https://cybertoolchain.io/tools/palo-alto-networks New releases and features in Palo Alto Networks, tracked by The Cyber Toolchain. en Thu, 13 Aug 2026 09:38:12 GMT https://www.paloaltonetworks.com/blog/2026/08/putting-openai-cyber-models-to-work-for-defenders/ https://www.paloaltonetworks.com/blog/2026/08/putting-openai-cyber-models-to-work-for-defenders/ Thu, 13 Aug 2026 09:38:12 GMT Unit 42 Frontier AI Exposure Analysis gains GPT-5.6 Daybreak for automated attack-path discovery and exploitability validation. • Expands Unit 42 Frontier AI Exposure Analysis to deploy GPT-5.6 Daybreak — previously unavailable for commercial use — directly in customer environments to find exposures, test exploitability, validate attack paths, and prioritize remediation. • Adds Action Center to Device Security, enabling automated response actions against IoT/OT devices. • Adds integration between Device Security and IGEL UMS for unified endpoint and device security management. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://www.paloaltonetworks.com/blog/2026/07/announcing-general-availability-of-prisma-airs-ai-gateway/ https://www.paloaltonetworks.com/blog/2026/07/announcing-general-availability-of-prisma-airs-ai-gateway/ Thu, 16 Jul 2026 14:50:53 GMT Prisma AIRS AI Gateway reaches GA with inline LLM/MCP/A2A enforcement, agent identity binding, and quantum-resilient SASE fabric via AT&T partnership. • Introduces Prisma AIRS AI Gateway as a unified control plane sitting inline between AI apps, LLMs, MCP tool calls, and A2A interactions for centralized governance. • Adds unified observability across all AI usage: tracking users, projects, models, token counts, latency, and cost in a single view to expose shadow AI. • Enables central governance of approved models, tools, and access with FinOps controls including per-team/project budget enforcement and rate limiting before access is granted. • Adds Coding Assistant Security that replaces raw provider API keys with scoped, per-user/team credentials to protect secrets and proprietary code. • Introduces Agent Identity Security that binds verifiable, ephemeral identities to agents at execution time, enforcing just-in-time least-privilege access. • Delivers Runtime Security with inline prompt and response inspection aligned to OWASP LLM Top 10 and OWASP Top 10 for Agentic Applications, blocking prompt injection and data exfiltration. • Supports Universal API for traffic distribution across LLM providers with quota enforcement and failover. • Adds Post-Quantum Cryptography (PQC) to Prisma SD-WAN via hybrid key exchanges based on IETF RFC 9370, 9242, and 8784, wrapping data in classical and quantum-resistant protection simultaneously. • Transitions all Prisma SASE control plane traffic to TLS 1.3 for quantum-resilient management plane protection. • Encrypts all network telemetry and metadata in transit via TLS 1.3 with region-geofenced storage and no cross-region aggregation. • Embeds crypto-agility natively so PQC algorithms can be updated via automated cloud updates without hardware replacement. • Adds Secure Boot support on Prisma SD-WAN ION hardware with TPM-backed hardware root-of-trust, cryptographically signed boot chain, and PQC-secured management/control/data plane tunnels. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-28 https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-28 Mon, 15 Jun 2026 00:00:00 GMT Cortex Analytics 2026.05.28 adds 29 new detectors focusing on AI security, cloud storage mass deletion, and OAuth token theft. • Adds `Suspicious AI model usage from a Tor exit node` detector for high-severity AI infrastructure abuse • Adds `ML artifacts destruction` and `Unusual ML artifacts destruction` detectors for model integrity monitoring • Adds `Potential denial of wallet abusing AI services` and `Possible denial of wallet abusing AI services` variations for crypto/AI threats • Adds `Suspicious AI Dataset Download` and `Suspicious First-Time AI Dataset Download by Identity` detectors • Adds `Suspicious ML Model Download` and `Suspicious First-Time AI Model Download by Identity` detectors • Adds `Unusual AI Knowledge Base Modification` and `Suspicious AI Knowledge Base Modification` detectors • Adds `AI model discovery` detector for reconnaissance activity • Adds `AI safeguards deletion attempt` and `AI safeguards were successfully deleted` detectors • Adds `AWS Bedrock model invocation logging deletion` and related variations • Adds `Abnormal increase in network-related alerts on the same host` detector • Adds `Bedrock model shared with a foreign account` detector for data exfiltration risk • Adds `Cloud AI agent was modified` and `Unusual modification of AI agent` detectors • Adds massive file deletion detectors for Box, Dropbox, Google Drive, and Microsoft SharePoint/OneDrive • Adds `Modification of the AD FS IdentityServer configuration file` detector • Adds `Multiple network-related alerts of different MITRE tactics on the same host` detector • Adds `Possible ConsentFix - OAuth Token Theft Detected` and `OAuth Token Theft - Potential Session Hijacking Detected from new ASN` detectors • Adds `Suspicious AI Dataset Label Modification`, `Unusual AI RAG Knowledge Base Modification`, and `Unusual AI dataset modification` detectors • Adds `An RDS snapshot containing sensitive data was exported` detector for cloud database exposure • Adds `Unusual AI model invocation`, `Unusual AWS Bedrock model access request`, and `Unusual AWS SageMaker notebook access` detectors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#967ea6d9151b98e517faa0bedff59737 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#967ea6d9151b98e517faa0bedff59737 Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 Preferred Innovation adds Serviceability Commands for Remote Networks—High Performance • Supports serviceability commands against Remote Networks—High Performance termination nodes from Strata Cloud Manager • Routing Information command now available for viewing routing tables, including BGP, static, and OSPF routes, on High Performance connections • Service IP Address command retrieves FQDN or IP address of the High Performance service endpoint for CPE configuration • Clear Security Associations command allows forcing IPSec tunnel renegotiation by clearing IKE/IPSec security