azure application, Microsoft SharePoint enumeration activity, and Microsoft Teams enumeration activity
     • Adds detection for Cloud Unusual Instance Metadata Service (IMDS) access
     • Adds detection for Network traffic to a crypto miner related domain detected

     +1 more show less

     • Adds detection for Penetration testing tool attempt

     6 details in Everything

252. Prisma Access 5.2 Preferred Innovation: Centralized Visibility and Connection Status for All Users Nov 2024 · release notes

     New All Users page in Prisma Access 5.2 for centralized visibility into user connection status, location, and access mode across NGFWs and cloud services.

     • Adds the All Users page to provide comprehensive, centralized visibility of user connections across Next-Generation Firewalls (NGFWs) and Prisma Access.
     • Enables viewing total unique users currently connected to Palo Alto Networks security solutions via the new centralized dashboard.
     • Provides breakdown of users connected through NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. and Prisma Access during specific time ranges.

     3 details in Everything

253. Prisma Access 5.2 Preferred Innovation: Privileged Remote Access Nov 2024 · release notes

     Prisma Access 5.2 adds Privileged Remote Access (PRA) for browser-based RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely./SSH/VNC.

     • Enables clientless browser-based access to nonweb applications like RDP, SSH, and VNC through the Privileged Remote Access (PRA) capability.
     • Integrates PRA with Cloud Identity Engine for authentication.

     2 details in Everything

254. PAN-OS 11.1: Brotli Decompression for Content-Based Threat Detection Nov 2024 · release notes

     PAN-OS 11.1 adds Brotli decompression to the Content-Based Threat Detection engine for HTTP traffic inspection.

     • Enables Advanced Threat Prevention Inline Cloud Analysis to inspect Brotli-compressed content previously dropped or passed through as unsupported.
     • Enables Precision AI optimized Inline Deep Learning Analysis for Advanced URL Filtering on Brotli-compressed HTTP traffic.
     • Integrates a software-based Brotli library into the existing content decoder framework for processing Brotli-encoded streams.

     3 details in Everything

255. Prisma Cloud: Features Introduced in November 2024 Nov 2024 · release notes

     Prisma Cloud adds asset relationship APIs, DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. docs, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Autopilot scanning, UBI micro-image support, and Azure VM disk public access policy.

     • Adds POST /audit/api/v1/log endpoint for paginated audit log retrieval
     • Adds resource.type query parameter to GET /v2/policy and resource.type in response to filter policies by asset type
     • Introduces aws-msk-vpc-connection, aws-servicecatalog-portfolio-share, and aws-lake-formation-* API ingesters for AWS resources
     • Adds azure-active-directory-authentication-methods-registration-campaign Azure policy ingest with updated Policy.Read.All permission requirement
     • Introduces new configuration policies including 'Azure VM disk configured with public network access' and 'GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Table not encrypted with CMEK'

     +7 more show less

     • Adds two new IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies: 'VM/Serverless can impersonate an Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. application...' and 'System/User-assigned managed identity with critical Entra ID permissions'
     • Enables scanning of Red Hat UBI Micro-images (versions 7, 8, and 9) in Secure the Runtime
     • Adds expanded GKE vulnerability detection for Autopilot mode with Google security bulletin integration
     • Introduces Asset Relationship Type Management APIs (get-asset-relationship-type-definitions, get-asset-relationship-definitions)
     • Adds DSPM API documentation site at pan.dev/prisma-cloud/api/dspm/
     • Supports MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v15.1, IRDAI, and updated CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline./NIST compliance standards
     • Increases SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login failure display from 5 to 10 messages in the UI

     12 details in Everything

256. PAN-OS 12.1: Unified Policy Enforcement Using IPv6 Geolocation Nov 2024 · release notes

     PAN-OS 12.1 adds unified IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. geolocation support for country-based Security, Decryption, and DoS policies

     • Enables global IPv6 geolocation mapping to apply country-based Security, Decryption, and DoS Protection policies across dual-stack and IPv6-only environments
     • Allows creation of custom IPv6 address-to-region mappings that take precedence over default global content file mappings

     2 details in Everything

257. Cortex Analytics: 2024.09.25 Oct 29, 2024 · release notes

     Cortex Analytics adds SSH brute force alert and new cloud identity BIOCs

     • Adds SSH brute force attempt informational analytics alert to detect credential stuffing via SSH.
     • Adds 2 new Medium Analytics BIOCs: Cloud snapshot of a database or storage instance was publicly shared and Uncommon DLL-sideloading from a logical CD-ROM (ISO) device.
     • Adds 17 new Informational Analytics BIOCs covering Azure identity events, cloud storage configuration changes, OneDrive activity, and rare RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets./AppleScript execution.

     3 details in Everything

258. Cortex Analytics: 2024.09.18 Oct 8, 2024 · release notes

     Cortex Analytics adds 5 new low and 1 medium BIOC detections; improves logic for over 600 existing rules

     • Adds A Command Line Interface (CLI) command was executed from a GCP serverless compute service detection
     • Adds A Command Line Interface (CLI) command was executed from an AWS serverless compute service detection
     • Adds Kubernetes pod creation from unknown container image registry detection
     • Adds Possible path traversal via HTTP request detection
     • Adds Executable or Script file written by web server process detection

     +2 more show less

     • Adds Rare MS-Update Server was detected detection
     • Adds Unique client computer model was detected via MS-Update protocol detection

     7 details in Everything

259. Prisma Cloud Compute Edition: 33.01 (Build 33.01.137) Oct 6, 2024 · release notes

     Prisma Cloud Compute 33.01 adds Podman Defender deployment with custom socket support.

     • Adds --podman-socket argument to the Linux Container Defender installation script to specify a custom Podman runtime socket path
     • Adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. checksum visibility for Defender images in Console Manage > System > Utilities

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Defenders from versions previous to v30.00 (such as v22.12) will be disconnected from the Console; failure to upgrade Defenders below version v30.00 results in disconnection.
     • !Upgrading from any v31.00 release requires an intermediate upgrade to v32.00 before upgrading to v33.00.
260. Prisma Access 5.2 Preferred Innovation: Israel and Saudi Arabia Strata Logging Service Region Support Oct 2024 · release notes

     Prisma Access 5.2 adds dedicated Strata Logging Service regions for Israel and Saudi Arabia.

261. Prisma Access 5.2 Preferred Innovation: RFC6598 Mobile Users Address Pool for New Prisma Access (Managed by Strata Cloud Manager) Deployments Oct 2024 · release notes

     New Prisma Access deployments managed by Strata Cloud Manager now automatically include a default RFC6598 Mobile User address IP pool.

262. Prisma Access 5.2 Preferred Innovation: Wildcard FQDNs for Simplified ZTNA Connector Policy Management Oct 2024 · release notes

     Prisma Access 5.2 adds wildcard FQDN support for ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector policies to simplify management

     • Adds wildcard FQDN support to ZTNA Connector security policies, allowing a single policy to apply automatically to all discovered applications matching the pattern
     • Removes protocol restrictions (previously limited to HTTP and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.) for wildcard FQDN-based ZTNA Connector policies

     2 details in Everything

263. Prisma Cloud: Features Introduced in October 2024 Oct 2024 · release notes

     Prisma Cloud adds Podman Defender support, SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. checksum verification, Copilot AI interface, satellite-based network exposure detection, and new application-centric securi

     • Support for deploying Defenders on Podman containers with --install-podman flag and optional --podman-socket argument for custom runtime paths
     • SHA-256 checksum validation for Defender image downloads via the Show Checksum button in Manage > System > Utilities
     • Prisma Cloud Copilot AI chat interface for risk prioritization, vulnerability management, and support case creation in stack version 24.10.1
     • Satellite-based Kubernetes Service Exposure detection correlating K8s Services with VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. network info via the new Satellite operator

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The format of external_asset_id for aws-ecr-image resources changes, deleting existing resources and resolving Open alerts to Closed.
     • !VPC peering connection ingestion is restricted to the requester account only, removing resources from the accepter account.
     • !Private AMIs owned by other accounts are no longer ingested unless actively used by EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances in the current account.
     • !gcloud-cloud-function-v1 API is deprecated and metadata ingestion stops; saved searches or policies based on it must be deleted manually.
     • !Resource Explorer endpoints GET/resource, POST /resource/timeline, and POST /resource/raw are deprecated and replaced by POST /uai/v1/asset.
264. PAN-OS 11.1: Support for Proxy ID in IPSec Transport Mode Oct 2024 · release notes

     PAN-OS 11.1 enables IPSec transport mode proxy ID configuration via CLI to fix inter-vendor connectivity failures.

     • Adds proxy-id configuration support for IPSec transport mode via the CLI.

     1 detail in Everything

265. Prisma Access 5.2 Preferred Innovation: Remote Network—High Performance Private App Access Support Oct 2024 · release notes

     Prisma Access 5.2 introduces Remote Network—High Performance for high-bandwidth branch sites with private app access support.

     • Adds Remote Network—High Performance feature to provide high bandwidth per service IP for branch sites
     • Enables private app access support in addition to internet egress for high-performance remote networks

     2 details in Everything

266. Prisma Access 5.2 Preferred Innovation: Disable the Dynamic Privilege Access Enabled Prisma Access Agent Oct 2024 · release notes

     Prisma Access 5.2 allows users to temporarily disable the Prisma Access Agent via the app interface.

267. Cortex Xpanse Expander: October 2024 Oct 2024 · release notes

     Cortex Xpanse Expander Oct 2024: new API endpoints and filter params for assets, services, alerts, websites; UI widget updates.

     • GET /api/business-units endpoint introduced to retrieve business units
     • Added first_observed and last_observed filters to the Get All Assets API endpoint
     • Added first_observed and last_observed filters to the Get All Services API endpoint
     • Added first_observed and last_observed filters to the Get All Alerts API endpoint
     • Added business_units_list filter parameter to the Get All Websites API endpoint

     +1 more show less

     • Risk Trend Over Last 90 Days widget now shows Y-axis title and markers

     6 details in Everything

268. Prisma Access 5.2 Preferred Innovation: Expanded Static IP Address Allocation Criteria and Capacity for Mobile Users Oct 2024 · release notes

     Prisma Access 5.2 adds location and user groups for mobile static IP allocation and increases IP pool capacity.

     • Adds location groups and user groups as criteria for assigning static IP addresses to mobile users
     • Increases the supported number of IP address pool profiles for managing large mobile deployments

     2 details in Everything

269. PAN-OS 11.1: SD-WAN Bandwidth Monitoring Oct 2024 · release notes

     PAN-OS 11.1 adds tunnel bandwidth as a default SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. link performance measure.

     • Adds bandwidth measurement to the SD-WAN tunnel and physical interface view for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. clusters.

     1 detail in Everything

270. Prisma Access 5.2 Preferred Innovation: Explicit Proxy Integration with ZTNA Connector Oct 2024 · release notes

     Prisma Access 5.2 enables Explicit Proxy integration with ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector for high-capacity private app access.

     • Adds Explicit Proxy integration with ZTNA Connector to support ZTNA Connectors with a capacity of up to 10 Gbps for Prisma Browser and Agent Proxy traffic
     • Enables ZTNA Connector support for Cloud Identity Engine (CIE) to allow automatic discovery of private applications
     • Adds support for ZTNA Connector retrieval of private applications in overlapping networks

     3 details in Everything

271. Prisma Access 5.2 Preferred Innovation: Native IPv6 Support for Existing Prisma Access Deployments Oct 2024 · release notes

     Prisma Access 5.2 adds native end-to-end IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for Mobile Users, Remote Networks, and Service Connections.

     • Enables Mobile Users with IPv6-only endpoints to establish connections via GlobalProtect using IPv6

     1 detail in Everything

272. PAN-OS 11.2: Prisma Access Hub Support for SD-WAN enabled Cellular Interfaces (4G/5G) Oct 2024 · release notes

     PAN-OS 11.2 adds Prisma Access hub support for SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. enabled cellular interfaces (4G/5G)

273. Prisma Access 5.2 Preferred Innovation: Scaling ZTNA Connector for High Application Counts Oct 2024 · release notes

     Prisma Access 5.2 raises ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector limits to 10k apps/tenant and 1k apps/connector group.

     • Increases ZTNA application target limit per tenant from previous constraints to 10,000
     • Increases application limit per connector group to 1,000
     • Increases connector limit per tenant to 200

     3 details in Everything

274. Cortex Analytics: 2024.09.04 Sep 24, 2024 · release notes

     Cortex Analytics 2024.09.04 adds new low/info BIOCs and alerts for Azure AD PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic., webshells, and P2P traffic.

     • Adds detection for 'Unusual process accessed a web browser history file' (Low Analytics BIOC)
     • Adds detection for 'Possible webshell file written by a web server process' (Informational Analytics BIOC)
     • Adds detection for 'Download pattern that resembles Peer to Peer traffic' (Informational Analytics Alert)

     3 details in Everything

275. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: GA 2024-09-17 Sep 17, 2024 · release notes

     Cortex XSOAR 8 On-premises GA introduces indicator change visibility, timezone selection for reports, and higher playbook throughput.

     • Added Indicator change visibility to track modifications to security indicators
     • Added Timezone selection for reports to allow localized reporting times
     • Higher playbook throughput for medium- and large-scale deployments

     3 details in Everything

276. Cortex Analytics: 2024.08.28 Sep 11, 2024 · release notes

     Cortex Analytics adds 4 Low and 1 Informational BIOCs plus 1 Informational alert for new detection coverage

     • Adds New FTP Server as a Low severity Analytics BIOC
     • Adds Suspicious SSH Downgrade as a Low severity Analytics BIOC
     • Adds 'Unusual process accessed a crypto wallet's files' as a Low severity Analytics BIOC
     • Adds 'Unusual process accessed a messaging app's files' as a Low severity Analytics BIOC
     • Adds 'Kubernetes Pod Created with host Inter Process Communications (IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory.) namespace' as an Informational Analytics BIOC

     +1 more show less

     • Adds Rare access to known advertising domains as an Informational Analytics Alert

     6 details in Everything

277. Prisma Cloud Compute Edition: 33.00 (Build 33.00.169) Sep 9, 2024 · release notes

     Prisma Cloud Compute 33.00 introduces VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. vulnerability reporting and agentless AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. firewall policy API.

     • Adds lbARN, lbName, and lbType fields to the trafficMirroring > vpcConfig object in the Set Agentless App Firewall Policy API for AWS ALB support
     • Switches vulnerability reporting format from OVAL to VEX for Red Hat security data when Console and Defenders are upgraded to 33.00+

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Failure to upgrade Defenders below version v30.00 (such as v22.12) results in disconnection from the Console.
278. Cortex Analytics: 2024.08.14 Sep 3, 2024 · release notes

     Adds detections for Unusual Netsh PortProxy rule, Multiple Suspicious FTP Login Attempts, and cloud instance stoppage events in Cortex Analytics.

     • Adds Unusual Netsh PortProxy rule BIOC detection to identify potential network tunneling via Netsh.
     • Adds Multiple Suspicious FTP Login Attempts alert detection for brute-force or unauthorized access patterns on FTP servers.
     • Adds A cloud instance was stopped informational BIOC to track termination events of cloud compute resources.

     3 details in Everything

279. Prisma Access 5.2 Preferred Innovation: View Prisma Access, Dataplane, and Application and Threats Versions Sep 2024 · release notes

     Prisma Access 5.2 adds a single-page view for component versions and EoS notifications

     • Adds a unified dashboard page in Strata Cloud Manager to view Prisma Access version, PAN-OS dataplane version, release type (Preferred or Innovation), and Applications and Threats content version for deployments managed by Strata Cloud Manager and Panorama
     • Adds notifications within the single-page view that alert users when their current running Panorama version and plugin versions will reach End-of-Support (EoS)

     2 details in Everything

280. Prisma Access 5.2 Preferred Innovation: Static IP Address Allocation for Mobile Users Sep 2024 · release notes

     Static IP address allocation for Prisma Access Mobile users via IP pools.

     • Adds Static IP Address Allocation feature allowing fixed IP assignment to mobile users.
     • Introduces IP pool definition based on theatre, user, user group, or location group criteria.
     • Enables persistent User-ID mapping for granular IP-based policy enforcement.

     3 details in Everything

281. Prisma Access 5.2 Preferred Innovation: Bandwidth Consumption Sep 2024 · release notes

     Prisma Access 5.2 introduces Aggregated and Per-Site Bandwidth Allocation models for license management.

     • Adds Aggregated Bandwidth Allocation model to calculate peak bandwidth consumption per compute region daily
     • Adds Per-Site Bandwidth Allocation model to calculate peak bandwidth consumption for each individual branch site daily

     2 details in Everything

282. Prisma Access 5.2 Preferred Innovation: Enhanced Management Interface for Large Scale Remote Networks Sep 2024 · release notes

     Strata Cloud Manager adds pagination, search by name, and grouping by compute location to remote network management lists.

     • search text box added to remote network lists, allowing filtering by Name.
     • Grouping by compute location enabled for remote networks and IKE gateways.
     • Pagination controls added to choose rows displayed per page.

     3 details in Everything

283. Prisma Access 5.2 Preferred Innovation: Explicit Proxy Support in China Sep 2024 · release notes

     Prisma Access 5.2 introduces explicit proxy support in China for branch and headless device traffic.

     • Adds explicit proxy support in China to provide a secure internet gateway for users and headless devices without requiring default route changes or GlobalProtect client installation
     • Leverages AWS infrastructure with a 1:1 architecture pairing each Envoy proxy with a proxy firewall virtual machine (VM) to handle traffic securely within local regulatory constraints

     2 details in Everything

284. Prisma Access 5.2 Preferred Innovation: Remote Networks—High Performance Sep 2024 · release notes

     Prisma Access 5.2 adds Remote Network—High Performance for high-bandwidth IPSec termination.

     • Introduces Remote Network—High Performance for scalable IPSec tunnel termination
     • Supports Link Quality Metrics (LQM) to measure jitter, latency, and packet loss
     • Provides in-product recommendations for selecting geographic locations

     3 details in Everything

285. PAN-OS 11.2: SD-WAN on 5G Cellular Interface Sep 2024 · release notes

     PAN-OS 11.2 adds SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. support on 5G cellular interfaces for automatic traffic steering

     • Enables SD-WAN on the 5G cellular interface for automatic traffic steering based on link metrics
     • Adds IPv4 SD-WAN cellular traffic support
     • Supports SD-WAN interface profile and upstream NAT for cellular links

     3 details in Everything

286. Prisma Access 5.2 Preferred Innovation: TLS 1.3 and Pub/Sub Support for Traffic Replication Sep 2024 · release notes

     Prisma Access 5.2 adds TLS 1.3 decryption and Pub/Sub notifications for Traffic Replication PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files

     • Adds Pub/Sub notifications to proactively signal when a new PCAP file is stored, eliminating the need for polling tools.

     1 detail in Everything

287. Cortex Xpanse Expander: Expander Release 2.7 (September 2024) Sep 2024 · release notes

     Expander 2.7 adds QRadar integration, Remediation Report, expanded XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. data and 65k port scanning.

     • Adds outbound QRadar integration for correlating Xpanse-discovered risks
     • Introduces Remediation Report to share risk details by business unit with non-expander users
     • Enhances external services XQL dataset with detailed CVE data, service classification and geolocation fields
     • Enables periodic discovery scans across all 65k ports on 60+ additional protocols for global IPv4 address space
     • Adds alerts overview dashboard showing alert resolution trends and top ten alerts by type/cloud provider over one year

     +3 more show less

     • Adds software version column to the Alerts table for filtering and exporting detected versions
     • Improves active response enrichment by supporting retrieval of Azure Compute instance hierarchy
     • Increases remediation coverage for attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rules: TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. Server, Libssh, Insecure Bitvise SSH Server, Insecure SFTPGo

     8 details in Everything

288. Prisma Access 5.2 Preferred Innovation: Private IP Address Visibility and Enforcement for Agent Based Proxy Traffic Sep 2024 · release notes

     Prisma Access 5.2 enables private IP visibility and enforcement for GlobalProtect agent proxy traffic

289. Cortex XSOAR 8 SaaS: September 2024 Sep 2024 · release notes

     Cortex XSOAR Cloud 8.8 introduces Guard Rails page, indicator enrichment exclusion, expanded audit logs, and multi-layer Canvas graphs.

     • Adds the Guard Rails page to display performance errors and warnings for system stability
     • Adds a search field on the Settings page to quickly find configuration options
     • Expands audit log coverage to include detailed records of incident edits with modified fields
     • Allows indicators (IP, Domain, Email, URL, File) to be marked as Enrichment Excluded
     • Enables feeds to be configured via instance parameters as enrichment excluded

     +2 more show less

     • Supports multi-layer indicator/incident relationship graphs in the Canvas for dynamic attack diagrams
     • Adds support for Red Hat Enterprise Linux 8.10 and 9.4

     7 details in Everything

290. Cortex XDR 3.x: September 2024 Sep 2024 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.12 adds multi-tenant MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. licensing, Windows cloud agent support, AI PowerShell inspection, and Linux Userspace fallback.

     • Adds Enterprise Multi-Tenant & MSSP licensing model for Cortex XDR to streamline child tenant management and data segregation
     • Enhances Palo Alto Networks NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. integration process to support onboarding from multiple CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. accounts into a single Cortex tenant
     • Enables Windows support for the Cortex XDR agent for Cloud, providing unified runtime security, vulnerability, and compliance scanning for Windows OS
     • Introduces AI-powered PowerShell examination in the Windows Malware Profile as part of local analysis capabilities
     • Adds Agent Operation Mode setting in Linux Agent Settings Profile to allow selection of Userspace fallback mode when Kernel Mode is unavailable

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Top Incidents widget has been renamed to Top Open Incidents.
291. PAN-OS 11.1: IKE Gateway with Dynamic IPv6 Address Assignment Sep 2024 · release notes

     PAN-OS 11.1 adds IKE gateway support for dynamic IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses via DHCPv6, PPPoEv6, and 5G modems

292. Prisma Access 5.2 Preferred Innovation: SC-NAT Support for Dynamic Privilege Access Sep 2024 · release notes

     Prisma Access 5.2 adds SC-NAT support with Dynamic Privilege Access to resolve IP exhaustion for private apps.