associations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/june-2026 https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/june-2026 Mon, 01 Jun 2026 00:00:00 GMT Adds CRI Profile v2.1, K-ISMS for Finance, NZISM v3.9, NIST SP 800-172 standards; updates AI and KSPM rules. • Adds 'Cyber Risk Institute (CRI) Profile v2.1' to the Standards Catalog • Adds 'Korea – Information Security Management System (ISMS) For Finance' to the Standards Catalog • Adds 'New Zealand Information Security Manual (NZISM) v3.9' to the Standards Catalog • Adds 'NIST SP 800-172' to the Standards Catalog • Updates EU AI Act, ISO/IEC 42001:2023, NIST AI 600-1, OWASP Top 10 for LLM Applications 2025, and OWASP Top 10 for Agentic Applications 2026 with new AI-focused rules • Adds KSPM-specific security configuration rules to CIS Amazon EKS Benchmark v1.4, CIS Azure AKS Benchmark v1.5, and other existing benchmarks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#b9703d959b8d26524713a4c094aff1eb https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#b9703d959b8d26524713a4c094aff1eb Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 allows up to eight Colo-Connects per region for redundancy • Supports deploying up to eight Colo-Connects per region • Adds support for GRE and non-GRE tunnel solutions with multiple Colo-Connects Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#340b62771040a750563c3c6e6b3fbff2 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#340b62771040a750563c3c6e6b3fbff2 Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 introduces BGP filtering and route metric configuration for service connections in Strata Cloud Manager. • Adds support for creating custom BGP policies on regular and Colo-Connect service connections to control routing behavior • Enables setting route metrics on service connections via the Strata Cloud Manager UI to influence traffic flow Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-june-2026 https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-june-2026 Mon, 01 Jun 2026 00:00:00 GMT Prisma Cloud adds detection for 15 new cloud services and fixes false negatives in Azure Cosmos DB and AWS API Gateway policies • Adds `aws-bedrock-agentcore-agent-runtime-endpoint` integration to detect Amazon Bedrock AgentCore agent runtime endpoints • Adds `aws-bedrock-agentcore-memory` integration to detect Amazon Bedrock AgentCore memory resources • Adds `aws-bedrock-agentcore-policy` integration to detect Amazon Bedrock AgentCore policy engines • Adds `aws-bedrock-agentcore-gateway` integration to detect Amazon Bedrock AgentCore gateways • Adds `aws-bedrock-agentcore-agent-runtime` integration to detect Amazon Bedrock AgentCore agent runtimes • Adds `aws-athena-prepared-statement` integration to detect Amazon Athena prepared statements • Adds `aws-ecr-repository-creation-template` integration to detect Amazon ECR repository creation templates • Adds `aws-opensearch-vpc-endpoint` integration to detect Amazon Elasticsearch Service VPC endpoints • Adds `gcloud-network-connectivity-policy-based-route` integration to detect Google Cloud Network Connectivity Center policy-based routes • Adds `gcloud-gke-backup-backup-channel` integration to detect Google Backup For GKE backup channels • Adds `gcloud-gke-backup-restore-channel` integration to detect Google Backup For GKE restore channels • Adds `gcloud-managed-kafka-clusters-acl` integration to detect Google Managed Kafka Clusters ACLs • Adds `gcloud-gcp-managed-kafka-connect-cluster` integration to detect Google Managed Kafka Connect Clusters • Adds `gcloud-vertex-ai-aiplatform-reasoning-engine` integration to detect Google Vertex AI AIPlatform reasoning engines • Updates the 'AWS API gateway request authorisation is not set' policy logic to exclude `OPTIONS` HTTP methods from authorization checks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/june-2026 https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/june-2026 Mon, 01 Jun 2026 00:00:00 GMT Cortex Cloud Runtime Security adds CRI, K-ISMS, NZISM, NIST SP 800-172 standards and AI/KSPM rule mappings for existing benchmarks. • Adds 'Cyber Risk Institute (CRI) Profile v2.1' to the Standards Catalog • Adds 'Korea – Information Security Management System (ISMS) For Finance' to the Standards Catalog • Adds 'New Zealand Information Security Manual (NZISM) v3.9' to the Standards Catalog • Adds 'NIST SP 800-172' to the Standards Catalog • Updates EU AI Act, ISO/IEC 42001:2023, NIST AI 600-1, OWASP Top 10 for LLM Applications 2025, and OWASP Top 10 for Agentic Applications 2026 with AI-focused cloud security posture management rules • Adds Kubernetes security posture management rules to CIS Amazon EKS Benchmark v1.4, CIS Amazon EKS Benchmark v1.7, CIS Azure Kubernetes Service (AKS) Benchmark v1.5, CIS Azure Kubernetes Service (AKS) Benchmark v1.8, CIS Docker Benchmark v1.7.0, CIS Google Kubernetes Engine (GKE) Benchmark v1.6, CIS Google Kubernetes Engine (GKE) Benchmark v1.8, CIS Kubernetes Benchmark v1.11.0, CIS Red Hat OpenShift Container Platform v1.7.0, HIPAA, and PCI DSS v4.0.1 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#f01c1f0a65ac12a9e7ec428b38e35e7a https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#f01c1f0a65ac12a9e7ec428b38e35e7a Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 adds SOCKS5 proxy support and scales trusted source IP capacity to one million • Adds `SOCKS5` proxy support on port `1080` with Basic Authentication for connecting to non-web TCP applications Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#0370aafddfe4d9b4b5ab99b15f67b0a4 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#0370aafddfe4d9b4b5ab99b15f67b0a4 Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 Preferred Innovation introduces inline prevention of AI-generated malware using Advanced WildFire's Code Genome technology. • Prisma Access 6.2 Preferred Innovation introduces inline prevention of AI-generated malware using Advanced WildFire's Code Genome technology. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#682cefc66d7bfe8064e33450036d19db https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#682cefc66d7bfe8064e33450036d19db Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 adds New Zealand compute location and remaps Ukraine to Poland • Adds a dedicated `New Zealand` compute location for Prisma Access users previously mapped to Australia. • Remaps the existing `Ukraine` Prisma Access location from `Germany Central` to `Poland` compute infrastructure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#960ccf65812b60075dfb8a7b9d12b3dd https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#960ccf65812b60075dfb8a7b9d12b3dd Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 introduces native IPv6 support for remote networks. • Enables native IPv6 operation for public-facing IP addresses in Prisma Access Remote Networks, supporting both underlay and overlay architectures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/june-2026 https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/june-2026 Mon, 01 Jun 2026 00:00:00 GMT Cortex XDR adds CRI Profile v2.1, K-ISMS Finance, NZISM v3.9, NIST 800-172 standards and AI/KSPM rule mappings. • Adds `Cyber Risk Institute (CRI) Profile v2.1` to the Standards Catalog • Adds `Korea – Information Security Management System (ISMS) For Finance` to the Standards Catalog • Adds `New Zealand Information Security Manual (NZISM) v3.9` to the Standards Catalog • Adds `NIST SP 800-172` to the Standards Catalog • Maps Kubernetes security posture management rules to existing cloud workload protection standards including `CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.4` and others • Maps AI-focused cloud security posture management rules to existing AI standards including `EU AI Act` and others Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#9a6f65b85cd12682eb85ac5f45c21889 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#9a6f65b85cd12682eb85ac5f45c21889 Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 adds native IPv6 support for service connections via dual-stack capabilities and dedicated BGP sessions. • Service connections now function as dual-stack entities processing both IPv4 and IPv6 traffic simultaneously • Enables secure implementation using IKE gateways configured specifically for IPv6 on customer premises edge devices • Adds support for dual BGP routing sessions to dynamically exchange routing information between service connections and CE devices Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#c5be7d6b6a86c9cfba1a5752248d5a4c https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#c5be7d6b6a86c9cfba1a5752248d5a4c Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 adds CVE Insights dashboard, Sliver C2 detection in TLS 1.3, and bulk enablement for advanced services. • Adds `CVE Insights` dashboard in Strata Cloud Manager for native CVE mapping and KEV status visibility • Enables Encrypted Sliver C2 Detection over TLS 1.3 via Advanced Threat Prevention Inline Cloud Analysis without decryption • Provides Bulk Enable Advanced Services wizard to activate Inline Cloud Analysis for Anti-Spyware, Advanced URL Filtering, Advanced WildFire, and Vulnerability Protection across custom profiles • Upgrades default profiles to include advanced protection by default for new greenfield setups • Introduces Threat Insights Dashboard with "Blocked Threats" metric and "Platform Effect" visualization • Reimagines Operator Dashboards for Advanced URL Filtering, Advanced WildFire, Advanced Threat Prevention, and Advanced DNS Security with real-time efficacy widgets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#627abeb07c292b818beddb5eb6683a4a https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#627abeb07c292b818beddb5eb6683a4a Mon, 01 Jun 2026 00:00:00 GMT Prisma Access 6.2 adds Context-Driven IP Address Manager for dynamic, policy-based source IP assignment using user geo-location, gateway location, and identity role. • Introduces `Context-Driven IP Address Manager` to dynamically assign source IP addresses based on real-time dimensions: User Geo-Location, Prisma Access Location, and Identity & Role • Enables granular, policy-driven access controls that automate compliance by replacing static rules with dynamic IP assignment logic Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#12ad5965e294815c7450059e3f352a2d https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-2-preferred-innovation#12ad5965e294815c7450059e3f352a2d Mon, 01 Jun 2026 00:00:00 GMT SASE Private Location now supports remote branch network connectivity via Local Inspection Nodes. • Introduces Local Inspection Nodes to bring Prisma Access managed data plane processing (virtual or hardware) into customer infrastructure, enabling low-latency inspection without routing through external cloud infrastructure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/june-2026 https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/june-2026 Mon, 01 Jun 2026 00:00:00 GMT Cortex XSIAM June 2026 adds CRI, ISMS, NZISM, NIST SP 800-172 standards; updates AI and KSPM rule coverage • Adds 'Cyber Risk Institute (CRI) Profile v2.1', 'Korea – Information Security Management System (ISMS) For Finance', 'New Zealand Information Security Manual (NZISM) v3.9', and 'NIST SP 800-172' to the Standards Catalog. • Updates EU AI Act, ISO/IEC 42001:2023, NIST AI 600-1, OWASP Top 10 for LLM Applications 2025, and OWASP Top 10 for Agentic Applications 2026 with new AI-focused cloud security posture management rules. • Maps Kubernetes security posture management (KSPM) rules to CIS EKS, AKS, GKE, Docker, Kubernetes, OpenShift benchmarks, HIPAA, and PCI DSS v4.0.1 for the first time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/cortex-xsoar-8-on-prem-releases https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/cortex-xsoar-8-on-prem-releases Fri, 22 May 2026 00:00:00 GMT Cortex XSOAR 8.13 On-prem adds Info mode in playbook editor and auto storage expansion via TUI • Adds `Info` mode in the playbook editor to view task and section details directly in workflow context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-06 https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-06 Mon, 18 May 2026 00:00:00 GMT Cortex Analytics adds new detection detectors and variants for Google Workspace, Azure, AWS, and Kubernetes environments. • Adds 'MFA was disabled for a Google Workspace user' detector with Medium and Low severity variations • Adds 'Large volume of files potentially containing credentials accessed in Google Drive' detector with Low severity variation for credential harvesting • Adds 'Cloud penetration testing tool activity' detector (High) to detect cloud pentesting tools • Adds 'Suspicious API call from a Tor exit node' detector (High) for Tor-based API access • Adds 'Suspicious objects encryption in an AWS bucket' detector (High) for ransomware-like S3 activity • Adds 'A Kubernetes API operation was successfully invoked by an anonymous user' detector (Medium) to detect anonymous K8s access • Adds 'Logging was impaired via external encryption key' detector (Medium) for log tampering • Adds 'AWS Guard-Duty detector deletion' detector (Low) to monitor GuardDuty integrity • Adds 'Azure Event Hub Deletion' detector (Low) and 'Azure Network Watcher Deletion' (Low) for monitoring Azure resource destruction Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-17-2026 https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-17-2026 Sun, 17 May 2026 00:00:00 GMT Cortex XDR 3.18 adds Broker VM upgrade enhancements and fixes static route management. • Broker VM upgrade enhancements improve reliability and stability of the upgrade process with reduced downtime. • The `restart_routes` command is now fully functional for static route management on Broker VM versions older than 31.0.58. • The legacy `route` command is deprecated and no longer supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-17-2026 https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-17-2026 Sun, 17 May 2026 00:00:00 GMT Cortex Cloud Posture Management adds Broker VM upgrade enhancements and fixes static route management in v31.0.58. • Improves reliability and stability of the Broker VM upgrade process with reduced downtime. • Makes the `restart_routes` command fully functional for configuring or restarting static routes. Breaking changes: • The legacy `route` command is deprecated and no longer supported on Broker VM versions older than 31.0.58. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-04-29 https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-04-29 Sun, 10 May 2026 00:00:00 GMT Cortex Analytics adds detection for multiple failed AWS assume role attempts and refines LDAP traffic detection logic. • Adds `Suspicious multiple failed AWS assume role attempts` detector to identify potential credential abuse via AWS STS. • Adds `LDAP traffic from an injected thread within a non-standard process` variation for deeper LDAP activity analysis. • Adds `LDAP traffic from non-standard process executed under an unsigned causality actor in a commonly abused directory` variation to detect suspicious lateral movement patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/2026-releases/may-2026 https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/2026-releases/may-2026 Fri, 01 May 2026 00:00:00 GMT Cortex Xpanse Expander 2.13 adds AST alert generation, AI surface coverage expansion, and XQL lookup datasets. • Generates alerts from positive Attack Surface Testing (AST) results to drive faster response • Expands AI Infrastructure Coverage with new AI Attack Surface Rules for OpenClaw, Hugging Face, and more • Enables creation and management of lookup datasets in XQL for correlating custom data sources with environment events Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-2026 https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-2026 Fri, 01 May 2026 00:00:00 GMT Cortex XDR 5.1 May 2026 adds FIM, CaaS support, new analytics suites, AppSec API triggers, SBOM-based vuln mgmt for CaaS, and Graph Search SBAC. • Adds File Integrity Monitoring (FIM) for XDR to Windows and Linux via the Cortex XDR agent • Adds Container as a Service (CaaS) support for AWS ECS Fargate via Cloud Runtime Security add-on • Adds `ciImage` and `imageRegistry` triggers and `blockCiImage` action to Application Security Policy API (`/public_api/appsec/v1/policies`) for pre-runtime scanning • Adds unified `findingTypes` values (CICD_RISKS, VULNERABILITY, SECRETS, IAC_MISCONFIGURATION, CODE_WEAKNESS, LICENSES, OPERATIONAL_RISK, MALWARE, DRIFT) to Application Security Policy API • Adds optional `userSbac` field to POST method of Application Security Policy API for scoped access control • Introduces Billing Contributors API endpoint to retrieve unique active contributors for billing transparency • Adds CaaS resource visibility in Asset Inventory under Compute assets, organized by ECS, Cloud Run, and Azure Container Instances • Adds granular per-object access control for report templates, playbooks, scripts, and saved queries • Expands Scope-Based Access Control (SBAC) with `Account Name` attribute for asset groups alongside existing `Realm` (Account ID) • Adds Malicious Emails Inventory view and AI-based phishing analysis in Advanced Email Security add-on • Adds single-click remediation quick actions from email investigation view • Adds new mailbox inventory in Unified Asset Inventory with mailbox metrics in Email Command Center • Adds detailed WildFire analysis reports accessible directly from the email causality card • Adds Scheduled Tasks, NDR Insights, Active Directory Federation Services, Google Workspace, Linux Discovery, and Kubernetes Credentials analytics suites • Adds real-time query management for saving, refining, or stopping XQL queries mid-execution • Introduces new mathematical and analytical functions in Cortex Query Language (XQL) • Adds DLP local application profiles for SSH, FTP, and RDP clients like FileZilla, PuTTY, and Windows Remote Desktop • Enables shared objects file examination to block malicious code via non-standard loading on Linux • Adds on-write detection for mach-o files, non-native macOS binaries (Windows PEs, Linux ELFs), and all Java files • Consolidates Vulnerability & Exposure Management into a unified module with quick links and pivot capabilities • Adds `Refine your risk accuracy` feature to recalibrate risk scores using custom/third-party security controls • Enables Tenable.sc vulnerability ingestion directly into Cortex Exposure Management • Introduces Vulnerability Ingest API for third-party scanner integration • Extends SBOM-based vulnerability evaluation to CaaS assets via Software Bill of Materials analysis • Adds Contextual Asset ID column in Vulnerabilities and Packages tables with direct navigation to nested asset tabs • Adds CVSS Version 