     • Adds source NAT (SNAT) support via SC-NAT integration with Dynamic Privilege Access (DPA) to map a single IP address for private application access through service connections.
     • Eliminates IPv4 address pool overlap and exhaustion between Prisma Access infrastructure subnets and on-premises data center or headquarters networks.
     • Enables simplified routing for service connections by using SNAT in Dynamic Privilege Access environments.

     3 details in Everything

293. Prisma Access 5.2 Preferred Innovation: IP Optimization for Mobile Users and Explicit Proxy Deployments Sep 2024 · release notes

     Prisma Access 5.2 adds IP Optimization with NAT layer for GlobalProtect and Explicit Proxy to reduce SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. allow list overhead.

     • Adds a new NAT layer for GlobalProtect Mobile Users that ensures autoscaled gateways retain the same IP address, eliminating the need to update external allow lists during autoscaling events.
     • Expands the existing IP Optimization capability to Explicit Proxy connections in Proxy Mode and Tunnel and Proxy Mode deployments, providing consistent source IPs.

     2 details in Everything

294. Prisma Access 5.2 Preferred Innovation: Route Summarization for Dynamic Privilege Access Sep 2024 · release notes

     Prisma Access 5.2 Preferred Innovation introduces route summarization for Dynamic Privilege Access to help enterprises with limited on-premises router capacity by advertising summarized global IP pools instead of numerous project-level routes.

295. Prisma Access 5.2 Preferred Innovation: ZTNA Connector Support for Commitless App Onboarding Sep 2024 · release notes

     Prisma Access 5.2 adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector support for commitless app onboarding

     • ZTNA Connector now supports commitless application onboarding, reducing setup time from 5-10 minutes to under one minute.
     • Enhanced scalability for large enterprises managing over 10,000 applications with rapid policy modifications.

     2 details in Everything

296. Prisma Cloud: Features Introduced in September 2024 Sep 2024 · release notes

     Prisma Cloud adds DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. integration with attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., new Bedrock/DSPM policies, POST vulnerability APIs, and more

     • Adds dataSecurity objects to Asset Explorer API responses for DSPM integration
     • Introduces trafficMirroring > vpcConfig fields (lbARN, lbName, lbType) to the Set Agentless App Firewall Policy API for AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. support
     • Adds new POST endpoints for vulnerability dashboards: Get Vulnerability Impact by Stage - POST, Get Vulnerable Assets - POST, Get Top Impacting Vulnerabilities - POST, Get Vulnerability Overview - POST, Get Prioritized Vulnerabilities - POST, Get CVE Overview - POST, and Get Vulnerable Assets by CVE - POST
     • Adds C2C Trace Asset Graph endpoint to identify vulnerability source details
     • Introduces AWS Logging Account APIs for configuring AWS flow log ingestion accounts

     +5 more show less

     • Supports Package Operational Risk assessment with severity levels (High, Medium, Low) for open-source packages
     • Decorates data stores in Attack Paths with a crown jewel icon and adds a Data tab to the Asset Inventory sidecar displaying data findings
     • Enhances Shared Views to allow setting default visibility (Make this dashboard visible for all viewers) when sharing custom views via Home > Alerts > Manage Views
     • Adds Jira integration support for versions 9.0 and above, including Jira Cloud and On-Premise
     • Transitions Red Hat security data reporting from OVAL to VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. format for vulnerability scanning

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The azure-active-directory-credential-user-registration-details API is deprecated and no longer ingests metadata; RQL auto-completion for this API name is removed. Existing saved searches or custom policies using this API must be manually deleted, and alerts will resolve as Policy_Deleted.
297. Prisma Access 5.2 Preferred Innovation: Granular Role-Based Access for Cloud Services Sep 2024 · release notes

     Prisma Access 5.2 Preferred Innovation enhances administrative security by allowing granular control over the Cloud Services plugin within Panorama admin roles.

298. PAN-OS 11.2: Explicit Proxy Support for Advanced Services Sep 2024 · release notes

     PAN-OS 11.2 adds explicit proxy support for Advanced WildFire, Threat Prevention, URL Filtering, App-ID Cloud Engine, and Enterprise DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. services

299. Cortex Analytics: 2024.07.31 Aug 13, 2024 · release notes

     Cortex Analytics adds new detections for KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access., SPN enumeration, and internal login password spray.

     • Possible Kerberoasting attack Medium Analytics Alert is now available
     • Abnormal Communication to a Rare Domain Informational Analytics BIOCs is now available
     • DLP sensitive data exposed to external users Informational Analytics BIOCs is now available

     3 details in Everything

300. Cortex Analytics: 2024.07.24 Aug 7, 2024 · release notes

     Cortex Analytics 2024.07.24 adds new BIOCs and updates detection logic for cloud, Kubernetes, and identity threats

     • Added Collection error High Analytics BIOC to detect collection failures.
     • Added Correlation rule error Medium Analytics BIOC.
     • Added Error in event forwarding Medium Analytics BIOC.
     • Added 'A rare FTP user has been detected on an existing FTP server' Low Analytics BIOC.
     • Added Cloud email service activity Low Analytics BIOC.

     +12 more show less

     • Added Rare DLP rule match by user Informational Analytics BIOC.
     • Improved logic for Copy a process memory file High Analytics BIOC.
     • Improved logic for 'Execution of the Hydra Linux password brute-force tool' Medium Analytics BIOC.
     • Improved logic for Kubernetes vulnerability scanning tool usage Medium Analytics BIOC.
     • Improved logic for 'Recurring rare domain access from an unsigned process' Medium Analytics BIOC.
     • Improved logic for 'Windows LOLBIN executable connected to a rare external host' Medium Analytics BIOC.
     • Improved logic for 18 Low Analytics BIOCs including An uncommon service was started and Masquerading as the Linux crond process.
     • Improved logic for Impossible traveler - SSO and Impossible traveler - VPN alerts.
     • Improved logic for 31 Informational Analytics BIOCs covering Kubernetes pod creation, PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. modification, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. enumeration.
     • Improved logic for 4 Informational Analytics Alerts including Kubernetes enumeration activity.
     • Decreased severity of 'A process modified an SSH authorized_keys file' to Informational.
     • Changed metadata for 'Discovery of misconfigured certificate templates using LDAP' Medium Analytics BIOC.

     17 details in Everything

301. Prisma Cloud: Features Introduced in August 2024 Aug 2024 · release notes

     Prisma Cloud introduces DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores./AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. GA, MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions., Code-to-Cloud tracing, AI queries, and RQL AWS key fields

     • Data Security Posture Management and AI Security Posture Management modules are now generally available for subscription via the console.
     • New Managed Security Service Provider capability allows administering large customer groups from a single console with dynamic tenant creation, industry segmentation, and credit reallocation.
     • Code to Cloud Tracing for Vulnerabilities traces runtime container image vulnerabilities back to their root cause in build (package manager files, Dockerfiles, base images).
     • Vulnerabilities Dashboard gains Account Group and Cloud Account filters, a Vulnerable Assets widget, and toggling View By between CVE and Asset views.
     • AI Assisted Queries toggle enables semantic searchsemantic searchSearching by meaning rather than requiring the same words. It commonly compares vector representations to find related content, even when the wording differs. in the query launcher, interpreting natural language like public facing to return relevant saved searches.

     +6 more show less

     • New RQL fields for AWS Access Key discovery: source.cloud.accesskey.lastused.days and source.cloud.accesskey.activekeys.
     • Custom Build Policies support a new AI and Machine Learning category in both YAML (Code Editor) and Visual Editor templates.
     • Resource Classes filter is available under Application Security > Inventory > IaC Resources, with supported values including Compute, Storage, Network, Identity & Security, Database, AI and Machine Learning, Analytics, Code, and Others.
     • Blocklist Resource Control allows defining granular resource controls to block specific Terraform resource types in custom build policies.
     • New compliance benchmarks added: SEBI CSCRF, SCF 2024.2, NIST SP 800-171 Revision 3, and CIS Controls v8.1.
     • Get Vulnerabilities by RQL API accepts a new View query parameter (values: CVE, Asset) to control vulnerability detail grouping.

     11 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Multiselect is disabled for the Alert Rule Name filter on the Alerts > Overview page; only one rule name can be selected in API requests via POST/alerts/policy.
     • !User-generated reports are now restricted to System Administrators and users with the same role due to RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. implementation.
     • !Create/Update Policy permissions are split into Policy and Manage Policy Compliance Mapping; new custom permission groups must explicitly select both to assign compliance mappings.
     • !azure-timeseriesinsights-environments and azure-datacatalog-catalog APIs are deprecated and no longer ingested; saved searches or policies based on these keys will be resolved as Policy_Deleted.
302. Cortex Analytics: 2024.07.17 Aug 1, 2024 · release notes

     New Informational BIOC for rare DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rule matches and improved logic across 51 existing BIOCs and alerts.

     • Rare DLP rule match by user is added as a new Informational Analytics BIOC to detect data loss events triggered by specific DLP policies rather than generic content matches.

     1 detail in Everything

303. Prisma Cloud Compute Edition: 32.07 (Build 32.07.123) Jul 22, 2024 · release notes

     Prisma Cloud Compute Edition 32.07 adds Partially Completed registry scan status and API label support.

     • Adds the Partially Completed status for registry scans to show when at least one image has been successfully scanned.
     • Adds the optional includeLabels query parameter to the [Download Container Scan Results](https://pan.dev/prisma-cloud/api/cwpp/get-containers-download/) API to include container labels in the response.

     2 details in Everything

304. Cortex Xpanse Expander: July 2024 Jul 2024 · release notes

     Cortex Xpanse Expander July 2024 hotfix adds attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. test fields to API responses.

     • Get All Services and Get Service Details API responses now include the attack surface test fields even when attack surface testing is disabled.

     1 detail in Everything

305. Prisma Access 5.1 Preferred Innovation: Deleting Unused ZTNA Connector IP Blocks Jul 2024 · release notes

     Prisma Access 5.1 enables secure deletion of unused ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector IP blocks

     • Adds ability to delete unused ZTNA Connector IP blocks after removing all associated connectors and applications.

     1 detail in Everything

306. Prisma Cloud: Features Introduced in July 2024 Jul 2024 · release notes

     Prisma Cloud adds RQL attributes for cloud workload identitiesworkload identitiesAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. and last access detection, .NET Central Package Management support, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. regions, and new compliance standards.

     • Adds grantedby.cloud.entity.lastlogin attribute to RQL queries to detect inactive cloud service accounts in AWS and Azure environments.
     • Adds source.cloud.account.isvendor attribute to RQL queries to identify validated vendor access in AWS and GCP environments.
     • Adds source.MFAenabled attribute to RQL queries to identify users without Multi-Factor Authentication enabled.
     • Supports .NET Central Package Management by scanning dependencies defined in the Directory.Packages.props file via Software Composition Analysis (SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself.).
     • Ingests data for OCI resources deployed in Chicago, Madrid, Paris, and Queretaro cloud regions.

     +10 more show less

     • Adds a Network Flowlog filter to the Inventory > Unmanaged Assets page to search for internet-exposed assets connected to secured assets.
     • Enables CSV bulk download of all CVE data from the table view using the Download > Download all CVE data option, limited to 10K records.
     • Introduces three new widgets on the Vulnerabilities dashboard: Overview (Unique CVEs/Vulnerabilities Remediated), Vulnerabilities Funnel, and Most Important Vulnerabilities.
     • Adds a CVE Preview Card feature to highlight key CVE information directly in the table view without opening the sidecar.
     • Displays real-time counts of unique CVEs, vulnerabilities, and affected assets in the Vulnerability Results table view.
     • Introduces a Partially Completed status for registry scans when at least one image has been successfully scanned.
     • Adds support for Digital Operational Resilience Act (DORA), Australian Cyber Security Centre (ACSC) Essential Eight Levels 1-3, and new CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. GCP policy mappings as built-in compliance standards.
     • Exposes a new GET /uve/api/v1/vulnerabilities/search/download endpoint to download all vulnerabilities from an RQL search in CSV format.
     • Exposes a new GET /uve/api/v4/dashboard/vulnerabilities/prioritised endpoint to retrieve prioritized vulnerability data for the dashboard.
     • Adds the managedCommunication parameter to CDEM asset inventory API endpoints (GET asm/api/v1/asset, etc.) to filter internet-exposed assets connected to secured assets.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The sourcerepo.googleapis.com service has been removed; Prisma Cloud no longer ingests metadata from the gcloud-cloud-source-repository API for accounts newly onboarded after June 6th, 2024.
     • !Compliance and Asset Inventory trendlines now display data only from the past one year; snapshots older than one year are not retained.
     • !Requests to the /audit/redlock endpoint exceeding 100K records now return a 413 Payload Too Large error.
     • !The PUT /user/role API is subject to a rate limit of Limit=3, Burst=3, returning HTTP 429 if exceeded.
307. Cortex XDR 3.x: July 2024 Jul 2024 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.11 adds host file bypass for DNS queries on XDR Collectors.

     • XDR Collectors now bypass the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) during DNS queries on Windows and Linux agents.

     1 detail in Everything

308. PAN-OS 11.1: Encrypted DNS for DNS Proxy and the Management Interface Jul 2024 · release notes

     PAN-OS 11.1 adds encrypted DNS (DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring./DoTDoTDNS over TLS: an IETF standard (RFC 7858) that wraps DNS queries in a TLS session on port 853, preventing eavesdropping and tampering that plain UDP DNS allows.) support for both the DNS Proxy and the Management Interface

     • Enables configuration of encrypted DNS (DoH or DoT) for the firewall's DNS Proxy service, with fallback to cleartext if servers reject encryption or timeout.
     • Adds ability to enable encrypted DNS on the firewall's Management Interface itself, allowing management traffic to resolve via DoH, DoT, or cleartext.

     2 details in Everything

309. Cortex Analytics: 2024.05.22 Jun 18, 2024 · release notes

     Cortex Analytics adds two new low-severity BIOCs for rare SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. sessions and uncommon browser extensions.

     • Added a BIOC for "Rare SMB session to a remote host".
     • Added a BIOC for Uncommon browser extension loaded.
     • Added a BIOC for Unusual DB process spawning a shell.

     3 details in Everything

310. Prisma Cloud Compute Edition: 32.06 (Build 32.06.113) Jun 10, 2024 · release notes

     Prisma Cloud Compute 32.06 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export (API/twistcli), Go symbol extraction toggle, Harbor registry support, and cluster name resolution via API server.

     • Adds --SBOM [file_format] flag to twistcli image scan commands to export SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in cyclonedx_json or cyclonedx_xml format
     • Adds new field clusterNameResolvingMethod (values: default, manual, api-server) to the Generate Daemonset Deployment YAML File and Generate a Helm Deployment Chart for Defender APIs
     • Adds core-symbol-extraction-enabled=false Launch Darkly setting in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. to disable Go symbol extraction for binary scans
     • Adds new Harbor registry type option to the version field of the Add Registry Settings API (POST /settings/registry)
     • Adds seven new SBOM download endpoints: /api/get-sbom-download-images/, /api/get-sbom-download-hosts/, /api/get-sbom-download-vms/, /api/get-sbom-download-serverless/, /api/get-sbom-download-registry/, /api/get-sbom-download-cli-serverless/, and /api/get-sbom-download-cli-images/

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The View Registry Scan Progress API (GET /registry-progress) response no longer includes the hostname or scanTime fields within discovery and imageScan; adds type field and specScanStartTime at root.
     • !Defender versions below v30.xx can no longer connect to this release; supported Defender versions are now v32.xx, v31.xx, and v30.xx.
311. Cortex Xpanse Expander: Expander Release 2.6 (June 2024) Jun 2024 · release notes

     Expander 2.6 adds Inventory Tag Rules, new API endpoints for asset tagging, Threat Report generation, SBAC for Threat Response, and XSOAR pack enhancements.

     • Adds Inventory Tag Rules to automate custom tag assignment for IPv4 addresses, domains, certificates, and Prisma Cloud resources
     • Adds new domain and certificate identifier fields to the Inventory view
     • Adds Remediation Guidance and Certificate Subject Organization fields to the Alerts table
     • Exposes new API endpoints: Override Business Units for Assets, Create User Defined IP Ranges (with tags), and Delete Unused Asset Tags
     • Enables generation of Threat Reports on zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. threats and impacted assets per business unit

     +4 more show less

     • Adds SBAC support to the Threat Response Center so scoped users see all widgets
     • Enables Slack notifications for newly discovered ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. risks
     • Automates remediation for select attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rules via patching for Linux (Ubuntu only) through AWS Systems Manager
     • Adds Xpanse Expander v2 Feed integration, new XSOAR layout for Xpanse alerts, indicator extraction support, and Reopened alert status to the Cortex Xpanse XSOAR pack

     9 details in Everything

312. Cortex Xpanse Expander: June 2024 Jun 2024 · release notes

     Cortex Xpanse Expander June 2024 adds Resolution Comment field to alerts table and column order improvements.

     • Improved the default order of the columns on the services page

     1 detail in Everything

313. Prisma Access 5.1 Preferred Innovation: Native IPv6 Compatibility Jun 2024 · release notes

     Prisma Access 5.1 adds native end-to-end IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support for Mobile Users, Remote Networks, and Service Connections.

     • Adds comprehensive end-to-end IPv6 support for Mobile Users, allowing mobile clients to connect via IPv6 using GlobalProtect when their endpoints are IPv6-only.
     • Enables Secure Access to public SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. applications over the internet via IPv6 connections for Remote Networks.
     • Adds support for Service Connections over IPv6, enabling secure access to destinations that necessitate IPv6.

     3 details in Everything

314. Prisma Access 5.0 Preferred Innovation: Saudi Arabia Compute Location Jun 2024 · release notes

     Prisma Access 5.0 Preferred Innovation adds a dedicated Saudi Arabia compute location for improved data locality and latency.

     • Adds a dedicated Saudi Arabia compute location to Prisma Access to improve data locality and reduce latency for regional users.
     • Enables migration of existing Saudi Arabia deployments from the previous access location to the new enhanced compute infrastructure.

     2 details in Everything

315. Prisma Cloud: Features Introduced in June 2024 Jun 2024 · release notes

     Prisma Cloud adds Ansible scanning, PackageJSON v3 SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export, Go symbol extraction, and multiple API endpoints.

     • Adds --sbom flag to the twistcli image scan command to export Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in cyclonedx_json or cyclonedx_xml format
     • Adds SYMBOL_EXTRACTION_ENABLED=False environment variable in twistlock.cfg (self-hosted) to disable Go symbol extraction for scanned binaries
     • Adds core-symbol-extraction-enabled=False Launch Darkly flag (SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.) to selectively disable Go symbol extraction
     • Adds support for scanning Ansible Infrastructure as Code templates for misconfigurations via built-in policies
     • Adds SCA support for package-lock.json v3 (PackageJSON v3) enabling vulnerability and license detection in JavaScript projects

     +14 more show less

     • Adds Cluster name resolving method field in the Defender manual deployment UI with options: Default, Manual, and API Server
     • Adds new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for CI/CD Risks: /pipeline-risks-get-all, /pipeline-risks-get-alerts-by-policy, /pipeline-risks-get-details-by-policy-get, /pipeline-risks-suppress-events, /pipeline-risks-unsuppress-events
     • Adds new Technologies API endpoints: /get-apps, /get-webhooks, /assets-inventory-get-all, /get-ci-inventory
     • Adds Get Repositories Page endpoint at /code/get-vcs-repository-page/
     • Adds SBOM dependency endpoint /code/sbom-dependencies/ and re-categorizes existing BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. report endpoint under SBOM
     • Adds new IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. API endpoints for least privilege access: GET /iam/api/v1/resources/:resourceId/over-permissive-metadata, GET /iam/api/v1/resources/:resourceId/existing-least-privileged-access, and GET /iam/api/v1/resources/:resourceId/custom-least-privileged-access
     • Adds CDEM API endpoints for unmanaged assets: GET /asm/api/v1/asset/{asset_id}/vulnerability, GET /asm/api/v1/asset/vulnerability, GET asm/api/v1/asset/snoozed-regex
     • Adds accountMappingStatus filter parameter to CDEM asset inventory and aggregation endpoints
     • Adds regex parameter support to POST /asm/api/v1/asset/snooze and POST /asm/api/v1/asset/reopen for bulk snooze/unsnooze
     • Adds new SBOM download API endpoints for Images, Hosts, VMs, Serverless, Registry, and CLI variants
     • Adds Harbor as a valid value for the version field in the POST /settings-registry/ API
     • Adds clusterNameResolvingMethod optional field to Daemonset YAML and Helm chart generation APIs
     • Adds support for DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. compliance standards: GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification., ISO27001, NIST, PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. v4, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria. Type 2
     • Adds AWS CodeCommit integration for version control scanning

     19 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The hostname and scanTime fields are removed from the discovery and imageScan properties in the response of the GET /registry-progress/ API
     • !Azure Data Lake Analytics and Azure Data Lake Storage Gen1 Services APIs (azure-data-lake-analytics-account, azure-data-lake-store-gen1-account) are no longer ingested due to deprecation
316. Cortex XSOAR 8 SaaS: June 2024 Jun 2024 · release notes

     Cortex XSOAR 8.7 adds migration wizard, Oracle Linux support, new integrations (Zoom Mail, AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., GitHub Feed), and YARA indicators.