4 support in Cortex Vulnerability Management • Adds SNMP v2/v3 authenticated scan support for Cortex Network Scanner • Adds Policy Compliance Assessment scan type for CIS Benchmarks in Network Scanner • Enables selection of saved Asset Groups as targets in new network scans • Migrates Network Scanner functionality from Settings->Configurations to Modules->Vulnerability & Exposure Management • Introduces Cloud NGFW (CNGFW) data source connector for cross-region and cross-account log ingestion • Adds SBAC enforcement in Graph Search with `User Groups` and `Asset Groups` scoping • Adds Case Timeline view, integrated asset context, SLAs for issue resolution, and issue exceptions in Investigation and Response • Adds centralized Identity Security profile for Windows Domain Controllers via ITDR add-on • Adds Chat with Cortex Agentic Assistant in Slack and natural language visualization capabilities • Allows administrators to remove unused or outdated saved views and filters Breaking changes: • Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries now enforce granular per-object access; default access for new objects is 'Restricted' instead of open. • Only object Owners or Administrators can delete custom objects; Editors no longer have deletion rights. • Enhanced application logs (EAL) are moved to non-billable status; EAL data volume is excluded from Data Collection (GB) license consumption totals and removed from the NGFW Ingestion Rate graph. • NGFW behavioral alerts previously displayed as 'High' severity now correctly display as 'Critical', potentially triggering different automation rules or notifications based on severity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-2026 https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-2026 Fri, 01 May 2026 00:00:00 GMT Cortex Cloud Posture Management v2.1 adds CSPM playbooks, Snyk integration, Alibaba Cloud support, AppSec policy API, CLI updates, Data Security Command Center and more. • Adds `Unified AppSec` policy engine with new `/public_api/appsec/v1/policies` API endpoints for unified finding types, CI build/registry scan triggers, pipeline blocking, and SBAC during creation • Adds 'CNGFW' (Cloud NGFW) as a new external data source connector for streaming traffic and application logs to Cortex Cloud • Adds Alibaba Cloud as a supported CSPM onboarding target with automated asset discovery and out-of-the-box policies • Adds Natively Snyk integration for ingesting SAST and SCA findings into Cortex Cloud • Adds 'Unified Human Identities' feature creating single virtual identities linking accounts across directories, cloud IdPs, and SaaS apps • Adds GCP Vertex Model Garden support for AI visibility tracking usage patterns and maintaining an AI Bill of Materials (AI-BOM) • Adds on-premise database support for Expanded DSPM governance across hybrid infrastructure • Introduces 'Data Security Command Center' (Beta) as a centralized dashboard for monitoring data discovery, classification, and security across connected stores • Expands CSPM automation with new playbooks and quick actions for remediation of internet-exposed compute instances and cloud misconfigurations across AWS, Azure, GCP • Enables manual AWS account onboarding flow allowing administrators to provision resources and IAM permissions directly without vendor templates • Enables manual GCP project onboarding flow allowing administrators to provision resources, service accounts, and permissions directly without vendor templates • Adds 'Bring your own Azure EventHub' capability for routing cloud audit log collection through customer-owned EventHubs • Allows connecting Microsoft Entra ID independently of tenant-level onboarding to enable CIEM, identity posture, and sign-in logs • Normalizes OCI audit logs into the `cloud_audit_logs` dataset for unified cross-cloud investigation via XQL • Adds new public API endpoint 'Billing Contributors' to retrieve unique active contributors factored into billing for seat transparency • Extends SBAC (Scope-Based Access Control) to allow defining Asset Groups scoped by **Account Name** attribute in addition to existing Realm/Account ID scoping • Enforces granular per-object access permissions across report templates, playbooks, scripts, and saved queries in Access Management • Automatically detects AWS Web Application Firewall (AWS WAF) instances to improve visibility of internet-exposed cloud assets • Adds 'AI associated' insight to instantly locate compute assets deploying AI models or containing AI software in their SBOM • Identifies Hugging Face open-source models found on virtual machines as self-managed and open-source for complete AI-BOM tracking • Displays Security Drift Detected highlight and dedicated Security Drift tab on Container Instances asset cards in Asset Inventory • Shows base image visibility for Build, Registry, or Runtime container images via **has base reference** and **is base reference for** relationships in Security Graph • Enables filtering the ASPM Command Center by one or more applications and a time range • Allows drilling down into ASPM Command Center prioritization funnel insights to view supporting evidence such as blocked findings • Enhances Urgency scoring coverage by extending calculations to active VM images and instances • Evaluates compensating controls (e.g., XDR Agent coverage) to automatically lower Urgency scores for detected assets • Correlates detected AWS API keys with their associated identity to improve impact assessment in Urgency scoring • Adds 'Chat with the Agentic Assistant directly in Slack' allowing users to trigger tasks and get results within Slack • Enables Natural language visualizations via Cortex Agentic Assistant to turn questions into charts without coding • Allows associating out-of-the-box config, identity, and AI cloud security rules with custom controls • Consolidates CaaS resources from Amazon ECS, Google Cloud Run, and Azure Container Instances into a dedicated section of the Asset Inventory under Compute assets • Expands notification forwarding fields for S3, SQS, Webhook, Splunk, and email to include asset name, cloud resource name, tags, account name, region, and evidence • Allows administrators to remove unused or outdated saved views and filters created by other users • Achieves Event-based Asset