     • Adds a built-in wizard to migrate data, configurations, and settings from Cortex XSOAR 6.13 On-prem to Cortex XSOAR 8 SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.
     • Adds Oracle Linux 8.9 and 9.3 as supported operating systems for engine installation
     • Adds the ability to select the timezone of a report
     • Adds admin capability to manage notification distribution by adding or removing tenant stakeholders' email addresses in Server Settings
     • Adds Zoom Mail integration for email creation, deletion, and user management

     +4 more show less

     • Adds AWS EKS integration for managing Amazon Elastic Kubernetes Service clusters
     • Adds GitHub Feed to fetch indicators from GitHub repositories
     • Adds Yara Rule as a new indicator type in the Yara content pack
     • Adds Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Malicious Pod Response Playbook with master and sub-playbooks for pod remediation

     9 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !OpenSSL versions 1.1.0 and earlier are no longer supported
     • !CentOS 7.x is no longer a supported operating system for engine installation
317. Prisma Access 5.0 Preferred Innovation: IP Optimization for Mobile Users - GlobalProtect Deployments Jun 2024 · release notes

     Prisma Access 5.0 Preferred Innovation introduces IP Optimization to reduce egress IP count for mobile users.

     • Introduces IP Optimization capability that significantly reduces the total number of public IP addresses required for GlobalProtect mobile user deployments by managing fewer egress, gateway, and network load balancer IPs.

     1 detail in Everything

318. Cortex XDR 3.x: June 2024 Jun 2024 · release notes

     New XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. capabilities: Shellcode AI protection, kernel-level bootkit defense, Browser Collections forensics, and API-driven lookup dataset management.

     • Introduces Shellcode AI Protection Module using Precision AI™ machine learning rules to prevent in-memory shellcode attacks on Windows.
     • Adds Dynamic Kernel Protection Module that loads during boot to protect against kernel-level threats like bootkits and rootkits.
     • Adds Crypto Wallet BTP Support via updated Behavioral Threat Protection (BTP) rules to block attackers stealing or manipulating cryptocurrency wallets on Windows and macOS.
     • Introduces Combined alerts using correlation rules allowing the transaction stage in scheduled correlation rules to group events from different datasets into a single alert.
     • Adds new actions for executable files reported as 'benign with low confidence' on macOS endpoints.

     +3 more show less

     • Adds Browser Collections support in Forensic Hunts for Web History searches across Chrome, Edge, Firefox, Internet Explorer, Safari, and custom Chromium browsers.
     • Introduces XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. standard deviation aggregate functions stddev_pop and stddev_sample.
     • Adds support for comma-separated syntax in incidr and incidr6 functions and operators within Correlation Rules and Query Builder.

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !OpenSSL versions prior to 1.1.1 are no longer supported for Syslog servers configured in Event Notification Forwarding.
     • !XQL filter stage behavior changed: triple double quotes now match exact prefixes rather than containing results; single double quotes should be used for containment matching.
319. Cortex Analytics: 2024.05.08 May 27, 2024 · release notes

     Cortex Analytics adds two new Low-severity BIOCs for rare RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. and scripting engine connections.

     • Adds Rare RDP session to a remote host as a new Low Analytics BIOC
     • Adds Scripting engine connected to a rare external host as a new Low Analytics BIOC

     2 details in Everything

320. Cortex Analytics: 2024.05.01 May 16, 2024 · release notes

     Cortex Analytics adds 10 new BIOCs covering Kubernetes, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., Okta, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. detections

     • Adds the Kubernetes scanning activity Medium BIOC for detecting reconnaissance in container environments
     • Adds five Low-severity BIOCs: Abnormal Communication to Rare IP, Abnormal Recurring Communications to Rare IP, 'Known service display name with uncommon image-path', 'Known service name with an uncommon image-path', and 'Kubernetes pod creation from unknown container image registry'
     • Adds four Informational-level BIOCs: 'A Kubernetes Pod was created with a sidecar container', First SSO Resource Access in the Organization, Okta admin privilege assignment, and Weakly-Encrypted Kerberos TGT Response
     • Improves logic for the High-severity BIOC Editing ld.so.preload for persistence and injection
     • Improves logic for three Medium BIOCs: 'A TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream was created directly in a shell', 'Execution of the Hydra Linux password brute-force tool', and 'Recurring rare domain access from an unsigned process'

     +5 more show less

     • Improves logic for one Medium Alert: New Administrative Behavior
     • Improves logic for four Low BIOCs: Azure domain federation settings modification attempt, Rare file transfer over SMB protocol, Suspicious domain suffix, and 'Suspicious process modified an SSH authorized_keys file'
     • Improves logic for two Low Alerts: Failed Connections and Large Upload (Generic)
     • Improves logic for five Informational BIOCs: 'A cloud snapshot was created or modified', AWS SSM send command attempt, 'Rare AppID usage to a rare destination', Rare process execution by user, and Rare process execution in organization
     • Improves logic for three Informational Alerts: Multiple Rare Process Executions in Organization, Port Scan, and SSH authentication brute force attempts

     10 details in Everything

321. Prisma Cloud Compute Edition: 32.05 (Build 32.05.124) May 6, 2024 · release notes

     Prisma Cloud Compute 32.05 adds Go OS-specific eval, GCR/GAR scanning, Serverless Defender Java 17/21, REFRESH_INTERVAL_SECONDS env var, and Account Origin filter

     • REFRESH_INTERVAL_SECONDS environment variable added to the Console to control Defender polling frequency for TAS applications.
     • Serverless Defender now supports Java 17 and Java 21 runtimes.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Send Debug Logs to Support button in Manage > Logs > Console is deprecated; you must use the Download Logs icon instead.
322. PAN-OS 11.1: OOXML Support for WildFire Inline ML May 2024 · release notes

     PAN-OS 11.1 adds an OOXMLOOXMLAn ISO-standardized file format family for Office documents (Word, Excel, PowerPoint), maintained by Microsoft, that stores content as XML inside a ZIP archive, giving cyber tools a parseable, scriptable structure for document analysis. analysis classification engine for WildFire Inline ML to detect malicious Office Open XML files.

     • Enables dynamic detection of malicious files by evaluating file details for high probability classification using machine learning analytics.

     1 detail in Everything

323. Prisma Access 5.1 Preferred Innovation: Advanced Threat Prevention: Support for Zero-day Exploit Prevention May 2024 · release notes

     Prisma Access 5.1 Preferred Innovation introduces automatic cloud-side detection updates and inline analysis for SQL and command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. via the Advanced Threat Prevention service.

324. PAN-OS 11.2: GTP Support for Intelligent Security May 2024 · release notes

     PAN-OS 11.2 adds GTP protocol support for UEIP Correlation in Intelligent Security

325. Prisma Access 5.1 Preferred Innovation: IPSec Serviceability May 2024 · release notes

     Prisma Access 5.1 adds IPSec tunnel diagnostics UI for routing, SA clearing, and IKE renegotiation

     • New IPSec tunnel diagnostics view provides real-time monitoring status and reason codes for downed tunnels.
     • New Clear Security Associations action allows manual teardown of existing IPSec tunnels via the UI.
     • New IKE Renegotiate button enables triggering an IKE renegotiation for a specific service or remote network connection.

     3 details in Everything

326. PAN-OS 11.1: Additional SD-WAN Hubs in VPN Cluster May 2024 · release notes

     PAN-OS 11.1 raises the configurable SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. hub count in a VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. cluster from 4 to 16.

     • Increases the maximum number of hubs configurable in a single VPN cluster from 4 to 16

     1 detail in Everything

327. PAN-OS 11.1: PA-450R-5G Next-Generation Firewall May 2024 · release notes

     PAN-OS 11.1 for PA-450R-5G ruggedized firewall introduces enterprise-grade security with 5G connectivity and fanless design.

     • PA-450R-5G hardware adds four 5G multi-band antennas and two nano SIM card slots for dual mobile network provider support
     • Front panel provides two SFP/RJ-45 combo ports and six RJ-45 ports for versatile network connections in harsh industrial environments
     • Fanless design with DC power and power redundancy enables installation on flat surfaces, walls, or racks at remote sites

     3 details in Everything

328. Prisma Access 5.1 Preferred Innovation: App Acceleration Support for Additional Apps May 2024 · release notes

     Prisma Access 5.1 adds App Acceleration for AWS S3, Azure Storage, Box, Google Drive, OneDrive, Salesforce, SAP Ariba, ServiceNow, Slack, and Zoom.

329. PAN-OS 11.2: Increased Maximum Number of Security Rules for PA-3400 Series Firewalls May 2024 · release notes

     PAN-OS 11.2 increases max security rules on PA-3400 series from 2,500 to 10,000

     • Increases maximum supported security rules from 2,500 to 10,000 for PA-3410 and PA-3420 firewalls

     1 detail in Everything

330. Prisma Access 5.1 Preferred Innovation: Calgary and South Africa Central Compute Locations May 2024 · release notes

     Prisma Access 5.1 adds Calgary (Canada West) and South Africa Central compute locations

     • Adds Canada West (Calgary) compute location for new Prisma Access deployments
     • Adds South Africa Central compute location for new Prisma Access deployments

     2 details in Everything

331. PAN-OS 11.2: Additional Private Link Types for SD-WAN May 2024 · release notes

     PAN-OS 11.2 adds Private 1-4 link types to SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. plugin for multi-provider peering

332. Prisma Access 5.1 Preferred Innovation: Business Continuity During Mergers and Acquisitions May 2024 · release notes

     Prisma Access 5.1 Preferred Innovation introduces gateway renaming to support M&A brand transitions

     • Adds the ability to rename Prisma Access gateways, updating the UI and logs to reflect the new brand name.

     1 detail in Everything

333. PAN-OS 11.2: TLSv1.3 Inbound Inspection with HSM-Protected Keys May 2024 · release notes

     PAN-OS 11.2 adds TLSv1.3 inbound inspection with HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.-protected keys

     • Enables SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inbound Inspection for TLSv1.3 sessions when private keys are stored on an HSM, eliminating the automatic downgrade to TLSv1.2

     1 detail in Everything

334. Prisma Access 5.1 Preferred Innovation: Remote Network Tunnel Automation API May 2024 · release notes

     Prisma Access 5.1 adds Remote Network Tunnel Automation API for SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. integration

335. Cortex Xpanse Expander: May 2024 May 2024 · release notes

     Cortex Xpanse Expander adds Incident and Alert Search, a redesigned Service Details page, and expanded access to vulnerability tests.

     • Adds the ability to search the content of Alerts and Incidents tables directly.

     1 detail in Everything

336. Prisma Access 5.1 Preferred Innovation: Prisma Access Internal Gateway May 2024 · release notes

     Prisma Access 5.1 introduces a native internal gateway for User-ID learning without on-premises deployment.

337. Prisma Access 5.1 Preferred Innovation: Explicit Proxy Forwarding Profiles with Multiple PAC File Support May 2024 · release notes

     Prisma Access 5.1 introduces Forwarding Profiles to replace single PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files for explicit proxy traffic management.

     • Adds Forwarding Profiles as a new object type in Prisma Access for defining explicit proxy forwarding rules and bypass logic.
     • Enables import of existing single or multiple .pac files into Forwarding Profiles for migration and simultaneous multi-profile management.
     • Supports use of Forwarding Profiles with GlobalProtect in Proxy, Tunnel, and Proxy mode traffic flows.

     3 details in Everything

338. PAN-OS 11.1: Additional Private Link Types for SD-WAN May 2024 · release notes

     PAN-OS 11.1 SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. adds Private 1-4 link types for one-to-one device peering

     • Adds Private 1, Private 2, Private 3, and Private 4 link types to the SD-WAN plugin, enabling unique assignment for distinct private providers

     1 detail in Everything

339. Prisma Access 5.1 Preferred Innovation: GlobalProtect Proxy Enhancements May 2024 · release notes

     GlobalProtect Proxy now supports all IPv4 TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections and multiple Explicit Proxy channels for region-specific needs.

     • GlobalProtect Proxy supports all IPv4 TCP connections, including non-proxy-aware traffic
     • GlobalProtect Proxy supports multiple Explicit Proxy channels to different regions
     • Prisma Access Insights surfaces GlobalProtect Proxy data under Mobile Users - GlobalProtect with additional metrics

     3 details in Everything

340. PAN-OS 11.1: Multiple Virtual Routers Support on SD-WAN Hubs May 2024 · release notes

     PAN-OS 11.1 adds Multiple Virtual Routers support on SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. hubs for traffic segregation.

     • Enables multiple virtual routers on the SD-WAN hub to separate branch traffic.
     • Allows overlapping IP subnets on branches connecting to the same SD-WAN hub.

     2 details in Everything

341. Prisma Access 5.1 Preferred Innovation: Static IP Address Enhancements for Mobile Users May 2024 · release notes

     Prisma Access 5.1 allows static IP assignment for mobile users via location groups and user groups.

     • Adds location groups and user groups as criteria for assigning static IP addresses to mobile users
     • Increases the supported number of IP address pool profiles to 10,000
     • Enables monitoring of static IP enhancements in Activity Insights

     3 details in Everything

342. Prisma Cloud: Features Introduced in May 2024 May 2024 · release notes

     Prisma Cloud adds Identity dashboard, third-party vendor detection, risk factors, configurable fix PRs, Security Lake integration, and new compliance standards.

     • Adds an out-of-the-box Identity dashboard to visualize identity-based threats in the Console
     • Enhances Permissions queries with the grantedby.cloud.policy.isExcessive RQL attribute for over-privileged access detection
     • Surfaces third-party vendor account information via the source.cloud.account.isvendor RQL query filter
     • Introduces Risk Factors indicators to prioritize code-to-cloud security vulnerabilities in the Console
     • Enables custom pull request titles and branch names for suggested fixes via PR customization settings

     5 details in Everything

343. PAN-OS 11.2: Additional SD-WAN Hubs in VPN Cluster May 2024 · release notes

     PAN-OS 11.2 increases SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. hubs per VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. cluster from 4 to 16

344. PAN-OS 11.2: Authenticate LSVPN Satellite with Serial Number and IP Address Method May 2024 · release notes

     PAN-OS 11.2 adds satellite-serialnumberip-auth CLI commands to enable unattended LSVPN satellite authentication via serial number and IP allow list.

     └──▷ USE IT
     Enable the new authentication method so satellites can auto-connect after power-on.
     shell copy

     set global-protect satellite-serialnumberip-auth enable

     • Adds the set global-protect satellite-serialnumberip-auth enable CLI command to enable serial number and IP address authentication for GlobalProtect satellites
     • Adds the satellite-ip-allowlist parameter to the set global-protect global-protect-portal portal <portal_name> satellite-serialnumberip-auth command to define allowed satellite IP addresses

     2 details in Everything

345. Prisma Access 5.1 Preferred Innovation: GlobalProtect Proxy: Simplified Configuration May 2024 · release notes

     GlobalProtect proxy-only mode no longer requires a mobile user gateway

346. PAN-OS 11.2: SD-WAN Bandwidth Monitoring May 2024 · release notes

     PAN-OS 11.2 improves SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. troubleshooting by adding tunnel bandwidth visibility to the default VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. monitor view.

347. Prisma Access 5.1 Preferred Innovation: Juniper Mist Integration for SASE Health May 2024 · release notes

     Prisma Access 5.1 Preferred Innovation adds Juniper Mist integration for SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. Health visibility in Strata Cloud Manager

     • Enables visibility and management of third-party network devices and alerts from the Strata Cloud Manager (SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows.) interface via Juniper Mist integration
     • Provides a single pane of glass for diagnosing branch site issues by extending LAN health and performance insights to the SCM dashboard
     • Offers SASE Health view of Juniper Mist infrastructure including device inventory, high availability status, impacted users, and root causes of service degradation

     3 details in Everything

348. PAN-OS 11.1: Virtual Systems Support on VM-Series Firewall May 2024 · release notes

     PAN-OS 11.1 adds Virtual Systems support to VM-Series firewalls for multi-tenant segmentation.

     • Enables creation of separate, logical firewall instances (Virtual Systems) within a single physical VM-Series firewall for segmented administration and scalable deployment.

     1 detail in Everything

349. PAN-OS 10.2: App Acceleration Support for Additional Apps May 2024 · release notes

     PAN-OS 10.2 adds App Acceleration support for AWS S3, Azure Storage, Box, Google Drive, OneDrive, Salesforce, SAP Ariba, ServiceNow, Slack file downloads, and Zoom file downl

350. PAN-OS 11.1: Authenticate LSVPN Satellite with Serial Number and IP Address Method May 2024 · release notes

     PAN-OS 11.1 adds Satellite Serial Number and IP Address Authentication for LSVPN to enable unattended satellite onboarding.

     └──▷ TRY IT
     Enable the Serial number and IP address Authentication method on the device.
     copy

     $ set global-protect satellite-serialnumberip-auth enable

     • Adds the Serial number and IP address Authentication method for GlobalProtect portal authentication, allowing automated satellite onboarding without manual intervention
     • Adds the set global-protect global-protect-portal portal <portal_name> satellite-serialnumberip-auth satellite-ip-allowlist entry <value> CLI command to configure the IP allow list for serial/IP auth
     • Adds the set global-protect satellite-serialnumberip-auth enable CLI command to activate the new authentication method

     3 details in Everything

351. Prisma Access 5.1 Preferred Innovation: GlobalProtect Portal and Gateway Support for TLSv1.3 May 2024 · release notes

     Prisma Access 5.1 adds TLSv1.3 support for GlobalProtect Portal and Gateway connections.

     • Adds TLSv1.3 as a configurable version in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS service profiles for GlobalProtect Portal and Gateway
     • Supports new TLSv1.3 cipher suites: TLS-AES-128-GCM-SHA256, TLS-AES-256-GCM-SHA384, TLS-CHACHA20-POLY1305-SHA256

     2 details in Everything

352. Prisma Access 5.1 Preferred Innovation: FQDNs for Remote Network and Service Connection IPSec Tunnels May 2024 · release notes

     Prisma Access 5.1 introduces FQDNs for IPSec tunnel peers to simplify CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. configuration

     • Enables using FQDNs instead of static public IP addresses as the peer address for Service Connection and Remote Network IPSec tunnels

     1 detail in Everything

353. Prisma Access 5.2 Preferred Innovation: Activity Insights: Static IP Address Allocation for Mobile Users May 2024 · release notes

     Prisma Access 5.2 adds static IP address allocation for mobile users to manage IP pool capacity.

     • Adds Static IP Address Allocation capability to proactively assign subnets to agent users instead of relying solely on dynamic pools.

     1 detail in Everything

354. PAN-OS 11.2: Post Quantum Hybrid Key Exchange VPN May 2024 · release notes

     PAN-OS 11.2 adds Post Quantum Hybrid Key Exchange for VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. using NIST round 3/4 suites

     • Enables post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. cryptographic (PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA.) hybrid keys for IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. and IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. rekey exchanges to guard against harvest-now-decrypt-later attacks
     • Allows adding up to seven additional key exchange mechanisms (KEM) alongside the primary KEM for increased quantum resistance
     • Supports combining RFC 8784 post-quantum pre-shared keys with PQC hybrid keys for in-depth defense

     3 details in Everything

355. Prisma Access 5.1 Preferred Innovation: PAN-OS 11.2 Support for Panoramas That Manage Prisma Access May 2024 · release notes

     Prisma Access 5.1 now allows management by Panorama appliances running PAN-OS 11.2.

356. Prisma Access 5.1 Preferred Innovation: PAN-OS 11.0, 11.1, and 11.2 Dataplane Support May 2024 · release notes

     Prisma Access 5.1 now supports PAN-OS 11.0, 11.1, and 11.2 dataplanes for enhanced visibility and threat detection.

     • Adds support for PAN-OS 11.0, 11.1, and 11.2 dataplanes in Prisma Access 5.1 Preferred Innovation

     1 detail in Everything

357. PAN-OS 11.1: PA-5420 Firewall Supports Additional Virtual Routers May 2024 · release notes

     PAN-OS 11.1 increases PA-5420 virtual router limit from 50 to 65

358. Prisma Access 5.1 Preferred Innovation: Rapid TCP Port Reuse for Short-Lived Sessions (Fast-Session Delete) May 2024 · release notes

     Adds fast session delete to rapidly reuse TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports for short-lived sessions

     • Enables fast_session_delete to allow Prisma Access to reuse TCP port numbers before the TCP TIME_WAIT period expires.

     1 detail in Everything

359. Prisma Access 5.1 Preferred Innovation: Explicit Proxy Support for South Africa Central Location May 2024 · release notes

     Prisma Access 5.1 Preferred Innovation now supports Explicit Proxy in the South Africa Central region.

360. PAN-OS 11.2: Advanced DNS Security May 2024 · release notes

     Advanced DNS Security service adds real-time detection and blocking of hijacked and misconfigured domains via cloud ML engines

     • Adds the new Advanced DNS Security subscription service that inspects DNS responses in the cloud using ML-based analytics to detect DNS hijacking and misconfigured domains in real-time.
     • Enables two new detection categories, DNS Misconfiguration Domains and Hijacking Domains, through cloud-side analysis engines updated automatically without user download packages.
     • Requires configuration via the Anti-Spyware (or DNS Security) profile, which now sends all DNS query responses to the Advanced DNS Security cloud for enhanced categorization.

     3 details in Everything

361. PAN-OS 11.1: PA-410R Next-Generation Firewall May 2024 · release notes

     PAN-OS 11.1 introduces support for the rugged PA-410R industrial firewall with IP65 rating and DIN rail mounting.

     • Adds hardware support for the PA-410R Next-Generation Firewall in PAN-OS 11.1

     1 detail in Everything

362. Cortex Analytics: 2024.04.03 Apr 16, 2024 · release notes

     Cortex Analytics 2024.04.03 adds two new low-analytics detections for rare file transfer over SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. enumeration.

     • Adds Rare file transfer over SMB protocol Low Analytics BIOC to detect unusual SMB file activity
     • Adds Rare LDAP enumeration Low Analytics Alert to flag suspicious LDAP search patterns

     2 details in Everything

363. Cortex Analytics: 2024.03.27 Apr 14, 2024 · release notes

     Cortex Analytics adds Kubernetes BIOCs/Alerts and new low-severity detections

     • Adds 'A Kubernetes API operation was successfully invoked by an anonymous user' BIOC
     • Adds 'A Kubernetes dashboard service account was used outside the cluster' BIOC
     • Adds Rundll32.exe executes a rare unsigned module BIOC
     • Adds Suspicious domain suffix alert
     • Adds Abnormal SMB activity to multiple hosts alert

     +3 more show less

     • Adds HTTP with suspicious characteristics alert
     • Adds 24 new Informational Analytics BIOCs for Kubernetes lifecycle events (ConfigMap, Cronjob, DaemonSet, Pod deletion, ReplicaSet, StatefulSet, ClusterRoleBinding, Cluster, Deployment, EphemeralContainer, Namespace, NodeServiceAccount, RoleBinding, Secret, ServiceAccount, Service, CommandExec, SensitiveVolume, HostPIDHostPIDA Kubernetes pod setting that lets containers in the pod share the host node's process ID namespace, giving them visibility into — and potential control over — all processes running on the node., Privileged, EventDeletion, NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules., HostNetwork) and Remote Code Execution/Unusual File Read
     • Adds Kubernetes enumeration activity alert

     8 details in Everything

364. Cortex XSOAR 8 SaaS: April 2024 Apr 2024 · release notes

     Cortex XSOAR 8.6 adds multi-role API keys, dashboard RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., API key management endpoints, favicon customization, and passwordless SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. controls.

     • Adds Multi-Role API Keys to allow creating API keys with aggregated permissions from multiple roles for dynamic RBAC management
     • Adds an API endpoint for managing API keys (GET, CREATE, UPDATE, DELETE) including bulk deletion capabilities
     • Adds dashboard-specific access control via role assignment to restrict which dashboards users can see
     • Adds favicon color customization per tenant in the UI to help distinguish between multiple open tenants
     • Adds Passwordless Authentication option for SSO requiring non-password credentials like biometrics

     +2 more show less

     • Adds Force Authentication option to require reauthentication even if already authenticated via SSO
     • Enables integration logs for non-Python scripts and integrations to improve troubleshooting

     7 details in Everything

365. Prisma Access 5.1 Preferred Innovation: Service Connection Support for Explicit Proxy Apr 2024 · release notes

     Prisma Access 5.1 now supports Service Connections for Explicit Proxy to access data center resources.

366. Prisma Cloud: Features Introduced in April 2024 Apr 2024 · release notes

     Prisma Cloud adds Jakarta region, Cortex XSOAR 8.0 integration, shareable views, RQL attributes, and new Azure IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. inventory.

     • Versions Available option on the Prisma Cloud Console to select between Cortex XSOAR versions 6.0 or 8.0 when configuring the integration
     • app.id.prismacloud.io tenant for the Jakarta region is now available
     • Manage Dashboards/Saved Views page allows setting Public access level to share custom dashboards and saved views with other users in your tenant
     • Compliance Trend widget now supports filtering data by specific time durations: 24 hours, 1 week, 1 month, 3 months, 6 months, 1 year, Year to Date, or Custom
     • RQL query attributes action.access.level and action.access.isAdministrative added to Permission Query for tracking over-privileged access in AWS, Azure, and GCP environments

     +5 more show less

     • IAM Permission Query Results now allow refining search results by selecting specific fields to customize the output
     • Azure IAM Identity Inventory feature with Suggest Least Privilege Access option to modify permissions and generate JSON/Terraform policies based on usage
     • demistoVersion parameter added to Integration APIs to support Cortex XSOAR 8.0
     • investigateOptions field added to Alert API responses (GET /alert, POST /alert, GET v2/alert, POST v2/alert, GET alert/:id)
     • timeRange parameter added to the GET Compliance Trend V2 - POST API (POST /api/cspm/post-compliance-posture-trend-v-2/)

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow logs with partitions set to Every 24 hours (default) are disabled, requiring a change to the hourly partition to continue monitoring or receiving alerts
367. Cortex Analytics: 2024.03.20 Apr 1, 2024 · release notes

     Cortex Analytics adds detections for rare DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. registry add, Svchost unsigned module loads, browser extension installs, and SAMR enumeration.

     • Adds Rare service DLL was added to the registry Low Analytics BIOC
     • Adds Browser Extension Installed Informational Analytics BIOC
     • Adds LOLBIN created a PSScriptPolicyTest PowerShell script file Informational Analytics BIOC
     • Adds User and Group Enumeration via SAMR Informational Analytics Alert

     4 details in Everything

368. Cortex XDR 3.x: April 2024 Apr 2024 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.10 adds in-product support cases, multi-role API keys, enhanced VA, iOS malware profile options, correlations_auditing dataset, and new Forensics hunting/investi

     • multi-role API keys support aggregated permissions for dynamic RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. management
     • In-product support case creation with console recording and log upload directly in the console
     • correlations_auditing dataset (Cortex XDR Pro) logs correlation rule execution details
     • regexcapture parsing rules function (Cortex XDR Pro per GB) extracts named regex groups into JSON
     • iOS malware profile allows configuring Safari browser security module and network security module for traffic monitoring and blocking

     +4 more show less

     • Network Shield and Safari Safeguard iOS protection modules with specific event alerts
     • New Forensic Investigations feature grouping evidence and notes in a single location
     • New Forensic Hunting feature with named collections and scheduled artifact searches
     • Export forensic Hunt or Triage collections into single archives from the server

     9 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Forensic Triage, Forensic File Search, Forensic Registry Search, and Forensic Log Search actions have been moved from the Action Center to the new Hunting and Investigation features in Forensics.
369. Cortex Xpanse Expander: Expander Release 2.5 (April 2024) Apr 2024 · release notes

     Cortex Xpanse Expander 2.5 adds GA Attack Surface Testing, Rapid7 ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. integration, multi-role API keys, and ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. data filtering.

     • Adds GA Attack Surface Testing to confirm vulnerabilities through benign, automated tests on public internet services
     • Adds support for ASN data filters and details in the Inventory UI and detail panes
     • Adds new incident and alert pivots to related alerts, services, and websites via IP or domain
     • Adds Rapid7 InsightVM as a new outbound integration to replicate ASM assets as scan targets
     • Extends Active Response with endpoint-based mitigation playbooks for some ASM alert types

     +9 more show less

     • Enables creating a single API key with multiple roles for dynamic RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. management
     • Adds custom incident and alert statuses and resolution types to align with org security practices
     • Adds Passwordless Authentication and Force Authentication as new authentication control options
     • Introduces Get Vulnerability Tests, Bulk Update Vulnerability Tests, and Override Business Units for Assets API endpoints
     • Adds vulnerability test status, confirmed_vulnerable_cve_ids, and confirmed_not_vulnerable_cve_ids fields to the Get All Services response
     • Returns last 14 days of vulnerability test results in the vulnerability_test_results field for Get Service Details
     • Adds aws_cloud_tags, azure_cloud_tags, certificate_details, certificate_expiry_date, creation_time, date_added, extended_properties, external_ips, gcp_cloud_tags, geo_region, hierarchy, internal_ips, open_ports, project_name, sub_region, and vpc_name_id fields to the Get All Assets response
     • Adds asm_id_list, aws_cloud_tags, gcs_cloud_tags, and azure_cloud_tags filters to the Get All Assets endpoint
     • Adds certificate_expiry_date and date_added fields to the Get Asset Details response

     14 details in Everything

370. Cortex XSOAR 8 On-premises: Cortex XSOAR 8 On-prem Releases: GA 2024-03-31 Mar 31, 2024 · release notes

     Cortex XSOAR 8.5 On-prem releases with Cortex platform integration and improved scalability

     • High scalability based on a revamped architecture.

     1 detail in Everything

371. Prisma Cloud Compute Edition: 32.04 (Build 32.04.113) Mar 28, 2024 · release notes

     Prisma Cloud Compute Edition 32.04 adds purl to scan APIs, incidentTime webhook macro, Account ID dashboard field, and enhanced vulnerability assessment logic.

     • Adds purl parameter to Get Image, Registry, All CI Image, Host, VM Image, and All CI Serverless Scan Results API responses for absolute package paths
     • Adds cert parameter under Syslog in the Add Logging Settings API (POST /api/v1/settings/logging) to configure TLS certificates for remote syslog
     • Adds incidentTime macro for webhook alerts showing incident occurrence time
     • Adds Account ID field to Manage Defenders dashboard and CSV export
     • Enhances vulnerability assessment by searching third-party security data when vendor feeds are empty

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !With v33.00, release v30.xx defenders will be obsolete; plan to upgrade to v31.xx or later
372. Cortex Analytics: 2024.03.06 Mar 28, 2024 · release notes

     Cortex Analytics 2024.03.06 adds new BIOC detections for WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS. HTTP activity and GCP IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy changes.

     • Adds Rare Windows Remote Management (WinRM) HTTP Activity as a new Low Analytics BIOC detection.
     • Adds GCP set IAM policy activity as a new Informational Analytics BIOC detection.

     2 details in Everything

373. Prisma Cloud: Features Introduced in March 2024 Mar 2024 · release notes

     Prisma Cloud Compute v32.04 adds Go package extraction on Windows, incidentTime webhook macro, and API fields

     • Adds the incidentTime macro to webhook alerts to show the incident occurrence time.
     • Enables Go packages extraction from zip, tar.gz, or tar.bz2 archives on Windows via Defenders.
     • Adds the purl field to image, registry, CI image, host, VM image, and serverless scan result API responses to identify absolute package paths.

     3 details in Everything

374. Prisma Cloud: Features Introduced in March 2024 Mar 2024 · release notes

     Prisma Cloud Darwin Release adds Google Workspace onboarding, VS Code extension, Asset Explorer APIs, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline./CI-CD policies.

     • Adds onboarding of Google Workspace domains to Prisma Cloud for MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. visibility and alerting
     • Releases the Prisma Cloud Code Security scanner extension for Visual Studio Code
     • Adds POST /asm/api/v1/asset/snooze and POST /asm/api/v1/asset/reopen endpoints for unmanaged assets in CDEM
     • Exposes GET /asm/api/v1/asset/{assetId}/flowlog-relationships endpoint to visualize network flows for internet-exposed assets
     • Adds the purl field to scan result APIs (images, registry, hosts, VMs, serverless)

     +4 more show less

     • Adds useTenantExternalId and related parameters to AWS Cloud Account Add/Update API endpoints
     • Introduces support for the Telecommunications Security Act (TSA) compliance benchmark
     • Introduces support for HITrust CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 11.2.0 compliance benchmark
     • Adds POST /iam/api/v4/search/permission endpoint to get permissions grouped by fields

     9 details in Everything

375. Prisma Cloud Compute Edition: 32.03 (Build 32.03.125) Feb 26, 2024 · release notes

     Prisma Cloud Compute 32.03 adds Amazon Linux 2023 support, granular Go stdlib detection, API issueType/packageType params, and two new traffic observation policies.

     • Adds issueType parameter to host, image, registry, CI image, VM image, and serverless download APIs to split vulnerability and compliance CSV exports
     • Adds packageType field to vulnerabilities schema responses across Get/Poll/Evaluate scan result APIs
     • Adds new Result column (pass/fail) with compliance check ID to compliance report CSV exported via Monitor > Compliance > Compliance Explorer
     • Adds Amazon Linux 2023 OS scans and security feed integration
     • Adds Go stdlib vulnerability detection at the package level with precise symbol association and false positive reduction

     +1 more show less

     • Adds two new incident policies for internet-exposed API endpoints transmitting sensitive data without authentication or encryption

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !CVE package type name binary is now Application
     • !CVE package type name Product is now Application
     • !CVE package type name package is now OS
     • !CVE package type name javascript is now nodejs
376. Prisma Access 5.0 Preferred Innovation: App Acceleration—Dynamic Content Acceleration for Top SaaS Apps Feb 2024 · release notes

     Prisma Access adds Dynamic Content Acceleration for top SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps

377. Prisma Cloud: Features Introduced in February 2024 Feb 2024 · release notes

     Prisma Cloud v32.03/v32.02 adds Amazon Linux 2023 support, refined Go stdlib detection, agentless scanning defaults, and new API parameters for exports.

     • v32.03 release notes (Compute) add issueType parameter to download scan result APIs.
     • v32.03 adds Amazon Linux 2023 OS scans and security feed integration support.
     • v32.03 introduces new incident policies for sensitive data sent via unauthenticated or unencrypted internet-facing API endpoints.
     • v32.03 enables package-level detection of Go stdlib vulnerabilities with symbol specificity.
     • Compliance report CSV download now includes a Result column showing pass/fail status and compliance check ID.

     +4 more show less

     • v32.02 enables agentless scanning for non-running hosts by default for newly added accounts.
     • Registry scan results now display Scan status, Last scan time, and a unified scan progress indicator.
     • v32.02 Get All Credentials endpoint adds external and autoImported query parameters.
     • Download Serverless Layer Bundle endpoint accepts nodeJSModuleType request body field (commonjs or ecmascript).

     9 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Code Repository Scanning feature is sunset in Prisma Cloud Compute Edition; replaced by Prisma Cloud Application Security.
     • !API endpoints starting with /api/<vVersion>/coderepos, /api/<vVersion>/coderepos-ci, and related policies/settings/webhooks are removed/sunset.
     • !Defenders below v30.00 (e.g., v22.12) will disconnect upon upgrade to v32.03 or later; must upgrade to v30.xx or later.
378. PAN-OS 11.1: Traceability and Control of Post-Quantum Cryptography in Decryption Feb 2024 · release notes

     PAN-OS 11.1 adds PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. detection, logging, and decryption policy controls for TLSv1.3 sessions.

     • Adds the ability to detect, block, and log post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQC) and hybrid PQC algorithms in TLSv1.3 sessions via existing SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS decryption policy rules
     • Introduces new threat signatures that monitor ServerHello responses to alert on successful PQC-based SSL/TLS session negotiations when a Threat Prevention license is active
     • Enforces classical algorithm negotiation by removing PQC and hybrid algorithms from the ClientHello in SSL Forward Proxy and SSL Inbound Inspection rules, or drops the session if the client strictly supports only PQC

     3 details in Everything

379. Cortex XSOAR 8 SaaS: February 2024 Feb 2024 · release notes

     Cortex XSOAR 8.5 Feb 2024 adds MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. user invitation, API IP allowlists, custom system emails, and new integrations

     • Adds the ability to invite users from Main and Child tenants to investigations in multi-tenant deployments
     • Enables configuring an Allow list of specific IP addresses or IP ranges for Cortex XSOAR API access
     • Allows customization of system emails sent to users, including task assignments and integration failures
     • Supports adding user phone numbers on the User Preferences page to trigger direct analyst communication
     • Groups playbook inputs and outputs within the editor for better visibility

     +11 more show less

     • Adds next/previous incident navigation buttons in the UI for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts
     • Enables searching War Room notes directly from the Incidents search bar
     • Introduces support for authenticated custom container registries for pulling images
     • Allows permanent retention of up to 1000 specific incidents independent of default retention policies
     • Enables assigning incident retention licenses for different end customers in multi-tenant deployments
     • Adds AWS Organizations content pack with capabilities to list accounts, create accounts, and modify OUs
     • Adds HashiCorp Terraform integration supporting policy check results and more commands
     • Adds Email Hippo integration for email address and domain validation
     • Adds XSOAR Capture the Flag content pack with investigative playbooks
     • Adds XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Lite playbook to reduce remediation time for Cortex XDR incidents
     • Adds Remote PsExec-like LOLBIN Command Execution playbook for automated investigation and response

     16 details in Everything

380. PAN-OS 10.2: Authenticate LSVPN Satellite with Serial Number and IP Address Method Feb 2024 · release notes

     PAN-OS 10.2 adds satellite-serialnumberip-auth CLI commands for automated LSVPN satellite onboarding.

     └──▷ TRY IT
     Enable the serial number and IP address authentication method globally to allow satellites to authenticate automatically upon power-on.
     copy

     $ set global-protect satellite-serialnumberip-auth enable

     • Adds set global-protect global-protect-portal portal <portal_name> satellite-serialnumberip-auth satellite-ip-allowlist entry <value> command to allow specific satellite IP addresses for Serial Number and IP Address authentication.
     • Adds set global-protect satellite-serialnumberip-auth enable CLI command to activate the Serial number and IP address Authentication method, removing the need for manual user intervention during onboarding.

     2 details in Everything

381. Cortex XDR 3.x: February 2024 Feb 2024 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.9 adds on-write and UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. protection modules, API IP allow lists, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. fields, and analytics updates

     • Adds on-write protection module for Windows that includes Wildfire and local analysis to expand ML-based security capabilities
     • Adds UEFI protection module to reinforce coverage against pre-boot attacks
     • Enables limiting Cortex XDR API access to specific IP addresses or ranges via an Allow list
     • Adds new cloud-related attributes to security events and agent status for essential context
     • Augments Host Card under Asset Scores with detailed Common Vulnerabilities and Exposures (CVE) insights sorted by severity

     +4 more show less

     • Introduces two new widgets in the Identity Threat Module User Risk View: Common Locations and Common OSs
     • Updates detectors inventory with new analytics including Direct Syscall, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Hijacking, Global, Injection, and Impacket Analytics
     • Adds action_process_instance_ID field to the xdr_process XQL preset for Cortex instance identification
     • Supports defining a target stage with dataset type lookup and append=false in Cortex Query Language (XQL)

     9 details in Everything

382. Prisma Access 5.0 Preferred Innovation: Consistent User Identity Formats Across Prisma Access Feb 2024 · release notes

     Prisma Access normalizes usernames from the Cloud Identity Engine into a unified format for consistent policy matching and logs

     • Applies global normalization standard to all usernames integrated through the Cloud Identity Engine, converting mixed case and varying prefixes/suffixes (e.g., test.User@abc.com, abc/Test.User) into a single standardized username format for policy matching, reporting, and logs.
     • Reduces administrative overhead and minimizes risk of user-based policy lookup failures due to username format variations across identity sources.

     2 details in Everything

383. PAN-OS 11.1: TACACS+ Accounting Feb 2024 · release notes

     PAN-OS 11.1 introduces TACACS+ Accounting, allowing firewalls to log user service initiation, duration, and termination to a TACACS+ server for auditing.

384. Cortex Xpanse Expander: Expander Release 2.4 (February 2024) Feb 2024 · release notes

     Cortex Xpanse Expander 2.4 adds Attack Surface Testing, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, API IP allowlisting, and PDF exports.

     • Attack Surface Testing (Closed Beta) confirms vulnerability presence via customer-authorized, benign tests on public internet services to prioritize risks with higher confidence
     • Support for scanning of customer-provided IPv6 ranges allows continuous discovery of new likely targets and visibility into services running on those hosts
     • Define User-defined IPv4 addresses and ranges for more granular business unit allocation
     • Filter alerts by MITRE ATT&CK filters Techniques and Tactics
     • Export individual incidents and alerts in PDF format for reports containing relevant information

     +6 more show less

     • Advanced Playbook Configuration allows customization of Active Response playbook email/ticket notification format/content and association with a JIRA project key
     • Limit Cortex Xpanse API access by adding specific IP addresses or ranges to an Allow list
     • New pDNS data source for subdomain enumeration increasing coverage
     • New Reopened alert status applied to alerts observed after being resolved with statuses like Resolved - No Longer Observed, Resolved - Remediated Automatically, or Resolved
     • Venafi TPP integration correlates certificates in the Expander inventory with those in Venafi TPP
     • Performance improvements include 70-90% faster public APIs for fetching services, websites, IP ranges, alerts, and details, plus reduced latency for AUM widget and Threat Event details loading

     11 details in Everything

385. Prisma Cloud: Features Introduced in February 2024 Feb 2024 · release notes

     Prisma Cloud adds non-default branch scanning, Amazon Linux 2023 support, Saved Views, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for ServiceNow, and new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints.

     • Adds issueType parameter to download APIs (get-hosts-download, get-images-download, get-registry-download, get-scans-download, get-vms-download, get-serverless-download) to split vulnerability and compliance findings.
     • Supports just-in-time (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) auto-provisioning via OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration endpoints (create-oauth-2-config, update-oauth-2-config, patch-oauth-2-config, get-oauth-2-config).
     • Adds autoEnableAttackPathAndModulePolicies field to Enterprise Settings APIs (GET Enterprise Settings, POST Enterprise settings) in v24.2.1.
     • Adds unified vulnerability dashboard endpoints: GET uve/api/v2/dashboard/vulnerabilities/overview and GET uve/api/v2/dashboard/vulnerabilities/burndown.
     • Supports non-default branch scanning for source code security assessments.

     +12 more show less

     • Enables saving filter combinations as Saved Views on Alerts, Compliance, and Governance pages with no 20-view limit.
     • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 support for ServiceNow integration to simplify token management.
     • Supports Amazon Linux 2023 OS scans and security feed integration.
     • Enhances RQL config from network searches with asset exclusion by name, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. ID, and tags, plus NLB/ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. listener port analysis on AWS and Azure.
     • Adds a Result column (pass/fail) to compliance report CSVs in Monitor > Compliance > Compliance Explorer.
     • Detects Go stdlib vulnerabilities at the package level for more precise classification in O’Neal Update 3.
     • Ingests data from new GCP Johannesburg region for resources deployed there.
     • Adds AWS Batch aws-batch-job-definition, AWS CodeBuild aws-code-build-source-credential, AWS CodeCommit aws-code-commit-repository and aws-code-commit-approval-rule-template, Amazon CodePipeline aws-code-pipeline-webhook, AWS Config aws-configservice-aggregator, AWS DataSync aws-datasync-agent, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. aws-ec2-vpc-endpoint-service, and EC2 Image Builder APIs (aws-imagebuilder-component, aws-imagebuilder-image-recipe, aws-imagebuilder-image-pipeline, aws-imagebuilder-infrastructure-configuration).
     • Adds AWS Elastic Disaster Recovery APIs: aws-drs-job, aws-drs-replication-configuration, and aws-drs-source-server.
     • Adds Google Cloud VMware Engine APIs: gcloud-vmware-engine-network and gcloud-vmware-engine-network-policy.
     • Adds Google Vertex AI AIPlatform APIs: gcloud-vertex-ai-aiplatform-dataset, gcloud-vertex-ai-aiplatform-hyperparameter-tuning-job, gcloud-vertex-ai-aiplatform-index, and gcloud-vertex-ai-aiplatform-feature-store-entity-type.
     • Introduces 196 new Config Build policies covering Open API, AWS General/IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access./Kubernetes/Logging/Networking, Azure General/IAM/Kubernetes/Logging/Networking/Storage, Docker, Google Cloud General/IAM/Kubernetes/Networking/Storage/Logging, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. General/IAM/Networking, and more.