Ingestion (EAI) parity with Prisma Cloud for real-time monitoring via improved data processing speeds • Adds Support for importing configurations from existing Broker VM 31.x versions to the new Debian 13 based image during migration • Adds **Advanced Settings** in Broker VM web interface for legacy SSL renegotiation and accepting certificates without an Authority Key Identifier (AKID) • Presents a centralized Compliance Overview Dashboard showing compliance performance against industry standards and internal frameworks • Updates compliance score calculation to reflect the status of all assessed controls for all assessed assets • Allows querying OCI audit logs alongside AWS, Azure, and GCP activity using a unified schema via XQL • Enforces SBAC in Graph Search by assigning users to **User Groups** and **Asset Groups** to control visibility of graph nodes • Detects inactive identities for Google Cloud Platform users to help revoke unnecessary access • Enhances OCI effective permission calculations with Identity Domain support, additional dynamic group sources, and pseudo-resource handling • Introduces Case Timeline view capturing every action, artifact, and evidence in an end-to-end investigation lifecycle • Connects asset data directly to cases and issues for richer investigation context • Centers all remediation actions (recommended/pending actions, playbooks, CLI commands) in the Resolution tab and syncs to the case's Resolution Center • Adds Service Level Agreements (SLAs) for issue resolution to ensure critical issues are resolved within consistent timeframes • Formalizes risk deferrals using Exception Management for Issues with 'snooze' capabilities, documented justifications, and approval workflows • Consolidates Kubernetes controls into a unified management interface accessible from the Kubernetes Clusters page • Enables pulling images directly from private container registries in Enhanced Kubernetes Connector security • Supports GitOps workflows for standalone Kubernetes Connectors via installer updates • Restricts connector management to specific namespaces instead of the entire cluster and removes unnecessary secret creation permissions • Associates XDR security profiles with specific connectors using new Tag support during Kubernetes configuration • Improves KSPM Graph design to streamline exploration of relationships between workloads, nodes, and cloud resources • Adds Failure Policy setting to choose whether to allow or block requests if the Kubernetes admission controller is unreachable • Adds Request Scan button and API support to trigger on-demand Kubernetes cluster scans for inventory, containers, and nodes • Optimizes resource usage by having the KSPM posture module handle Adaptive Vulnerability Assessment (AVA) scans when a connector is deployed, disabling the XDR agent's AVA • Sets default access for newly created custom objects to **Restricted** so only the creator can access them initially • Changes Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries to manage access at the individual custom object level • Restricts deletion of custom objects to only the **Owner** or an Administrator, removing Editor delete rights Breaking changes: • Newly created custom objects default to **Restricted** access instead of Public. • Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries now manage access at the individual custom object level rather than a global setting. • Deletion of custom objects is restricted to the **Owner** (creator) or an Administrator; **Editors** no longer have delete permission. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026 https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026 Fri, 01 May 2026 00:00:00 GMT Cortex Cloud Runtime Security May 2026 adds GCP Vertex AI detection, OCI Object Storage DSPM, NLP viz in Slack, Snyk integration, and on-demand K8s scans. • Adds `has base reference` and `is base reference for` relationships in Security Graph to trace container image lineage from the asset details page • Enables triggering on-demand Kubernetes cluster scans via a new API and UI button to evaluate newly deployed resources instantly • Introduces a public `Billing Contributors API` endpoint to retrieve unique active contributors factored into billing • Adds GCP Vertex Model Garden discovery to track AI models as assets with activity data even without specific endpoints • Supports Alibaba Cloud account onboarding for unified security visibility across AWS, Azure, GCP, and OCI environments • Integrates Snyk SAST and SCA findings into Cortex Cloud via a new marketplace integration to centralize visibility • Adds Unified AppSec policy engine with `/public_api/appsec/v1/policies` API updates for unified finding types and pipeline blocking • Enables OCI Object Storage discovery and classification within the Data Security Platform module Breaking changes: • All newly created custom objects are now `Restricted` by default, meaning only the creator can access them until changed to `Public`. • Only the object `Owner` or an Administrator can delete a custom object; `Editors` can no longer delete them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/release-notes-34-04-160 https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/release-notes-34-04-160 Fri, 01 May 2026 00:00:00 GMT Prisma Cloud Compute Edition 34.04 adds per-image cluster caps, OCI compartment OCID support for agentless scanning, and PURL augmentation for binary packages. • Adds configurable cap for the number of clusters stored per image in MongoDB to prevent excessive document growth • Expands agentless scanning configuration to accept OCI compartments by OCID in addition to compartment name • Augments binary packages with Package URLs (PURLs) to improve software composition analysis accuracy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026 https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026 Fri, 01 May 2026 00:00:00 GMT Cortex XSIAM 3.5 (May 2026): New APIs, detections, integrations, and Agentic Assistant capabilities • Adds Application Security Policy API with new `triggers.ciImage`, `triggers.imageRegistry`, `blockCiImage` action, unified `findingTypes`, and optional `userSbac` field for scoped access • Introduces new Billing Contributors API endpoint to retrieve active contributors