     17 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Prisma Cloud updates the aws-ecr-image API to exclude the lastRecordedPullTime field from the JSON.
     • !Prisma Cloud updates oci-compute-instance, oci-cloudguard-security-zone, and oci-apimanagement-apigateway-deployment APIs to prevent ingestion of deleted resources from Oracle Cloud Service Provider.
     • !Prisma Cloud updates the gcloud-cloud-firestore-native-database API to exclude the earliestVersionTime field from the resource configuration.
     • !Prisma Cloud updates the gcloud-compute-autoscaler API to exclude the recommendedSize field from the resource configuration.
386. Prisma Cloud Compute Edition: 32.02 (Build 32.02.127) Jan 28, 2024 · release notes

     New agentless scanning default for non-running hosts and new API query parameters for imported cloud accounts.

     • Enables agentless scanning of non-running hosts by default for all newly added accounts
     • Adds external and autoImported query parameters to the Get All Credentials endpoint to list credentials imported from the Prisma Cloud platform Accounts page
     • Adds nodeJSModuleType request body field (accepts commonjs or ecmascript) to the Download Serverless Layer Bundle endpoint

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Code Repository Scanning feature is removed, eliminating support for endpoints such as /api/\<vVersion>/coderepos (GET), /api/\<vVersion>/coderepos/scan (POST), and /api/\<vVersion>/settings/coderepos
     • !Defender versions prior to v30.00 are no longer supported and will disconnect; you must upgrade to at least v30.00 before upgrading the Console to v32.00
     • !Console upgrades from v22.00 now require an intermediate upgrade to v30.00 before proceeding to v31.00
387. Prisma Cloud Compute Edition: 32.01 (Build 32.01.128) Jan 7, 2024 · release notes

     Prisma Cloud Compute 32.01 adds agentless scanning for encrypted Azure volumes and OpenShift 4.14 support.

     • Adds Agentless Scanning support of encrypted volumes in Azure for hub account mode
     • Adds Agentless Scanning hub account mode for Azure
     • Adds Vulnerability Management support for Debian Bullseye and Bookworm Security fixes
     • Adds Operating System Support for OpenShift 4.14
     • Enables Vulnerability Management detection of IBM Java version numbers (v1.8 and earlier) during vulnerability management

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The AccountID macro is deprecated in alerts, removing the AccountID field from Webhook, AWS SQS, Prisma Cortex Alert, and Splunk destinations
     • !The Cluster macro is deprecated in alerts, removing the Cluster field from Webhook, AWS SQS, Prisma Cortex Alert, and Splunk destinations
388. Prisma Cloud Compute Edition: 33.03 (Build 33.03.138) Jan 5, 2024 · release notes

     Prisma Cloud Compute 33.03 adds module-aware RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence./NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. vulnerability reporting, fsmon_v2 prevent action, and Defender last-connected logging.

     • Adds last-connected epoch timestamp field to Defender stats logs to track connection history
     • Enhances vulnerability reporting for Red Hat Enterprise Linux (RHEL) 8 and 9 with module and stream metadata
     • Enhances vulnerability reporting for NuGet packages by excluding runtime-specific dependencies not related to the application

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Defenders below version v30.00 will disconnect from the Console after upgrading to this release
389. Prisma Cloud: Features Introduced in January 2024 Jan 2024 · release notes

     Prisma Compute v32.01 adds Azure agentless scanning for hub accounts, OpenShift 4.14, Debian Bullseye/Bookworm CVEs, and IBM Java detection.

     • Adds Agentless Scanning support for encrypted volumes in Azure using hub account mode
     • Adds Agentless Scanning hub account mode support for Azure
     • Adds Vulnerability Management support for Debian Bullseye and Bookworm Security fixes
     • Adds Operating System Support for OpenShift 4.14
     • Adds Vulnerability Management detection for IBM Java version 1.8 and earlier based on the jdk/release file

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The AccountID and Cluster macros in Runtime Security Alerts (Webhook, AWS SQS, Prisma Cortex Alert, Splunk) are deprecated; their corresponding fields are removed from alert payloads.
390. Prisma Cloud: Features Introduced in January 2024 Jan 2024 · release notes

     Prisma Cloud Darwin Release adds Terraform module scanning, agentless Azure scanning, CI/CD build policies, new dashboards/APIs, and RBI/SEBI compliance standards.

     • Adds Terraform Module Scanning for public, private, and locally cached modules to analyze misconfigurations in resource blocks and variables.
     • Adds support for sending ad hoc alert notifications to Email and Slack via the Send To dropdown in Alerts > Overview.
     • Adds unique CVE counts in the Prioritized Funnel widget in Vulnerability Management instead of total occurrences.
     • Adds eight new Dashboard Widgets (e.g., Adoption Progress, Risks Burndown) via Dashboards > Add Dashboard > Widget Selector.
     • Adds Agentless Scanning support for encrypted volumes and hub account mode on Azure.

     +14 more show less

     • Adds support for scanning Debian Bullseye and Bookworm Security fixes in Vulnerability Management.
     • Adds IBM Java version number detection (1.8 and earlier) during vulnerability management.
     • Adds OpenShift 4.14 to supported Operating Systems.
     • Adds API ingestions for Azure Cache, Google Cloud VMware Engine (private cloud, cluster, HCX activation key, subnet), Vertex AI AIPlatform, Speech to text, Cloud Composer, and Data Migration.
     • Adds new Compliance Dashboard accessible via Home > Dashboards > Compliance to view asset compliance status and trends.
     • Adds RBI and SEBI compliance standards available under Compliance > Standards.
     • Adds new Attack Path policies for configuration checking.
     • Adds default CI/CD Configuration Build Policies for Azure Repo, Bitbucket, CircleCI, GitHub, and GitLab.
     • Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints: POST /api/v1/metrics/alert-count-by-resolution-reason and POST /api/v1/metrics/alert-mean-resolution-time for dashboard widgets.
     • Adds Unified Vulnerability Explorer V2 API (Get Prioritized Vulnerabilities V2) to view top priority vulnerabilities and asset counts.
     • Adds new IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. APIs endpoints in the IAM category to get least privilege access details and remediation commands.
     • Adds new Widget APIs for Discovered vs. Secured Resources, Vulnerabilities Trend, and Assets with Alerts via POST /adoptionadvisor/api/v2/...
     • Adds Background Job APIs (GET /report-service/api/v1/report, etc.) to get reports metadata, status, and download content.
     • Updates Policy APIs to support malware and grayware policy types and host and container_image subtypes.

     19 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Microsegmentation module is disconnected; active Enforcer agents will no longer work.
     • !The app.sg stack is decommissioned for Prisma Cloud Data Security.
     • !BridgecrewCLI, including GitHub Action, CircleCI Orb, and container, is deprecated.
     • !The AccountID and Cluster macros used in Webhook, AWS SQS, Prisma Cortex Alert, and Splunk alerts are deprecated.
391. Prisma Cloud Compute Edition: 32.00 (Build 32.00.159) Dec 3, 2023 · release notes

     Prisma Cloud Compute v32 adds agentless host scanning report, expands malware scan coverage, and drops CNNS policy support.

     • Adds the Agentless Scanning Report accessible via Runtime Security > Cloud Accounts to show host inventory and scan status at account and regional levels
     • Expands agentless malware scanning to detect all supported binaries and shared libraries on Linux and Windows, including malicious ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. files on Windows
     • Removes the ability to create CNNS policies, along with the Runtime Security > Defend > CNNS console settings and associated APIs

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The AccountID macro is removed from the Alerts payload; use AccountIDs instead
     • !CNNS policies can no longer be created, and the Runtime Security > Defend > CNNS console settings and corresponding APIs are removed
392. Prisma Cloud: Features Introduced in December 2023 Dec 2023 · release notes

     New agentless scanning report and expanded agentless malware scanning in Prisma Cloud Compute v32.00

     • Adds the agentless scanning report under Runtime Security > Cloud Accounts for host visibility.
     • Expands Agentless malware scanning to detect all supported binaries and shared libraries on Linux and Windows, including malicious ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. files on Windows.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The ability to create CNNS policies is removed in v32.00; configuration settings at Runtime Security > Defend > CNNS and corresponding APIs are deprecated.
     • !Deprecates the aggregated and rest macros from webhook custom JSON alerts, replacing them with AggregatedAlerts and Dropped respectively.
     • !Deprecates the AccountID macro in Alerts payloads, replacing it with AccountIDs.
393. PAN-OS 11.1: Persistent NAT for DIPP Dec 2023 · release notes

     PAN-OS 11.1 introduces Persistent NAT for DIPP to resolve STUN compatibility issues in real-time communication apps like VoIP and video conferencing.

     • Adds Persistent NAT for Dynamic IP and Port (DIPP) source NAT configurations

     1 detail in Everything

394. Prisma Cloud: Features Introduced in December 2023 Dec 2023 · release notes

     Prisma Cloud Darwin Release adds new API endpoints for Compliance Posture and Asset Inventory.

     • get /v2/compliance/posture, post /v2/compliance/posture, and associated trend endpoints are now available in the Compliance Posture API.
     • save-report (POST /v2/report) and resource scan info endpoints (GET/POST /v2/resource/scan_info) are added to the Asset Explorer and Reports API.
     • Asset Inventory APIs v3 endpoints (GET/POST /v3/inventory, GET/POST /v3/inventory/trend) are introduced.
     • Support for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Cloud IaaS v13 and v14 is available in Compliance > Standards.
     • New policies include AWS CloudFront WAFv2 AMRAMRAutonomous Mobile Robot — a self-navigating wheeled platform that maps its environment and plans its own path; cyber tools might target AMR firmware or fleet-management APIs in OT/ICS assessments. check, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings, BitBucket public repo detection, GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. unrotated secrets, CircleCI unpinned images, Azure Pipelines unpinned images, and GitLab CI secrets in logs.

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !AccountID macro in the Alerts payload is deprecated and replaced by AccountIDs.
     • !aggregated and rest macros from webhook custom JSON alerts are deprecated and replaced by AggregatedAlerts and Dropped respectively.
     • !The ability to create CNNS policies that Defenders use to limit traffic from containers and hosts is being removed; configuration settings on Runtime Security > Defend > CNNS will be removed in v32.00.
395. Prisma Access 5.0 Preferred Innovation: View and Monitor ZTNA Connector Access Objects Nov 2023 · release notes

     Prisma Access 5.0 adds view and monitor capabilities for ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector Access Objects

     • Enables viewing connectivity status and associated Connector Groups for ZTNA Connector Access Objects in the console
     • Adds data visualization for private apps added by FQDNs, IP subnets, and wildcards via ZTNA Connector access objects

     2 details in Everything

396. PAN-OS 11.1: Quantum-Resistant IKEv2 VPNs Nov 2023 · release notes

     PAN-OS 11.1 introduces quantum-resistantquantum-resistantCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. based on RFC 8784

     • Supports quantum-resistant IKEv2 VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. connections by mixing post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. pre-shared keys (PQ PPKs) with standard Diffie-Hellman key exchange

     1 detail in Everything

397. Prisma Access 5.0 Preferred Innovation: Service Connection Identity Redistribution Management Nov 2023 · release notes

     Prisma Access 5.0 adds granular control to select specific service connections for User-ID redistribution.

     • Adds the ability to select specific service connections for identity redistribution instead of using all connections by default.

     1 detail in Everything

398. Prisma Cloud: Features Introduced in November 2023 Nov 2023 · release notes

     Adds Israel Central and Italy North to the list of supported Azure regions for Prisma Cloud Compute agentless configurations.

     • Supports Israel Central Azure region in agentless configuration.
     • Supports Italy North Azure region in agentless configuration.

     2 details in Everything

399. PAN-OS 11.1: 5G Cellular Interface for IPv4 Nov 2023 · release notes

     PAN-OS 11.1 adds 5G cellular interface configuration for IPv4 on PA-415-5G firewalls.

400. PAN-OS 11.1: Improved Throughput with Lockless QoS Nov 2023 · release notes

     PAN-OS 11.1 adds lockless QoS mode for selected PA-34xx/54xx firewalls to improve throughput.

     • Adds lockless QoS mode option for PA-3410, PA-3420, PA-3430, PA-3440, PA-5410, PA-5420, PA-5430, PA-5440, and PA-5445 firewalls.
     • Dedicates CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores to the QoS function in lockless mode, resulting in improved throughput and latency for high-bandwidth requirements.

     2 details in Everything

401. PAN-OS 10.2: Policy Rulebase Management Using Tags Nov 2023 · release notes

     PAN-OS 10.2 adds policy rulebase tags and Tag Browser for organizing and filtering rules

     • Adds policy rule tags to categorize and organize security policy rules in Panorama and standalone NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports..
     • Introduces the Tag Browser interface to visually group, manage, and filter the policy rulebase by tag.

     2 details in Everything

402. PAN-OS 11.1: IKEv2 Certificate Authentication Support for Stronger Authentication Nov 2023 · release notes

     PAN-OS 11.1 adds IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. certificate authentication support for SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. topologies

     • Adds certificate as an authentication type for SD-WAN, replacing the default pre-shared key requirement.
     • Enables certificate-based authentication for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. clusters (hub-and-spoke and mesh) in SD-WAN configurations.

     2 details in Everything

403. PAN-OS 11.1: Device-ID Visibility and Policy Rule Recommendations Nov 2023 · release notes

     PAN-OS 11.1 adds Device-ID inventory and policy rule recommendations directly to the web interface

     • Adds Device-ID inventory visibility directly in the PAN-OS web interface for firewalls subscribed to Device Security services
     • Adds a summary of the top 10 common device categories, profiles, and operating systems in the PAN-OS web interface
     • Adds policy rule recommendations from Device Security analysis to the PAN-OS web interface with import capability

     3 details in Everything

404. PAN-OS 11.1: IP Protocol Scan Protection Nov 2023 · release notes

     PAN-OS 11.1 adds IP Protocol Scan Protection to detect and block reconnaissance scans.

     • Adds the ability to enable reconnaissance protection against IP protocol scans in PAN-OS 11.1
     • Allows configuring actions such as dropping subsequent packets from the source IP for a specified time when scan thresholds are met
     • Enables exclusion of trusted internal groups' IP addresses to minimize false positives during vulnerability testing

     3 details in Everything

405. PAN-OS 11.1: Exclude All Explicit Proxy Traffic from Authentication Nov 2023 · release notes

     PAN-OS 11.1 adds explicit proxy authentication exclusion

406. PAN-OS 11.1: New Platform Support for Web Proxy Nov 2023 · release notes

     PAN-OS 11.1 adds Web Proxy support to PA-5400 series hardware.

     • Enables the web proxy feature on PA-5400 series platforms (PA-5410, PA-5420, PA-5430, PA-5440, and PA-5445).

     1 detail in Everything

407. Prisma Access 5.0 Preferred Innovation: App Acceleration in Prisma Access Nov 2023 · release notes

     Prisma Access 5.0 Preferred Innovation introduces App Acceleration to boost TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. throughput and Autonomous DEM metrics for remote users.

408. PAN-OS 11.1: Dynamic IPv6 Address Assignment on the Management Interface Nov 2023 · release notes

     PAN-OS 11.1 adds dynamic IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. address assignment (DHCPv6 and SLAAC) to the MGT interface

409. PAN-OS 11.1: TLSv1.3 Support in SSL/TLS Service Profiles for Administrative Access Nov 2023 · release notes

     PAN-OS 11.1 adds TLSv1.3 configuration in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS service profiles for admin access and GlobalProtect

     • Configures TLSv1.3 as the minimum and maximum supported version in an SSL/TLS service profile for administrative access.
     • Enables modern cipher suites automatically when TLSv1.3 is selected in an SSL/TLS service profile.
     • Customizes key exchange, encryption, and authentication algorithms via GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. without using CLI.

     3 details in Everything

410. Prisma Access 5.0 Preferred Innovation: Enhanced SaaS Tenants Control Nov 2023 · release notes

     Prisma Access 5.0 adds granular SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tenant policy control to distinguish access per tenant instance.

     • Enables distinct SaaS policies for specific tenants within the same SaaS application (e.g., blocking uploads for a partner's GitHub while allowing them for the corporate account).

     1 detail in Everything

411. PAN-OS 11.1: PA-455 Next-Generation Firewall Nov 2023 · release notes

     PAN-OS 11.1 on PA-455 introduces integrated PoE (up to 91W) and increased threat prevention performance.

     • Integrates Power over Ethernet (PoE) capability on four designated ports supporting up to 91W for connecting devices like IP phones, wireless access points, and IP security cameras.
     • Delivers improved threat prevention performance of up to 2.3 Gbps.

     2 details in Everything

412. Prisma Access 5.0 Preferred Innovation: Support for Strata Logging Service Switzerland Region Nov 2023 · release notes

     Prisma Access now supports the Switzerland Strata Logging Service region for log aggregation.

413. Prisma Access 5.0 Preferred Innovation: Service Provider Backbone Integration Nov 2023 · release notes

     Service Provider Backbone Integration enables SPs to control tenant egress traffic and inbound flows in Prisma Access 5.0 Preferred Innovation.

414. Prisma Cloud: Features Introduced in November 2023 Nov 2023 · release notes

     Prisma Cloud Darwin Release introduces new Attack Path policies, AlloyDB support, CMMC v2 compliance, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. APIs, and more.

     • aws-ec2-launch-template-data, aws-audit-manager-assessment, aws-audit-manager-control, aws-mgn-launch-configuration-template, azure-synapse-workspace-managed-sql-server-blob-auditing-policies, azure-synapse-workspace-ip-firewall-rules, gcloud-alloydb-cluster, gcloud-alloydb-cluster-user, gcloud-alloydb-cluster-instance, and gcloud-alloydb-backup API ingestions for expanded cloud coverage
     • New oci-cloudguard-configuration API ingestion for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Cloud Guard
     • New SAML configuration endpoints: GET /authn/v1/saml/config, PUT /authn/v1/saml/config, and POST /authn/v1/saml/config
     • New cloud account feature toggle endpoint: PUT /cas/api/v1/org/{id}/features
     • New Alert policy endpoints: POST /alert/v1/policy, POST /alert/v1/aggregate, and GET /alert/v1/{id}/graph

     +1 more show less

     • Support for CMMC v2 Level 2 compliance standard with associated policies and reports

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Checkov CLI --skip-fixes and --skip-suppressions flags are deprecated; use --skip-download instead.
     • !Scans with API keys now require the --repo-id parameter for repository scans.
415. Prisma Cloud: Features Introduced in October 2023 Oct 2023 · release notes

     Agentless secrets scanning, Wolfi image support, 81 new Rego admission rules, and custom rule exploration in Prisma Cloud Compute v31.02.133.

     • Adds agentless secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. across all workloads for images, container file systems, and host file systems (AWS, Azure, GCP, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.).
     • Enables vulnerability scanning of Wolfi-based and Chainguard images with Intelligence Stream feeds.
     • Adds 81 out-of-the-box admission control rules written in Rego.
     • Extends agentless compliance cluster scanning to AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. worker nodes.
     • Allows exploration of resources violating custom compliance rules directly from the Compliance Explorer view.

     5 details in Everything

416. Cortex Xpanse Expander: Expander Release 2.3 (October 2023) Oct 2023 · release notes

     Expander 2.3 adds business unit management, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. filtering, embedded AI owner discovery, NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. remediation, and new integrations.

     • Adds business unit management for IPv4 ranges, owned responsive IPs, domains, and certificates
     • Displays GeoIP data on services, alerts, and incidents pages with location filtering
     • Introduces embedded AI service owner discovery in Active Response
     • Enables NGFW remediation via Pan-OS engines using NGFW logging
     • Adds outbound integration support for Tenable.io, Qualys VMDR, and Jira Server

     +2 more show less

     • Provides a new ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. Overview Report with monthly or quarterly scheduling options
     • Allows dashboard filtering by business unit and tag

     7 details in Everything

417. Cortex XSOAR 8 SaaS: October 2023 Oct 2023 · release notes

     Cortex XSOAR 8.4 adds Excel export, in-app docs, private repos, and several new integrations.

     • Adds in-app documentation that launches relative to the current location within the product
     • Adds Private Repository support allowing selection of built-in or private repos with single/multiple git branch options
     • Adds ability to export multiple incidents including notes, chat, and evidence to Excel
     • Adds Communication Task Authentication configuration via Cortex XSOAR Authentication Settings > Communication Task Authentication tab
     • Adds centralized credentials definition for Long Running Integrations and external dynamic lists in the Settings page

     +11 more show less

     • Adds metadata URL entry option for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration replacing manual IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. URL, issuer ID, and x.509 certificate input
     • Adds search by playbook name, description, or tags capability with grouped results sorted by modified date
     • Adds Run again button in the Work Plan incident tab to rerun a playbook on the same incident
     • Adds role update visibility in Components tab when a role is updated in Cortex Gateway
     • Adds Enrich and Save & Enrich buttons replacing Calculate and Recalculate in indicator windows
     • Hides deprecated content entities from view by default in Marketplace
     • New Crowdstrike Falcon Horizon (CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps.) integration with alert/incident mirroring and API-based policy management
     • New Microsoft Purview integration for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. events, eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. cases, and Graph Security alerts
     • New Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Cloud Data Exfiltration Playbook for investigation and remediation
     • New Cortex XDR Cloud Key Rotation Playbook for rotating compromised credentials
     • New Cortex XDR Identity Threat Detection and Remediation (ITDRITDRIdentity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions.) enhancements for risky users/hosts

     16 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !SSO login authentication is moved to the Login Options tab under the same Authentication Settings menu
     • !Calculate and Recalculate buttons are replaced by Enrich and Save & Enrich in indicator creation/editing windows
418. Cortex XDR 3.x: October 2023 Oct 2023 · release notes

     Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. 3.8 adds container-escaping prevention, dynamic dashboards with filters, new XQLXQLPalo Alto Networks' query language for searching and correlating telemetry data across endpoints, logs, and network events inside their Cortex platform. datasets/functions, and a new cloud security agent.

     • Adds container-escaping protection module for Linux endpoints to prevent malicious container escapes
     • Adds ransomware protection enhancement for macOS endpoints
     • Adds MBR Protection Module with an improved detection engine against Master Boot Record manipulations
     • Adds new Broker VM image (Ubuntu 20.04) as the supported upgrade path for brokers
     • Adds flexible hot storage retention license managed from the Dataset Management page

     +10 more show less

     • Introduces new XQL datasets: vpn_logs, auth_logs, and login_logs as subsets of xdr_data
     • Adds new XQL function convert_to_base_64 for encoding base64-decoded input
     • Adds system field _collector_internal_ip_address to all XDR Collector datasets (Filebeat/Winlogbeat)
     • Introduces dynamic dashboards allowing fixed filters across all widgets and in-dashboard drilldowns
     • Adds new incident lifecycle widgets: Open Incidents, Incidents by Status Duration, and Open Incidents by Assignee Over Time
     • Enables automatic backup via native OS mechanisms (Time Machine for macOS, Shadow Copy for Windows) from Cortex XDR
     • Allows entering a metadata URL for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration instead of manual IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. details
     • Adds Detector Tags to filter Alerts, Incidents, and Analytics BIOC Rules by specific detectors
     • Enables replacing existing data when importing files into lookup datasets via the Add Lookup option
     • Allows manual editing of existing lookup datasets directly from the console

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Kernel Mode on Google Container-Optimized OS (COS) is no longer supported; Cortex XDR agent now enforces User Space Mode
419. Prisma Cloud: Features Introduced in October 2023 Oct 2023 · release notes

     Prisma Cloud 23.10.1 introduces Service Provider initiated SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via new OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. API endpoints and ingests AWS Budgets, Azure CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server./DNS, GCP Certificate Manager, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Cloud Guard.

     • Adds Service Provider initiated Single Sign On (SSO) capability using OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) to allow users to sign in with their Identity Provider credentials
     • Ingests AWS Budgets data via the aws-budgets-budget API ingestion
     • Ingests Amazon EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. launch template metadata via the aws-ec2-launch-template API ingestion
     • Ingests AWS Well-Architected Tool workload data via the aws-well-architected-tool-workload API ingestion
     • Ingests Azure Front Door Standard/Premium endpoints metadata via the azure-frontdoor-standardpremium-afd-endpoints API ingestion

     +7 more show less

     • Ingests Azure Private DNS zone data via the azure-dns-privatedns-zones API ingestion
     • Ingests Google Certificate Manager certificate details via the gcloud-certificate-manager-certificate API ingestion
     • Ingests Google Certificate Manager DNS authorization details via the gcloud-certificate-manager-dns-authorization API ingestion
     • Ingests Google Certificate Manager certificate issuance configuration details via the gcloud-certificate-manager-certificate-issuance-config API ingestion
     • Ingests Google Certificate Manager certificate map details via the gcloud-certificate-manager-certificate-map API ingestion
     • Ingests OCI Cloud Guard detector recipe data via the oci-cloudguard-detector-recipe API ingestion
     • Adds new configuration policies: 'Azure Storage account not configured with SAS expiration policy', 'Azure Storage account configured with Shared Key authorization', and 'Azure Virtual machine configured with public IP and serial console access'

     12 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The deprecated GET /das/api/v1/resource API endpoint has been removed; users must use POST /uai/v1/asset instead.
420. Prisma Cloud: Features Introduced in October 2023 Oct 2023 · release notes

     Prisma Cloud adds CDEM subscription, RQL vulnerable where clause, API endpoint inventory, Collection APIs, Azure defaultMemberState, and GCP drift detection.

     • GET /c2c/api/v1/deploy/trend and GET /c2c/api/v1/runtime/trend endpoints expose deploy and runtime trends for the Code to Cloud dashboard
     • POST /api/v1/summary/{swimlane-type}, POST /api/v1/top-assets/{swimlane-type}, and POST /api/v1/top-policies/{swimlane-type} endpoints enable Command Center summary queries
     • GET /entitlement/api/v1/collection, GET /entitlement/api/v1/collection/{id}, POST /entitlement/api/v1/collection, PUT /entitlement/api/v1/collection/{id}, and DELETE /entitlement/api/v1/collection/{id} endpoints manage logical asset collections
     • defaultMemberState parameter added to Azure (POST /cas/v1/azure_account, PUT /cas/v1/azure_account/{account_id}) and AWS/GCP cloud account APIs for selective organization scanning support
     • vulnerable where RQL clause available in Search and Investigate for filtering vulnerable assets

     +11 more show less

     • Cloud Discovery and Exposure Management subscription discovers internet-exposed and unmonitored assets
     • Compute Workloads view added to Inventory > Assets covering container images and hosts
     • Vulnerabilities Dashboard provides holistic vulnerability views across the application lifecycle
     • Inventory > API Endpoints continuously discovers API endpoints using WAAS runtime rules
     • Attack Path Analysis identifies risks via a graph view of correlated security signals
     • Application Asset queries added to Search and Investigate for SDLCSDLCThe Software Development Life Cycle: a structured process covering planning, design, coding, testing, and deployment. Cyber tools integrate into it to catch vulnerabilities before code ships rather than after. relationship graphs
     • Repository Application Graph accessible via dedicated sidecar from repository inventory table
     • Inventory > IaC Resources provides comprehensive listing of Infrastructure as Code resources
     • GCP Drift Detection and Alerts supported for Terraform configurations
     • AWS, GCP, and Azure organizations support selective Agentless scanning for individual member accounts
     • AWS Israel region data ingestion now supported

     16 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Date filter no longer supported on Inventory > Assets, Asset Explorer, and Compliance > Overview
     • !Data Dashboard widgets moved; create a custom dashboard to view Data Security information
     • !POST /cloud/{cloud_type}, PUT /cloud/{cloud_type}/{id}, and POST /cloud/status/{cloud_type} endpoints no longer support AWS, GCP, or Azure cloud types
421. PAN-OS 11.1: New Predefined BGP Redistribution Profile Sep 2023 · release notes

     PAN-OS 11.1 introduces the All-Connected-Routes BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. redistribution profile to automate branch-to-branch connectivity in SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. clusters.

     • Adds the All-Connected-Routes predefined BGP Redistribution profile for automatic network reachability across VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. cluster peers.
     • Automatically assigns the All-Connected-Routes profile by default when NGFWs are added to a VPN cluster via Strata Cloud Manager.

     2 details in Everything

422. Prisma Access 4.2 Preferred: Credential Phishing Prevention Support Sep 2023 · release notes

     Prisma Access 4.2 adds credential phishing prevention with configurable actions and detection methods for managed deployments

     • Introduces credential phishing prevention capability to detect and act on corporate credential submissions in Panorama managed and Cloud managed deployments
     • Adds support for four response actions: alert, allow, block, or continue when submissions are detected
     • Supports the domain credential filter method which validates both usernames and passwords against a directory server

     3 details in Everything

423. Prisma Cloud: Features Introduced in September 2023 Sep 2023 · release notes

     Prisma Cloud adds GCP backend bucket dangling storage detection, AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. public IP assignment checks, and async config search APIs

     • Adds GCP backend bucket having dangling GCP Storage bucket policy to detect potential bucket takeover via load balancer misconfigurations
     • Adds AWS ECS services have automatic public IP address assignment enabled policy to identify services exposed to the internet
     • Adds Pending Resolution alert state for auto-remediated alerts, filterable via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.
     • Adds four new Config Search API endpoints: POST /search/api/v1/config, POST /search/api/v1/config/async, POST /search/api/v1/config/download, and POST /search/api/v1/config/:id

     4 details in Everything

424. Prisma Cloud: Features Introduced in September 2023 Sep 2023 · release notes

     Prisma Cloud Compute adds severity-based package scoping for vulnerability rules and parallel registry scanning.

     • Adds severity threshold scoping per package type in vulnerability policy rules, enabling alert and block actions based on per-package severity rather than just collection-level scope
     • Adds the ability to trigger a new registry scan while previous scans are still in progress via Monitor > Vulnerabilities, with queueing for scans initiated during Defend > Vulnerabilities > Registry configuration

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The /api/v_version/audits/access endpoint no longer includes Docker information in the response.
     • !Docker Access Control and the Access User role are removed from Defend > Access > Docker and Manage > Authentication > Roles respectively.
425. Prisma Cloud: Features Introduced in September 2023 Sep 2023 · release notes

     Prisma Cloud introduces 31 new CI/CD security policies and two new REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for code errors.

     • Adds support for 'Pull request reviews are not required in Azure Repos before merging to the default branch' policy
     • Adds support for 'Requestors allowed to self-approve pull requests on default branch in Azure Repos' policy
     • Adds support for 'Approvals for pull requests on the default branch in GitHub are not revoked when new commits are pushed' policy
     • Adds support for 'Forking of private repositories in the GitHub organization is allowed' policy
     • Adds support for 'Forking of a private GitHub repository is allowed' policy

     +29 more show less

     • Adds support for 'Private repository forks can lead to code leakage in GitHub' policy
     • Adds support for GitHub organization secret not scoped policy
     • Adds support for 'Any organization member in GitHub can create internal repositories' policy
     • Adds support for 'GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow allows command execution through the standard output stream' policy
     • Adds support for 'Code owners reviews are not required in GitHub before merging to the default branch' policy
     • Adds support for 'GitHub organization’s identity not confirmed with a verified badge' policy
     • Adds support for 'Any organization member In GitHub can create private repositories' policy
     • Adds support for 'Environment variables exposed when printed to log in Azure Pipelines' policy
     • Adds support for 'Certificate not verified by Azure Pipelines pipeline command' policy
     • Adds support for 'Azure Pipelines commands transmit data over an unencrypted channel' policy
     • Adds support for 'Push restrictions are not enforced on the default branch in GitHub' policy
     • Adds support for 'Merging to default branch with outdated code allowed in GitHub' policy
     • Adds support for 'Missing integrity check for downloaded executable in Azure Pipelines pipeline' policy
     • Adds support for 'Packages insecurely installed through “npm install” command in Azure Pipelines pipeline' policy
     • Adds support for 'GitLab project configured for group-wide access using job token' policy
     • Adds support for 'GitLab CI/CD accesses cloud provider using insecure long-term credentials' policy
     • Adds support for 'Excessive GitHub Actions pipeline permissions on the repository' policy
     • Adds support for 'Secrets found in logs of an Azure Pipelines pipeline' policy
     • Adds support for 'Project Service hooks sent over unencrypted channel' policy
     • Adds support for 'Project service hook SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. verification is disabled' policy
     • Adds support for 'Forking of a private Azure repository is allowed' policy
     • Adds support for Self-hosted runner group allows public repositories policy
     • Adds support for 'Default branch does not require signed commits in GitHub' policy
     • Adds support for CirceCI pipeline vulnerable to command injection policy
     • Adds support for 'Insecure definition of secret variable in Azure pipeline' policy
     • Adds support for 'Mutable orb used in the CircleCI pipeline' policy
     • Adds support for Public repository created in GitHub policy
     • Adds GET /api/code/errors/findings/periodic endpoint to retrieve code issues from periodic scans
     • Adds GET /api/code/errors/findings/cicd endpoint to retrieve code issues from pull requests and CI/CD runs

     34 details in Everything

426. Prisma Access 4.2 Preferred: Prisma Access PAC File Endpoint for Explicit Proxy Aug 2023 · release notes

     Prisma Access 4.2 Preferred introduces a managed PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file endpoint at store.swg.prismaaccess.com, simplifying configuration for explicit proxy environments.

427. Prisma Cloud: Features Introduced in August 2023 Aug 2023 · release notes

     Prisma Cloud adds attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. visualization, CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. v2 support, workload credential anomaly policies, and several new cloud API ingestions.

     • Adds Attack Path Analysis and Visualization to identify and graph attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. in the console
     • Adds Support for CIS AWS Foundations Benchmark v2.0.0 compliance standard in the Compliance > Standard page
     • Adds Unusual Usage of Workload Credentials Anomaly Policies (inside/outside cloud) requiring the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. security module
     • Adds API ingestion for aws-costexplorer-cost-and-usage (AWS Cost Explorer)
     • Adds API ingestion for aws-macie2-administrator-account (Amazon Macie)

     +6 more show less

     • Adds API ingestion for azure-data-lake-store-gen1-diagnostic-settings (Azure Data Lake Store Gen1)
     • Adds API ingestion for azure-devices-iot-hub-resource-diagnostic-settings (Azure IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Hub)
     • Adds API ingestion for azure-key-vault-managed-hsms-diagnostic-settings and azure-key-vault-managed-hsms (Azure Key Vault)
     • Adds API ingestion for gcloud-firebase-app-distribution-tester (Google Firebase App Distribution)
     • Adds support for the AWS Spain region for resource ingestion
     • Adds tenant-level opt-out for Prisma Cloud Chronicles via Settings > Enterprise Settings

     11 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Prisma Cloud no longer ingests metadata for the aws-inspector-v2-finding API; resources previously ingested are removed and alerts resolved as Resource_Deleted
428. Prisma Cloud: Features Introduced in August 2023 Aug 2023 · release notes

     Prisma Cloud Code Security adds multiple integrations for GitLab/Jenkins/CircleCI, Helm-based Transporter deployment, and seven new dashboard API endpoints.

     • Adds GET endpoints to the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for Code Security dashboard metrics: /api/code/get-dashboard-common-errors-by-policy-data/, /api/code/get-dashboard-errors-by-severity-data/, /api/code/get-dashboard-iac-errors-by-category-data/, /api/code/get-dashboard-data/, /api/code/get-dashboard-data/get-pr-issues-over-time-data/, /api/code/get-dashboard-top-cvss-vulnerabilities-data/, and /api/code/get-dashboard-top-vulnerable-repositories-data/
     • Enables configuration of Transporter network tunnels via Kubernetes Helm Charts for customized deployment
     • Adds support for multiple integrations across GitLab and GitLab Self-Managed version control systems within a single Prisma Cloud account

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Code Security console path is renamed to Application Security, requiring updates to bookmarks or manual navigation in the administrative console
429. Prisma Cloud: Features Introduced in August 2023 Aug 2023 · release notes

     Prisma Cloud Compute adds non-RPM Red Hat vulnerability scanning, containerd CI support, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. worker checks, and registry tag RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..

     • Expands vulnerability detection to include non-RPM content (binaries, Python, JS, Java JAR) from Red Hat layered products like OpenShift using detailed image analysis.
     • Adds Custom label support under compute collections to segregate scan results and enable registry-based role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC).
     • Enables CI scanning of images on Linux using the containerd runtime, removing the dependency on Docker for Kubernetes environments.
     • Supports CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. version 1.4.0 for Google Kubernetes Engine (GKE) worker nodes.

     4 details in Everything

430. Prisma Cloud: Features Introduced in July 2023 Jul 2023 · release notes

     Prisma Cloud adds AWS region support, MLPS compliance, new API ingestions, asset-level data scans, and traceable alert views

     • Adds aws-inspector-v2-coverage, aws-inspector-v2-finding, aws-inspector-v2-filter, and aws-inspector-v2-permission API ingestions for Amazon Inspector coverage and findings
     • Adds azure-bastion-diagnostic-settings ingestion to capture Azure Bastion diagnostic settings
     • Adds gcloud-deployment-manager-deployment and gcloud-deployment-manager-deployment-manifest ingestion for Google Deployment Manager resources
     • Adds gcloud-monitoring-group and gcloud-monitoring-snooze ingestion for Google Stackdriver Monitoring groups and snoozes
     • Adds gcloud-translation-model and gcloud-translation-native-dataset ingestion for Google Cloud Translation models and datasets

     +13 more show less

     • Adds aws-cloudhsm-cluster ingestion to monitor AWS CloudHSM clusters
     • Adds aws-ec2-vpc-endpoint-service-permission ingestion for Amazon VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoint service permissions
     • Adds gcloud-translation-glossary ingestion for Google Cloud Translation glossaries
     • Adds oci-compute-image ingestion for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Compute images
     • Adds Asset Level Scan mode to Prisma Cloud Data Security scans (backward scan) to reduce cost by scanning a subset of objects
     • Adds MLPS Level 3 compliance benchmark to the Compliance > Standard page
     • Supports data ingestion for AWS Zurich and Melbourne regions
     • Makes Prisma Cloud Data Security available on the app.sg stack in Singapore
     • Adds Least Privilege Access Enforcement suggestions and remediation capabilities at the Group/Role level
     • Adds Integrated View of Run and Build details for Alerts, including IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. resource details and yor_trace tagging support
     • Adds new API endpoint GET /das/api/v1/resource to retrieve the latest resource snapshot by Restricted Resource Name (rrn)
     • New policies: Azure SQL on Virtual Machine (Linux) with basic authentication and AWS Route53 Hosted Zone having dangling DNS record with subdomain takeover risk associated with AWS S3 Bucket
     • Adds OJK 38/POJK.03/2016 compliance benchmark

     18 details in Everything

431. Cortex XSOAR 8 SaaS: July 2023 Jul 2023 · release notes

     July 2023 update adds user group management, War Room indicator creation, and RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. engine support to Cortex XSOAR 8.3

     • Adds Manage User Groups in the Cortex Gateway to view and manage user groups for Cortex XSOAR, allowing them to assume roles or manage nested groups.
     • Adds Manage RBAC settings in the Cortex Gateway to view and manage tenants and role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.) settings from within the gateway.
     • Adds Mark as Indicator capability in the War Room to create an indicator directly from hovered text in a War Room entry.
     • Adds Detach and Attach Lists for Editing allowing lists from content packs to be detached, edited, and saved without duplication.
     • Adds Support for RHEL on Engines supporting RHEL v8.8 and v9.0 for engines.

     +1 more show less

     • Adds ability to disable keyboard shortcuts by toggling Enable Shortcuts in User Preferences > Preferences > General.

     6 details in Everything

432. Prisma Cloud: Features Introduced in July 2023 Jul 2023 · release notes

     Prisma Cloud Code Security adds integrated build/run alert views and CSV project exports.

     • Alert details now include traceability information linking runtime resources to their build-time IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. source, requiring the yor_trace tag on Terraform resources.

     1 detail in Everything

433. Prisma Cloud: Features Introduced in July 2023 Jul 2023 · release notes

     Prisma Compute adds GitLab registry scanning, agentless malware via WildFire, pURL filtering, parallel scans, and syslog field alignment.

     • Adds version: gitlab support in the POST /settings/registry API endpoint to scan GitLab Container Registries without admin credentials.
     • Adds agentless malware scanning through Palo Alto Networks Advanced WildFire for Linux/Windows hosts and container images.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The hub account is now treated as a dedicated account for agentless scanning and no longer scans itself.
434. Prisma Access 4.1 Preferred: High-Bandwidth Private App Access with Colo-Connect Jun 2023 · release notes

     Prisma Access 4.1 Preferred adds Colo-Connect for high-bandwidth private app access via dedicated and partner interconnects on GCP

     • Adds Colo-Connect support for high-bandwidth (10-20 Gbps) low-latency connections to Prisma Access from existing performance hubs
     • Adds support for Dedicated and Partner interconnects using Google Cloud Platform (GCP)
     • Adds support for multiple VLAN attachments (up to 20) per interconnect link

     3 details in Everything

435. Prisma Access 4.1 Preferred: New and Remapped Prisma Access Locations and Compute Locations Jun 2023 · release notes

     New and remapped Prisma Access locations for Sweden, Kazakhstan, Qatar, Senegal, and updated compute mappings

     • Adds new Prisma Access locations in Sweden, Kazakhstan, Qatar, and Senegal to expand geographic coverage.
     • Remaps existing Ecuador deployments from US Central to US Southeast compute location to optimize performance.
     • Remaps existing Jordan deployments from Europe Central to Europe South compute location to optimize performance.

     3 details in Everything

436. Prisma Cloud: Features Introduced in June 2023 Jun 2023 · release notes

     Prisma Cloud Code Security Projects now supports grouping by Resource or Policy, sorting by Count, and enforcing VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures./CI filters.

     • Adds Grouping Issues capability in Projects to group scan results by Resource or Policy
     • Adds Sort capability in Projects to sort issues by highest issue Count
     • Adds Filter for Enforcement in VCS Pull Requests and CI/CD Runs category views

     3 details in Everything

437. Prisma Access 4.1 Preferred: Third-Party Device-ID in Prisma Access Jun 2023 · release notes

     Adds Third-Party Device-ID integration via Cloud Identity Engine to Prisma Access policy rules.

     • Adds API-driven integration with third-party IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. visibility solutions through the Cloud Identity Engine.

     1 detail in Everything

438. Prisma Access 4.1 Preferred: Traffic Replication and PCAP Support Jun 2023 · release notes

     Prisma Access 4.1 Preferred adds traffic replication and PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. support for forensic analysis.

     • Enables traffic replication to capture packet data using organization encryption certificates
     • Supports saving PCAP files for forensic and analytical purposes

     2 details in Everything

439. Cortex Xpanse Expander: Expander Release 2.2 (June 2023) Jun 2023 · release notes

     Expander 2.2 adds Active Response, Prisma Cloud integration, Python SDK, new APIs, and threat response reporting.