for billing transparency • Adds SBAC enforcement in Graph Search allowing users to assign user groups and asset groups for granular control • Enables Container as a Service (CaaS) support for AWS ECS Fargate within Endpoint Security via XDR Agent • Deploys advanced macOS kernel behavioral monitoring for near-real-time privilege escalation prevention • Adds on-write detection for mach-o, non-native binaries (Windows PE, Linux ELF), and Java files in Endpoint Security • Examines and blocks malicious shared object files on Linux in the Cortex XDR agent • Launches new analytics suites: Scheduled Tasks, NDR Insights, Active Directory Federation Services, Google Workspace, Linux Discovery, and Kubernetes Credentials • Adds new XQL mathematical/analytical functions and autosave/personalized view persistence in Query Builder • Expands notification forwarding fields to include asset name, cloud resource name, tags, account name, region, and evidence for S3, SQS, Webhook, Splunk, and email • Enables Slack integration for Cortex Agentic Assistant to trigger tasks directly from the application • Adds Scope-Based Access Control (SBAC) with Account Name attribute support in Access Management • Introduces 'Refine your risk accuracy' feature in Exposure Management to recalibrate risk scores based on custom controls • Provides Vulnerability ingest API and Tenable.sc integration for third-party vulnerability data • Adds `Compliance Policy Audit` scan type and SNMP v2/v3 authentication support in Network Scanner • Enables near-real-time Salesforce event collection and new CNGFW data source for cloud-native visibility • Supports CVSS V4 framework in Vulnerability Management and adds SBOM-based evaluation for CaaS assets • Adds Contextual Asset ID column in Vulnerabilities and Packages tables to trace finding origins • Allows import of configuration to Debian 13 broker image via Import Configuration tool enhancements • Adds Granular Per-Object Access control for user groups across report templates, playbooks, scripts, and saved queries Breaking changes: • Role permissions for Report Templates, Scripts, Playbooks, and Saved Queries now manage access at the individual custom object level instead of broad role settings • All newly created custom objects are now `Restricted` by default (owner-only access) until explicitly set to `Public` • Only the object Owner or an Administrator can delete a custom object; Editors lose deletion rights for objects they do not own • Enhanced application logs (EAL) are moved to non-billable status and excluded from Data Collection quota calculations and the NGFW Ingestion Rate graph • NGFW behavioral alerts previously mapped to High severity are now mapped to Critical severity in Cortex XSIAM, potentially triggering different automation or notification rules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026 https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026 Fri, 01 May 2026 00:00:00 GMT Cortex XDR 3.18 adds macOS/Linux kernel prevention, on-write detection, scheduled query management, and several new analytics suites. • Adds macOS and Linux kernel behavioral monitoring to prevent privilege escalation attempts in near-real-time • Adds Device guardrails for SD cards to block devices connected via the PCI Bus • Adds Real-time query management allowing users to refine, validate, or stop running queries before completion • Adds on-write detection for malicious mach-o files, non-native macOS binaries, Windows PEs, and Linux ELFs the moment they are saved • Adds Android zero-touch installation support via MDM providers like Workspace ONE and Intune • Adds Scheduled Tasks Analytics to identify malicious persistence through scheduled task installation and execution • Adds NDR Insights Analytics to correlate low-fidelity network signals with existing alerts • Adds Active Directory Federation Services Analytics to detect suspicious behavior within AD FS • Adds Google Workspace Analytics to detect attack attempts including brute force, phishing, and credential harvesting • Adds Linux Discovery Analytics to identify reconnaissance and host environment mapping activities • Adds Kubernetes Credentials Analytics to identify credential harvesting techniques such as kubelet impersonation • Adds Identity Profile in Centralized Identity Security for Domain Controllers to monitor LDAP protection and AD misconfigurations • Adds Broker VM Advanced Settings options for legacy SSL renegotiation and accepting certificates without Authority Key Identifier (AKID) • Enhances Import Configuration tool to support migration of existing Broker VMs to the new Debian 13 based image Breaking changes: • EAL data is no longer displayed on the Data Ingestion dashboard or NGFW Ingestion Rate graph, as EAL logs are now non-billable and excluded from quota totals. • NGFW behavioral alerts previously mapped to 'High' severity by the Detection & Mapping Service now display as 'Critical'; existing automation rules or notification profiles based on alert severity require adjustment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2026/may-2026 https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2026/may-2026 Fri, 01 May 2026 00:00:00 GMT Cortex XSOAR 8.14 SaaS adds multi-tenant name renaming, content workspace separation, expanded audit logs, and new CrowdStrike/AzureWAF integrations • Adds the ability to rename child tenants from within Cortex Gateway for simplified tenant management • Introduces a dedicated workspace structure that moves all content pack items to the Content Pack Items page, reserving the Content Items page exclusively for custom creations • Enhances audit logs with expanded auditing for notification forwarding configuration changes and high-stakes content lifecycle events such as pushing content to production in the Management Audit log • Adds Identity and privilege-based SOC response via CyberArk Endpoint Privilege Manager integration available through Cortex Marketplace • Adds new data collection type to the CrowdStrike Falcon integration to capture additional security events • Adds support for ingesting and analyzing Azure Front Door WAF policy data in the AzureWAF integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-03-18 https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-03-18 Mon, 13 