     • Adds Tag Management, Remediation Scanning, Attack Surface Rules, Get All Websites, Get Website Details, and Get Websites Last Assessment as new Expander API endpoints
     • Introduces a Python Software Development Kit (SDK) for Asset, Incident, Tag, and Attack Surface Rules management
     • Adds Prisma Cloud integration to ingest cloud context from AWS, GCP, Azure, Alibaba Cloud, and Oracle Cloud Infrastructure
     • Adds Active Response add-on module with automated remediation for Mongo Server, PostgreSQL Server, MySql Server, and ElasticSearch Server
     • Adds Jira Cloud integration for ticket creation within the Active Response module

     +10 more show less

     • Adds Prisma Cloud integration for service owner identification within Active Response
     • Introduces Inventory navigation with Unified Inventory page and Cloud Inventory section
     • Enables bulk enable/disable of attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rules via Bulk edit attack surface rules capability
     • Allows download of data in CSV format from most list-view pages
     • Adds IPv4 address filter supporting CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network., Range, and Wildcard search
     • Adds domain-level filters
     • Adds ability to add notes to individual assets
     • Defines custom IP ranges via Asset Tag Rules for automatic tagging
     • Introduces Threat Response Center PDF reporting from threat event details page
     • Adds trending charts in Threat Response Center to track remediation progress

     15 details in Everything

440. Prisma Access 4.1 Preferred: Transparent SafeSearch Support Jun 2023 · release notes

     Prisma Access 4.1 Preferred introduces a new capability to enforce SafeSearch policies for guest users by mapping search engine FQDNs to SafeSearch portal IPs.

     • Enables Transparent SafeSearch Support to resolve search engine queries from mobile users and remote networks to the engine's SafeSearch portal by performing an FQDN-to-IP mapping

     1 detail in Everything

441. Prisma Access 4.1 Preferred: Private IP Visibility and Enforcement for Explicit Proxy Traffic Originating from Remote Networks Jun 2023 · release notes

     Prisma Access 4.1 adds private IP visibility and enforcement for explicit proxy traffic from remote branch networks via site-to-site IPSec.

     • Enables private IP addresses to skip authentication for headless systems in branches forwarding traffic to Explicit Proxy
     • Supports security policy enforcement based on private IPs of systems originating from remote branch locations
     • Provides visibility of traffic on Prisma Access Explicit Proxy for remote networks using Proxy mode

     3 details in Everything

442. Prisma Cloud: Features Introduced in June 2023 Jun 2023 · release notes

     Prisma Cloud Compute adds containerd support in Defender workflows, Azure Managed Identities, and new API endpoints for registry scans.

     • Adds --container-runtime flag to twistcli Defender deployment workflow to specify docker, cri-o, or containerd
     • Adds support for custom compliance checks on clusters running containerd runtime
     • Adds Azure Managed Identities authentication option for agentless scanning under Manage > Cloud accounts
     • Adds api/vVERSION/registry/progress endpoint to monitor registry scan status with optional onDemand parameter
     • Adds backward-compatible api/vVERSION/cloud/discovery/entities endpoint for cloud discovered entities

     5 details in Everything

443. Prisma Cloud: Features Introduced in June 2023 Jun 2023 · release notes

     Prisma Cloud adds AWS WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. v2, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. storage/DB, Dataplex, DAXDAXA Linux kernel feature that lets a filesystem map persistent memory (like NVDIM storage) directly into a process's address space, eliminating page-cache overhead and giving cyber tools near-zero-copy access to stored data., Shield API ingestions and new GCP/AWS/Azure network policies

     • Adds aws-waf-v2-rule-group API ingestion for AWS WAFv2 Rule Groups in the Security Audit role.
     • Adds oci-block-storage-volume-group API ingestion for OCI Block Storage Volume Groups requiring VOLUME_GROUP_INSPECT permission.
     • Adds aws-shield-drt-access API ingestion for AWS Shield DRT Access requiring shield:DescribeDRTAccess permission.
     • Adds gcloud-dataplex-lake-zone-action, gcloud-dataplex-lake-action, gcloud-vertex-ai-notebook-instance-schedule, and gcloud-dns-resource-record-set API ingestions for Google Cloud resources.
     • Adds new network policy 'GCP VM instance that is reachable from untrust internet source to ports with high risk' detecting risky port access on GCP VMs.

     +5 more show less

     • Adds new network policy 'AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance that is internet reachable with unrestricted access (0.0.0.0/0) to Admin ports' detecting open admin ports on AWS EC2.
     • Adds new network policy 'Azure Virtual Machine that is internet reachable with unrestricted access (0.0.0.0/0) to Admin ports' detecting open admin ports on Azure VMs.
     • Adds new network policy 'GCP VM instance that is internet reachable with unrestricted access (0.0.0.0/0) to Admin ports' detecting open admin ports on GCP VMs.
     • Adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Security metrics to Cloud Security Report powered by Adoption Advisor for quantifying unused over-privileged permissions.
     • Adds trendline for critical severity alerts and assets to Assets With Urgent Alerts, Incident Burndown, and Risk Burndown widgets in Adoption Advisor.

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow logs with partitions set to Every 24 hours (default) will be disabled; you must change the configuration to use the hourly partition.
444. Prisma Cloud: Features Introduced in May 2023 May 2023 · release notes

     Prisma Cloud Compute adds agentless Windows package scanning, host tag-based inclusion, private IP reporting, TAS 4.0/AL2023 support, and new APIs for feeds, settings, TAS dr

     • Adds Include hosts by tag option in Agentless Security to select a subset of hosts for scanning using tags and wildcards (e.g., web-*).
     • Adds ability to specify a subnet name and private IP for agentless scanning results in AWS.
     • Adds discovery date for host vulnerability scan results on the Host tab.
     • Adds support for TAS 4.0 as a new operating system for Compute capabilities.
     • Adds support for Amazon Linux 2023 as a new operating system for Compute capabilities.

     +5 more show less

     • Adds support for scanning third-party packages on Windows (Node.js, Python, Ruby Gems, Java JARs, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code.) via Agentless Security.
     • Adds feeds/custom/vulnerabilities and feeds/custom/malware API endpoints.
     • Adds a comprehensive set of Settings APIs including settings/certs, settings/custom-labels, settings/intelligence, settings/license, settings/logging, settings/logon, settings/proxy, settings/saml, and settings/scan.
     • Adds TAS Droplets management API endpoints (tas-droplets, tas-droplets/download, tas-droplets/progress, tas-droplets/scan, tas-droplets/stop).
     • Adds Trust Data API endpoints (trust/data).

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Ends the support for TLS ciphers TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_CBC_SHA, and TLS_RSA_WITH_AES_256_CBC_SHA for WAAS.
     • !AWS Lambda runtimes deprecated .NET Core 3.1; Prisma Cloud updated system requirements to reflect this deprecation.
445. Prisma Cloud: Features Introduced in May 2023 May 2023 · release notes

     Prisma Cloud 23.5.x adds GCP network analysis, Attack Path views, recurring CSA reports, credit allocation rules, and new detection capabilities

     • Adds config from network RQL support for GCP to the Cloud Network Analyzer
     • Adds Attack Path policies as a Saved View on the Homepage, Command Center, and Alerts page
     • Adds recurring Cloud Security Assessment reports configurable via daily, weekly, or monthly schedules
     • Adds Credit Allocation rules under Settings > Licensing > Credit Allocation with usage threshold alarms
     • Adds Create Custom Secret Signature check to Adoption Advisor Code Policy Management

     +18 more show less

     • Adds Add Drift Alert Rule to Adoption Advisor Notifications category
     • Adds new detection: 'Azure Virtual Machine that is reachable from any untrust internet source to ports with high risk'
     • Adds new detection: 'Azure SQL Server (PaaS) reachable from any untrust internet source'
     • Adds new detection: 'GCP VM instance that is internet reachable with unrestricted access (0.0.0.0/0)'
     • Adds new detection: 'AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance publicly exposed with critical/high exploitable vulnerabilities and port scan activity'
     • Adds new detection: 'AWS EC2 instance publicly exposed with critical/high exploitable vulnerabilities and ransomware activity'
     • Adds Mitre Att&ck v12 compliance standard to the Compliance > Standard page
     • Adds CRI Profile v.1.2.1 compliance standard to the Compliance > Standard page
     • Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft Azure Foundations Benchmark v2.0.0 to the Compliance > Standard page
     • Adds aws-iot-analytics-channel API ingestion for AWS IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Analytics
     • Adds aws-securityhub-enabled-standards API ingestion for AWS Security Hub
     • Adds azure-compute-gallery and azure-compute-gallery-image API ingestions for Azure Compute
     • Adds azure-managed-identity-user-assigned-identities API ingestion for Azure Managed Identity
     • Adds gcloud-hybrid-connectivity-global-hub and gcloud-hybrid-connectivity-spoke API ingestions for Google Hybrid Connectivity
     • Adds gcloud-serverless-vpc-access-connector API ingestion for Google Serverless VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Access
     • Adds gcloud-logging-default-sink-exclusion API ingestion for Google Stackdriver Logging
     • Adds oci-service-mesh-virtualservice-routetable and oci-service-mesh-virtualservice API ingestions for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Service Mesh
     • Improves UEBA Anomaly Policy Attribution to attribute alerts by resource name instead of ID

     23 details in Everything

446. Prisma Access 4.0 Preferred: Support for 15,000 Remote Network Sites Apr 2023 · release notes

     Prisma Access now supports creating up to 15,000 Remote Networks for branch site security.

     • Increases the maximum number of configurable Remote Networks from the previous limit to 15,000.

     1 detail in Everything

447. Prisma Cloud: Features Introduced in April 2023 Apr 2023 · release notes

     Prisma Cloud 23.4.x adds new GCP/AWS regions, Workload Protection policies, _Set.isSubset RQL, Data Security API endpoints, and CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. updates.

     • _Set.isSubset method in RQL to check if a JSON path value is contained in a target list
     • Support for Doha and Turin cloud regions on GCP
     • Support for Hyderabad cloud region on AWS
     • New Workload Protection policies: Workload Vulnerability and Workload Incident types
     • Critical detection policies for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances with public exposure plus data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., cryptomining, DGA, malware, botnet, or backdoor activity

     +7 more show less

     • Support for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27001:2022 compliance standard and reporting
     • New Data Security Settings API endpoints for managing data patterns and profiles (e.g., POST /config/v3/dss-api/data-pattern/clone/dssTenantId/:dssTenantId)
     • New Cloud Accounts REST API endpoints (POST /config/v3/account, GET /config/v3/account/awsorg/:id, etc.)
     • New GCP Cloud Account onboarding endpoints (POST /cas/v1/gcp_account, PUT /cas/v1/gcp_account/:id, POST /cas/v1/cloud_account/status/gcp, POST /cas/v1/gcp_template)
     • Alibaba account support via new deployment type parameter in Cloud Account APIs
     • New Azure Cloud Account onboarding endpoints (POST /cas/v1/azure_account, PUT /cas/v1/azure_account/:account_id, POST /cas/v1/azure_template)
     • New Data Security Onboarding API endpoints (e.g., GET /config/v3/account/storageUUID/:id, PUT /config/v3/account/:id)

     12 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The aws-ec2-classic-instance API is deprecated and will no longer be ingested at the end of April 2023.
     • !Prisma Cloud Data Security v1 and v2 APIs for AWS onboarding, data settings, patterns, profiles, and snippets are deprecated (e.g., POST /dlp/api/config/v2, GET /dlp/api/v1/resource-inventory/resources).
     • !The gcloud-compute-internal-lb-backend-service API resource ID changed, causing existing resources to be deleted and regenerated; associated alerts resolve as Resource_Updated.
448. Cortex XSOAR 8 SaaS: April 2023 Apr 2023 · release notes

     XSOAR 8.2 adds Multi-Tenant architecture, War Room tag filters, and integration log export

     • Adds Cortex XSOAR Multi-Tenant support for strict data segregation across main and child tenant accounts
     • Adds ability to filter War Room incidents by tags
     • Adds subscription updates for content packs in Marketplace
     • Allows custom login messages to be displayed to users before every login
     • Adds option to wrap label text for incident and indicator fields in layouts

     +7 more show less

     • Adds last seen timestamp to the engines table in the UI
     • Enables forwarding management audit log notifications to email distribution lists and syslog servers
     • Adds management of External Dynamic List (EDLEDLExternal Dynamic List — a plain-text URL-hosted feed of IPs, domains, or URLs that a firewall or cyber tool polls on a schedule to keep block or allow lists current without manual updates.) integrations via Settings > Integrations
     • Adds view and export capability for integration log details including status and error messages
     • Improves Default playbook with incident de-duplication, file/file-path retrieval, sandbox detonation, and severity calculation
     • Introduces new Default layout with dynamic sections and quick remediation buttons
     • Simplifies search for playbooks and scripts with free text search

     12 details in Everything

449. Prisma Cloud: Features Introduced in April 2023 Apr 2023 · release notes

     Prisma Cloud Code Security April 2023 adds private registry support and secret validation settings.

     • Adds Private Registries integration via Settings > Repositories > Add Repositories > Package Registries > Artifactory to improve SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. dependency accuracy
     • Adds Validate Secrets setting at Settings > Code Security Configuration > Validate Secrets to enable live secret verification against public APIs
     • Adds support for multiple Terraform Cloud and Enterprise Run Task integrations from a single Prisma Cloud account

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. XML output now uses namespaced tags, potentially breaking existing SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. ingestion pipelines
450. Prisma Cloud: Features Introduced in April 2023 Apr 2023 · release notes

     Prisma Compute 30.00.140 adds agentless scanning for Windows/Bottlerocket/encrypted AWS volumes, .NET NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code./OEL7/RHEL9/CBL-Mariner support, and WAAS customizable CAPTCHA.

     • Adds agentless scanning for Windows hosts (Server 2016, 2019, 2022) on AWS, GCP, and Azure
     • Adds agentless scanning of encrypted volumes using AWS hub accounts
     • Adds support for shared VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. in GCP agentless scanning
     • Adds vulnerability scanning support for .NET NuGet packages on images, functions, and hosts (via twistcli)
     • Adds support for Oracle Enterprise Linux 7 (x86) and Red Hat Enterprise Linux 9 (x86/ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.)

     +5 more show less

     • Adds runtime protection support for Photon OS 4.0 hosts
     • Adds support for CBL-Mariner 2.0 on hosts for vulnerability, compliance scanning, and runtime protection
     • Adds customizable CAPTCHA page for WAAS Bot Protection via Defend > WAAS > Active Bot Detection UI
     • Adds autoScalingEnabled and autoScalingMaxInstances fields to the /api/vVERSION/policies/firewall/app/agentless API endpoint
     • Adds serverless scanning configuration during cloud account onboarding under Compute > Manage > Cloud accounts

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The /api/vVERSION/settings/serverless-scan API route is no longer supported.
     • !The entities object in the GET /api/vVERSION/cloud/discovery response is moved to the new endpoint GET /api/v1/cloud/discovery/entities.
     • !The GET /api/vVERSION/cloud/discovery API endpoint now returns paginated responses of 50 results instead of all results.
451. Prisma Access 4.0 Preferred: Support for RFC 6598 Addresses in Prisma Access Infrastructure IP Addresses Mar 2023 · release notes

     Prisma Access 4.0 Preferred supports RFC 6598 shared address space in infrastructure configurations

     └──▷ BREAKING ON UPGRADE

     • !You can no longer use the 169.254.0.0/16 subnet for infrastructure addresses after enabling RFC 6598 support.
     • !Clientless VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. is not supported with RFC 6598 addresses, disabling this feature if required.
452. Prisma Access 4.0 Preferred: Support for 15,000 Branch Sites in a Single Tenant Mar 2023 · release notes

     Prisma Access 4.0 Preferred now supports managing up to 15,000 branch sites within a single tenant.

     • Prisma SASE single-tenant capacity scaled to support 15,000 branch sites

     1 detail in Everything

453. Prisma Cloud: Features Introduced in March 2023 Mar 2023 · release notes

     Adds Oracle Cloud scanning support for images and containers on Compute; improves GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. Autopilot testing and Defender upgrade UI.

     • Adds ability to scan images and containers running on cloud hosts in supported Oracle Cloud environments
     • Improves GKE Autopilot cluster testing for automatic updates with daily testing of the latest three Prisma Cloud releases against the latest GKE Autopilot version
     • Enhances Manage > Defenders > Deployed Defenders upgrade flow to filter by eligibility and role-based permissions, adding a confirmation dialog

     3 details in Everything

454. Prisma Access 4.0 Preferred: Support for 400 Remote Network Sites per IPSec Termination Node Mar 2023 · release notes

     Prisma Access 4.0 Preferred raises the limit for Remote Network Sites per IPSec Termination Node from 250 to 400.

455. Prisma Access 4.0 Preferred: PAN-OS 10.2 Support Mar 2023 · release notes

     Prisma Access 4.0 Preferred adds PAN-OS 10.2 support with selective commit, inline deep learning URL filtering, and multiple SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certs.

     • Enables Selective commit to apply configuration changes incrementally instead of committing the entire device config
     • Adds Advanced Threat Prevention Inline Cloud Analysis for real-time advanced threat inspection
     • Adds Domain Fronting Detection to identify and block domain fronting attacks
     • Supports Multiple certificate support for SSL inbound inspection to use different certificates per service
     • Adds Inline deep learning analysis for Advanced URL Filtering to improve detection accuracy

     +2 more show less

     • Enables HTTP header expansion in URL filtering policy rules
     • Adds Web form data inspection under Enterprise DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. to protect sensitive data in web forms

     7 details in Everything

456. Prisma Access 4.0 Preferred: New and Updated Prisma Access Locations Mar 2023 · release notes

     Prisma Access adds new compute locations in Ghana, Guatemala, Latvia, US Central West, Uruguay, and Uganda.

     • Adds Ghana to the Europe Northwest compute location
     • Adds Guatemala to the US East compute location
     • Adds Latvia to the Belgium compute location
     • Adds US Central West as a new compute location
     • Adds Uruguay to the South America West compute location

     +1 more show less

     • Adds Uganda to the Switzerland compute location

     6 details in Everything

457. Cortex Xpanse Expander: Expander Release 2.1 (March 2023) Mar 2023 · release notes

     Cortex Xpanse Expander 2.1 adds Threat Response Center, Automation Config Wizard, Remediation Path Rules, Web ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them., Risk Scoring, Asset Explainability, and Syslog forwarding.

     • Threat Response Center centralizes threat event aggregation, impact assessment, remediation planning, and alert/incident review in a single UI view.
     • Automation Configuration Wizard provides a step-by-step guided experience for installing and configuring integrations.
     • Remediation Path Rules allow customization of Active Response to automatically respond to alerts with specific business-context actions.
     • Active Response now supports use case coverage for SSH Servers, OpenSSH, Unencrypted FTP, Unclaimed S3, and SMTP servers, plus Azure and Google cloud providers.
     • Active Response enrichment integrations are now available for Tenable.io, Rapid7, and Splunk.

     +7 more show less

     • Web Security Assessments attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. rules detect website security best practice failures; these rules are disabled by default.
     • Website Business Unit (BU) tags enable filtering, sorting, and scope-based access control for websites.
     • Asset Explainability adds Asset Attribution Evidence, Asset Confidence Labels, and Attribution-Related Tags to the asset details panel and incident assets tab.
     • Risk Scoring automatically assigns an Xpanse Risk score to incidents based on threat/exploit intelligence, supports custom risk-scoring rules, and allows manual risk score assignment.
     • A new XSOAR Pack for Expander 2.x provides commands and incident fetching capabilities for automation.
     • Syslog Forwarding enables forwarding alerts and management audit logs to a syslog receiver.
     • Owned Responsive IPs and Owned IP Ranges are the new names in the Asset Inventory and API for assets previously called Unassociated/External.

     12 details in Everything

458. Prisma Access 4.0 Preferred: New Prisma Access Locations with Local Zones Mar 2023 · release notes

     Prisma Access 4.0 Preferred adds three new local zone locations with dedicated compute for lower latency.

     • Adds support for Australia West (Perth), US-Central (Chicago), and US-Southeast (Miami) as new Prisma Access locations.

     1 detail in Everything

459. Prisma Access 4.0 Preferred: Outbound Route Prefixes Increased to 500 Mar 2023 · release notes

     Prisma Access 4.0 Preferred raises outbound route prefix limit to 500 for Panorama Managed deployments

460. Prisma Access 4.0 Preferred: ZTNA Connector Mar 2023 · release notes

     Prisma Access 4.0 Preferred adds Zero Trust Network Access (ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections.) Connector for automated secure access without IPSec routing.

     • Adds the ZTNA Connector capability to enable automated secure tunneling for mobile and branch users, removing the need for manual IPSec tunnel setup and routing configuration.
     • Enables support for applications with overlapping IP addresses in complex multi-tenant or merged network environments through the ZTNA Connector.

     2 details in Everything

461. Prisma Access 4.0 Preferred: Prisma Access on the Strata Cloud Manager Platform Mar 2023 · release notes

     Prisma Access management and visibility (Autonomous DEM, Insights) available via Strata Cloud Manager

462. Prisma Access 4.0 Preferred: New Explicit Proxy Locations Mar 2023 · release notes

     Prisma Access adds new Explicit Proxy egress locations in US Central West, Poland, and Israel.

     • Adds Poland as a new Explicit Proxy location
     • Adds Israel as a new Explicit Proxy location

     2 details in Everything

463. Prisma Access 4.0 Preferred: Third-Party Data Source Support for Device-ID Mar 2023 · release notes

     Adds third-party IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. device intelligence integration to Prisma Access for cross-vendor policy enforcement

     • Enables leveraging IP address-to-device mappings from third-party IoT detection sources to identify and close security gaps.
     • Allows applying device-based security policies in Prisma Access using context obtained through the Cloud Identity Engine.

     2 details in Everything

464. Prisma Access 4.0 Preferred: Integrate Prisma Access with Cisco Meraki SD-WAN Mar 2023 · release notes

     Automated Cisco Meraki MX SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. onboarding to Prisma Access via API

465. Prisma Cloud: Features Introduced in March 2023 Mar 2023 · release notes

     Prisma Cloud Code Security adds custom permission groups and Git history secrets scanning

     • Adds Custom Prisma Cloud Permission group for Code Security capabilities to define explicit roles for view access, repository integrate/view/update/delete, and suppression/enforcement management via Settings > Access Control
     • Enhances Audit Logs to track administrator actions including Suppression Management (creating/deleting suppression rules), Enforcement rule changes (adding/reconfiguring/editing/deleting rules and modifying default thresholds), and Repository lifecycle events (addition, deletion, updating)
     • Adds Secrets Scanning on Git History to find exposed secrets deleted from code, visible in Projects > Secrets view with commit history in Resource Explorer

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Policy 'AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance is not configured with VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.' is deleted; Code Security findings for this policy will no longer be surfaced in scans
     • !Policy 'My SQL server enables public network access (duplication of CKV_AZURE_53)' is deleted; Code Security findings for this policy will no longer be surfaced in scans
466. Prisma Cloud: Features Introduced in March 2023 Mar 2023 · release notes

     Prisma Cloud adds GRBAC for Data Security, Attack Path policies, Command Center vulnerability widgets, and several REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints.

     • POST /commandcenter/v1/top-vulnerabilities enables querying urgent vulnerabilities via the Command Center API
     • POST /commandcenter/v1/vulnerabilities/summary returns counts of total vulnerable images and hosts via the Command Center API
     • Attack Path out-of-the-box policies detect publicly exposed AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances with risky permissions (e.g., iam:PassRole, ec2:RunInstances)
     • Azure Anomaly policies detect privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. or defense evasion tactics in Azure audit logs (e.g., workloads modifying Key Vault or deleting NSGs)
     • GRBAC (Granular Role Based Access Control) is now available for Data Security, allowing custom roles with View, Create, Update, or Delete permissions

     +1 more show less

     • Vulnerabilities widget in the Command Center dashboard displays urgent vulnerabilities, top 5 vulnerable images, and top 5 vulnerable hosts

     6 details in Everything

467. Prisma Cloud: Features Introduced in February 2023 Feb 2023 · release notes

     Prisma Cloud Code Security introduces enforcement thresholds, custom secrets regex, drift alert rules, and enhanced Projects views.

     • Adds configurable Enforcement Thresholds for Vulnerabilities, Licenses, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., Build integrity, and Secrets to code security modules
     • Adds a Code Editor in the console for defining regular expression patterns for Custom Secrets detection rules
     • Adds new alert rules specifically for detecting policy drift violations in AWS and Azure accounts via the Alerts console
     • Enhances the Projects view with grouped scan results, saved preset filters (Overview, IaC Misconfiguration, Vulnerabilities, Secrets, License, Build Integrity, VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. Pull Requests, CI/CD Runs), and a toggle for Enhanced mode

     4 details in Everything

468. Prisma Cloud: Features Introduced in February 2023 Feb 2023 · release notes

     Prisma Cloud adds Asset Class filter, audit log forwarding, new RQL operators, and multiple new API ingestions.

     └──▷ USE IT
     Query IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles that contain all specified actions using the new operator
     shell copy

     config from iam where action.name CONTAINS ALL ( 'Microsoft.AgFoodPlatform/farmBeats/seasons/write', 'Microsoft.AgFoodPlatform/fields/delete' )

     • Adds Asset Class filter to the Asset Inventory and Alerts Overview pages for filtering by Code, Compute, Database, Identity and Security, Network, Other, or Storage
     • Enables forwarding of audit logs to external AWS SQS or Webhook integrations via Enterprise Settings > Send Audit Logs to integration
     • Adds Access Key Expiration Notifications (Email for named users, Alarm Center for Service Accounts) configurable at Enterprise Settings > Access Key Expiration Notifications
     • Adds support for AWS tags in Prisma Cloud IAM RQL queries and dynamic custom policies
     • Adds support for Azure Permission levels in Prisma Cloud IAM context and custom policy creation

     +3 more show less

     • Adds CONTAINS ALL operator support for the action.name attribute in IAM queries
     • Adds API ingestion for new service resources including aws-ecr-registry, aws-chime-voice-connector, gcloud-analytics-hub-data-exchange-listing, gcloud-compute-external-vpn-gateway, gcloud-dataproc-metastore-federation, aws-cloudwatch-insight-rule, aws-kinesis-video-stream, oci-certificate-certificates, oci-cloudguard-security-zone, oci-cloudguard-security-recipe, oci-data-safe-private-endpoint, oci-data-safe-target-database, oci-iam-dynamic-group, oci-nosql-database-table, oci-scanning-host-scantarget, oci-scanning-host-scanrecipe, and oci-vault-keyvault
     • Adds new detection policies: DNS Rebinding Activity Anomaly Policy, Azure AKS cluster is not configured with disk encryption set, Azure Service Fabric cluster not configured with cluster protection level security, AWS SSM documents are public, AWS CloudFront distributions does not have a default root object configured, Azure Storage account is not configured with private endpoint connection, Azure Microsoft Defender for Cloud set to Off for Resource Manager, and GCP SQL server instance database flag 3625 (trace flag) is not set to on

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Legacy IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Scan on app.govcloud.io is End of Support; the IaC Scan plugins and the DevOps dashboard have been removed from the platform
     • !Prisma Cloud will no longer ingest gcloud-cloud-task API related resources because these are ephemeral; all gcloud-cloud-task resources will be deleted from your tenant
469. Prisma Cloud: Features Introduced in February 2023 Feb 2023 · release notes

     Prisma Cloud Compute 22.12 adds OEL, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9, Rocky Linux and Windows Server 2022 Defender support, cgroupv2 scanning, WAAS JSON exception whitespace handling, agentless custo

     • Added support for Oracle Enterprise Linux (OEL) 8 and 9 hosts and containers.
     • Added support for Red Hat Enterprise Linux 9 on X86 architecture hosts and containers.
     • Added support for Rocky Linux 8 and 9 hosts and containers.
     • Added Windows Server 2022 support for Container Defenders (compliance, vulnerability, registry, runtime scans, CNNS) and Host Defenders (compliance, vulnerability, WAAS, metadata scans).
     • Added full cgroup v2 support for Scans and WAAS In-Line firewall.

     +4 more show less

     • Added support for whitespace in JSON (body) Firewall exceptions for WAAS.
     • Added the ability to specify up to ten custom tags during agentless advanced configuration.
     • Introduced a new Last changed column in API Discovery showing the date of the latest change to an API.
     • Improved registry scan logs at Manage > Logs > Console to include information about scans that failed due to missing Defenders.

     9 details in Everything

470. Prisma Access 3.2 Preferred Innovation: Prisma Access Explicit Proxy License Enhancements Jan 2023 · release notes

     Prisma Access 3.2 enables single Mobile Users license for both Explicit Proxy and GlobalProtect

471. Prisma Access 3.2 Preferred Innovation: Kerberos Authentication Support for Explicit Proxy Jan 2023 · release notes

     Prisma Access 3.2 now supports combining SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication in a single Explicit Proxy deployment

     • Enables explicit proxy deployments to simultaneously use SAML for user authentication and Kerberos for user and machine authentication within the same configuration.

     1 detail in Everything

472. Prisma Access 3.2 Preferred Innovation: Explicit Proxy Support for Office 365 Client Apps Jan 2023 · release notes

     Prisma Access 3.2 adds Explicit Proxy support for native Office 365 client traffic

473. Prisma Access 3.2 Preferred Innovation: Advanced Threat Prevention Inline Cloud Analysis Support for Explicit Proxy Jan 2023 · release notes

     Prisma Access 3.2 adds inline cloud-based ML detection for Advanced Threat Prevention in Explicit Proxy deployments

474. Prisma Access 3.2 Preferred Innovation: Advanced URL Filtering Inline Deep Learning Analysis Support for Explicit Proxy Jan 2023 · release notes

     Prisma Access 3.2 adds inline deep learning URL filtering for Explicit Proxy deployments.

475. Prisma Access 3.2 Preferred Innovation: Advanced URL Filtering Inline Deep Learning Analysis Jan 2023 · release notes

     Prisma Access 3.2 adds inline deep learning analysis to Advanced URL Filtering for real-time detection of unknown threats.

476. Prisma Access 3.2 Preferred Innovation: Populate User Group Names in Security Policy Rules Using the Cloud Identity Engine Jan 2023 · release notes

     Populate User Group Names in Security Policy Rules Using the Cloud Identity Engine

477. Prisma Access 3.2 Preferred Innovation: Multi-Tenant Support for Cloud Identity Engine Directory Group Sync Jan 2023 · release notes

     Multi-Tenant Support for Cloud Identity Engine Directory Group Sync in Prisma Access 3.2

478. Prisma Access 3.2 Preferred Innovation: New Strata Logging Service Region: Switzerland Jan 2023 · release notes

     Prisma Access 3.2 Preferred Innovation adds a Strata Logging Service region in Switzerland for local log storage.

479. Prisma Access 3.2 Preferred Innovation: Simplified Activation and Subscription Management Jan 2023 · release notes

     New simplified activation and subscription management workflow in Prisma Access 3.2.

     • Introduces a single unified workflow for activating and managing all Prisma Access subscriptions
     • Adds Evaluation-to-production conversion requests within the new activation flow
     • Includes incident management procedures to troubleshoot activation-related issues

     3 details in Everything

480. Prisma Access 3.2 Preferred Innovation: Commit Job Status via XML API for Multi-Tenant Deployments Jan 2023 · release notes

     Prisma Access 3.2 adds a programmatic XML API endpoint for checking commit job statuses in multi-tenant Panorama deployments, replacing manual UI checks.

481. Prisma Access 3.2 Preferred Innovation: DNS Security Enhancements Jan 2023 · release notes

     Prisma Access 3.2 adds detection for strategically aged domains in DNS security.

482. Prisma Access 3.2 Preferred Innovation: Web Proxy Support Jan 2023 · release notes

     Prisma Access 3.2 introduces web proxy support for migrating on-prem SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. configurations.

     • Adds on-premises web proxy capability to Prisma Access, enabling seamless migration of existing Secure Web Gateway (SWG) configurations from PAN-OS 11.0.

     1 detail in Everything

483. Prisma Access 3.2 Preferred Innovation: 1 Gbps Maximum Bandwidth Support for Remote Network IPSec Termination Nodes Jan 2023 · release notes

     Prisma Access 3.2 increases max bandwidth for remote network IPSec termination nodes to 1 Gbps

484. Prisma Access 3.2 Preferred Innovation: API to Simplify Remote Network Automation Jan 2023 · release notes

     Prisma Access 3.2 introduces an automation API to streamline the configuration of remote SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. and CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. devices.

     • Automates IPSec node selection for remote networks via XML API.

     1 detail in Everything

485. Cortex XSOAR 8 SaaS: January 2023 Jan 2023 · release notes

     Cortex XSOAR 8.1 SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. adds unified platform look and feel, built-in Git Repository for dev/prod data sharing, communication task links, and Quiet Mode for manual tasks.

     • Integrates into the Cortex platform with a unified look and feel
     • Adds a built-in Git Repository for sharing data between development and production instances

     2 details in Everything

486. Prisma Access 3.2 Preferred Innovation: Regional Private IP Address Pools for Mobile Users—GlobalProtect Jan 2023 · release notes

     Adds granular regional IP address pools for Mobile Users—GlobalProtect in Prisma Access 3.2.

     • Allows specifying granular IP pools for specific connection locations instead of only global or broad regional levels in GlobalProtect deployments
     • Enables definition of IP pools at the Worldwide level or per Prisma Access theater level to control which address ranges users receive based on their connection location

     2 details in Everything

487. Prisma Access 3.2 Preferred Innovation: Prisma SASE Platform Jan 2023 · release notes

     Prisma Access 3.2 introduces the SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. Portal for unified license and tenant management.

     • Adds the SASE Portal as a single location to access and manage Prisma® SASE products
     • Adds Open API gateway to enable integration and automation for Prisma SASE services
     • Adds Identity and access management for centralized authentication of user roles and API-based access

     3 details in Everything

488. Prisma Cloud: Features Introduced in January 2023 Jan 2023 · release notes

     Prisma Cloud Compute v22.12 adds Talos Linux support, agentless OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. scanning, WAAS JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. parsing, TAS foundation filtering, and audit APIs.

     • Adds tasFoundations field to UI and GET /api/v{VERSION}/defenders API to filter Defenders by TAS Foundation ID
     • Adds Talos Linux support for Orchestrator Defenders with new --talos flag in twistcli
     • Adds agentless vulnerability and compliance scanning for Oracle Cloud Infrastructure (OCI)
     • Extends WAAS custom rules with JWT parsing functions to validate tokens in requests and responses
     • Adds AWS SQS as a trigger destination for Compute alerts under Manage > Alerts

     +5 more show less

     • Enables on-demand registry image scanning via onDemandScan body parameter on POST /api/v{VERSION}/registry/scan
     • Adds new Audit API endpoints for managing and downloading audit records across all controls
     • Increases maximum registry entries to 19,999 via POST /api/v{VERSION}/settings/registry and PUT /api/v{VERSION}/settings/registry
     • Adds support for regional STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. endpoints (sts.REGION.amazonaws.com) for Defender onboarding in AWS
     • Enables filtering Vulnerability Explorer results by package pivot and risk factors

     10 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Defenders running versions earlier than 22.01 will no longer be able to connect to the console
     • !Manual export of container runtime rules from Console 22.06 or older to 22.12 will fail due to schema change
489. Prisma Access 3.2 Preferred Innovation: New Prisma Access Compute Locations: Middle-East West and Europe Northwest (Paris) Jan 2023 · release notes

     Prisma Access 3.2 adds Middle-East West and Europe Northwest compute locations to reduce latency.

     • Adds new compute locations for Middle-East West (mapping from Israel) and Europe Northwest/Paris (mapping from France South) to optimize performance.
     • Automatically applies location remappings for all new Prisma Access deployments.

     2 details in Everything

490. Prisma Access 3.2 Preferred Innovation: Terminal Server Agent Support Jan 2023 · release notes

     Prisma Access adds Terminal Server Agent support to enable user-based policies in shared OS sessions.

     • Adds Palo Alto Networks Terminal Server (TS) Agent support for Windows Server 2019 and Windows 10 Enterprise Multi-session to map source ports to individual users.

     1 detail in Everything

491. Prisma Access 3.2 Preferred Innovation: Cloud Identity Engine Multiple Authentication Mode Support Jan 2023 · release notes

     Prisma Access Cloud Identity Engine now supports multiple auth methods and group-based rules in a single profile.

     • Supports certificate-based authentication and multiple SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.-based identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. within a single Cloud Identity Engine authentication profile
     • Enables group-based authentication to specify different authentication types for particular user groups or directories
     • Adds support for multiple authentication mode in Prisma Access Explicit Proxy deployments (SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication only)

     3 details in Everything

492. Prisma Access 3.2 Preferred Innovation: NAT Support for Private Applications Jan 2023 · release notes

     Prisma Access 3.2 adds source NAT options for mobile users and infrastructure traffic to private apps

     • Adds Enable Data Traffic Source NAT option to control which IP ranges are advertised to the data center for GlobalProtect mobile user traffic
     • Adds Enable Infrastructure Traffic Source NAT option to NAT infrastructure subnet addresses before they reach the data center
     • Supports RFC1918RFC1918IETF standard that reserves three IPv4 address ranges (10.x, 172.16–31.x, 192.168.x) for private networks, never routed on the public internet, giving tools a reliable way to identify internal traffic. and RFC6598 address ranges as configurable NAT subnets at service connections

     3 details in Everything

493. Prisma Access 3.2 Preferred Innovation: Dual Authentication Portal Support for Mobile Users—GlobalProtect Deployments Jan 2023 · release notes

     Prisma Access 3.2 adds support for configuring two independent GlobalProtect portals with different authentication methods on a single tenant.

     • Enables configuration of two Mobile Users—GlobalProtect portals in Prisma Access, each supporting a distinct authentication method (e.g., RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.) on a single tenant.

     1 detail in Everything

494. Prisma Access 3.2 Preferred Innovation: Simplified SASE Consumption Model with Prisma Access SD-WAN Add-On Jan 2023 · release notes

     Prisma Access introduces Prisma SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. as an add-on for unified SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. consumption.

     • Makes Prisma SD-WAN available as a simple add-on to Prisma Access

     1 detail in Everything

495. Prisma Access 3.2 Preferred Innovation: Next-Generation CASB-X for Prisma Access and Next-Generation Firewalls Jan 2023 · release notes

     Prisma Access 3.2 introduces CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic.-X, a new single-tenant SKU for Cloud Managed and Panorama Managed Prisma Access/NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports. that unifies SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. security components.

     • Introduces the CASB-X SKU that bundles SaaS Security Inline, SaaS Security API, SaaS Security Posture Management (SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.), and Enterprise DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. API.

     1 detail in Everything

496. Prisma Access 3.2 Preferred Innovation: Terminal Server Agent Additional Platform Support in Prisma Access 3.2.1 Jan 2023 · release notes

     Prisma Access 3.2.1 adds TS Agent support for Citrix XenApp, Windows Server 2019, and Win10 Multi-session to enforce user policies in shared sessions.

     • Adds Palo Alto Networks Terminal Server (TS) Agent support for Citrix XenApp 7.x, Windows Server 2019, and Windows 10 Enterprise Multi-session to map IPs to users in shared-session environments

     1 detail in Everything

497. Prisma Access 3.2 Preferred Innovation: Disable Logging for Service Connections Jan 2023 · release notes

     Prisma Access 3.2 allows disabling logging on service connections to reduce Strata storage consumption.

     • Adds the capability to disable logging on service connections for deployments with high asymmetric traffic flows.
     • Reduces Strata Logging Service storage consumption by omitting logs from asymmetric service connection flows.

     2 details in Everything

498. Prisma Cloud: Features Introduced in January 2023 Jan 2023 · release notes

     Prisma Cloud adds Agentless Workload Scanning onboarding, EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. audit ingestion, GuardDuty/Inspector findings support, and Adoption Advisor API endpoints.

     • Adds Agentless Workload Scanning as a selectable security capability during the cloud account onboarding workflow for AWS, Azure, and GCP
     • Adds support for configuring Amazon EventBridge to enable event-assisted ingestion of audit logs in near real time
     • Adds visibility into vulnerability and malware findings generated by AWS GuardDuty or vulnerabilities generated by AWS Inspector via the Config Findings page
     • Introduces GET /adoptionadvisor/report, POST /adoptionadvisor/report, PUT /adoptionadvisor/report/{reportId}, DELETE /adoptionadvisor/report/{reportId}, DELETE /adoptionadvisor/report/{reportId}/download, and GET /adoptionadvisor/report/{reportId}/{createdOn}/download for programmatic scheduling and retrieval of Adoption Advisor reports
     • Adds new compliance standards Sarbanes-Oxley Act (SOX), CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Google Cloud Platform Foundation Benchmark v2.0.0, and CIS Google Kubernetes Engine (GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.) v1.3.0 to the Compliance > Standard page

     +2 more show less

     • Adds asset.severity and vulnerability.severity as query parameters to GET /resource/scan_info
     • Adds informationalSeverityFailedResources and criticalSeverityFailedResources properties to response objects of GET /compliance/posture, POST /compliance/posture, GET /compliance/posture/trend, POST /compliance/posture/trend, GET /v2/inventory, POST /v2/inventory, and informational/critical fields within the alertStatus object of GET /resource/scan_info

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Monitor and Monitor & Protect modes are no longer available when onboarding new cloud accounts; they are replaced by the Remediation security capability in the new workflow
     • !The terraform file name for Azure onboarding changed from azure_template API to prisma-cloud-azure-terraform-<ts>.tf.json and for GCP from gcp_template API to prisma-cloud-gcp-terraform-<ts>.tf.json
499. Prisma Cloud: Features Introduced in January 2023 Jan 2023 · release notes

     Prisma Cloud Code Security adds Terraform Enterprise/Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. Tasks integration and new IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. build policies

     • Adds Terraform Enterprise (Run Tasks) integration via Settings > Repositories > Add Repository for automated policy-as-code checks in Terraform pipelines
     • Adds Terraform Cloud (Run Tasks) support with Pre-plan and Post-plan phase scan options for specific or all workspaces
     • Maps CVE Moderate severity to Medium and Important to Important, increasing violation volume for medium-above thresholds
     • Introduces new Configuration Build Policies including checks for GitLab CI images, CircleCI workflows, GitHub branch protection rules, and Kubernetes privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. risks
     • Adds build-time checks to existing Configuration Run Policies for AWS CloudFront, S3, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., ElastiCache, GCP Functions, and GCR scanning

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Make Prisma Cloud’s run tasks mandatory checkbox is removed from Terraform Cloud Run Tasks integration; builds with hard fail thresholds will now enforce these checks regardless of previous optional settings
500. Cortex Xpanse Expander: Expander Release 2.0 (December 2022) Dec 2022 · release notes

     Expander 2.0 adds Active Response automation, Web Attack Surface Management, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists./SBAC, Boolean searches, and cloud integrations.

     • Adds the Cortex Xpanse Active Response module to automate exposure remediation using out-of-the-box playbooks triggered by new alerts.
     • Introduces Web Attack Surface Management (Web ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.) to continuously discover and monitor insecure websites, web components, and technologies on managed and unmanaged assets.
     • Enables User Management features in the Expander UI including viewing user details, updating permissions, deactivating users, and hiding users.
     • Adds Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) with predefined roles and support for creating custom roles to control component access.
     • Adds Scope-Based Access Control (SBAC) to control data visibility using tags in conjunction with RBAC.

     +8 more show less

     • Provides the ability to create custom dashboards and reports using widgets from an extensive library.
     • Supports Boolean filtering on list view pages such as Asset Inventory, Incidents, and Alerts.
     • Adds Saved Searches to save and share filters on list view pages.
     • Adds AWS integration to pull in cloud compute instances.
     • Adds Azure integration to pull in cloud compute instances.
     • Adds GCP integration to pull in cloud compute instances.
     • Adds ServiceNow ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. integration to push tickets via the Active Response module.
     • Adds ServiceNow CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. integration to check assets in the ServiceNow CMDB.

     13 details in Everything