Apr 2026 00:00:00 GMT Cortex Analytics adds detection logic for macOS process communication, AWS export events, SAML errors, and Okta admin actions. • Adds 15 new detector variations across High, Medium, Low, and Informational severities, including 'Uncommon macOS process communication to a rare external host' (High) and 'An unsigned process created scheduled task and performed an injection' (Medium) • Adds detection for Invalid SAML errors with the '[Informational] Invalid SAML Detected' detector • Adds 'Possible an unsigned installer created scheduled task and performed an injection' (Low) variation under the existing scheduling/detection category • Adds 'Discovery of accounts with pre-authentication disabled via LDAP' (Low) detector for Active Directory enumeration monitoring Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/april-2026 https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/april-2026 Wed, 01 Apr 2026 00:00:00 GMT Cortex Cloud Runtime Security adds CIS AWS/Azure v6/v5, HITRUST 11.7, OWASP Agentic, DPDP 2023 standards and updates SaaS/endpoint/network scanning rules. • Adds `CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1` to the Standards Catalog for AWS security hygiene. • Adds `CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 2` for advanced defense-in-depth configurations in AWS environments. • Adds `CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1` for specialized Azure configurations handling highly sensitive data. • Adds `CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 2` to harmonize global security and privacy standards into a unified assessment model. • Adds `HITRUST CSF 11.7.0` as a baseline security roadmap for Azure tenants focusing on identity and access controls. • Adds `OWASP Top 10 for Agentic Applications 2026` to manage risks associated with autonomous AI agents and goal manipulation. • Adds `The Digital Personal Data Protection Act 2023` to establish a legal framework for digital privacy and user consent rights. • Introduces SaaS-specific security configuration rules for `CIS Critical Security Controls v8` benchmarks. • Appends new rules to `CIS GitLab Benchmark 1.0.1` to detect insecure repository settings and access controls. • Appends new rules to `CIS GitHub Benchmark 1.0.0` to provide automated oversight of GitHub security settings and supply chain protection. • Introduces network scanning rules for `CIS Microsoft Windows Server 2022 Benchmark v3.0.0` to audit OS-level configuration drifts. • Introduces network scanning rules for `CIS Microsoft Windows 11 Enterprise Benchmark v.4.0.0` to audit endpoint security baselines. • Introduces workload security rules mapped to `Cloud Security Assurance Program (CSAP) - IaaS` for South Korean public sector services. • Introduces attack surface management controls for cloud-native applications in `CSA Cloud Controls Matrix (CCM) 4.0.12`. • Introduces application-layer security rules to the HITRUST framework in version `11.2.0`. • Appends new AI governance and management rules to `ISO/IEC 42001:2023`. • Introduces workload security rules mapped to Korea – Information Security Management System (ISMS) for private sector compliance. • Appends data security and privacy control rules to `NIST SP 800-53 Rev. 5`. • Appends rules to `NIST AI 600-1` for managing generative AI risks and safety. • Introduces attack surface management and CI/CD-specific rules in `OWASP TOP 10 CI/CD Security Risks 2025`. • Appends rules to `OWASP Top 10 for LLM Applications 2025` to defend against prompt injection and training data poisoning. • Introduces application-layer security rules to the `Secure Controls Framework (SCF) 2024.2`. • Introduces SaaS-specific security configuration rules for `SOC 2` benchmarks. Breaking changes: • Rule `CUSTOMIZE: Non-corporate accounts have access to Google Cloud Platform (GCP) resources.` is removed from all applicable compliance standards. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/april-2026 https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/april-2026 Wed, 01 Apr 2026 00:00:00 GMT Cortex XDR adds OWASP Top 10 for Agentic Applications and CIS AWS/Azure benchmarks to Compliance Catalog • Adds `OWASP Top 10 for Agentic Applications 2026` standard to the Standards Catalog • Adds `CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1` to the Standards Catalog • Adds `CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 2` to the Standards Catalog • Adds `CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1` to the Standards Catalog • Adds `CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 2` to the Standards Catalog Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/april-2026 https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/april-2026 Wed, 01 Apr 2026 00:00:00 GMT Cortex XSIAM adds OWASP Top 10 for Agentic Applications, DPDP Act standards and expanded CIS rules. • Adds 'OWASP Top 10 for Agentic Applications 2026' standard to the Compliance Catalog • Adds 'The Digital Personal Data Protection Act 2023' to the Standards Catalog • Adds 'CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1' and 'Level 2' support • Adds 'CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1' and 'Level 2' support • Adds 'HITRUST CSF 11.7.0' standard to the Compliance Catalog • Updates CIS Critical Security Controls v8 with SaaS-specific security configuration rules • Appends new rules for GitLab repository management in CIS GitLab Benchmark 1.0.1 • Appends new rules for GitHub developer workflows in CIS GitHub Benchmark 1.0.0 • Introduces network scanning rules for CIS Microsoft Windows Server 2022 Benchmark v3.0.0 • Introduces network scanning rules for CIS Microsoft Windows 11 Enterprise Benchmark v.4.0.0 • Introduces workload security rules mapped to CSAP-IaaS standard • Adds attack surface management controls for CSA Cloud Controls Matrix (CCM) 4.0.12 • Appends new application-layer security rules to HITRUST CSF 11.2.0 • Appends new AI governance rules to ISO/IEC 42001:2023 • Introduces workload security rules for Korea – Information Security Management System (ISMS) • Appends data security and privacy controls to NIST SP 800-53 Rev. 5 • Appends generative AI risk management rules to NIST AI 600-1 • Adds attack surface management and CI/CD rules for OWASP TOP 10 CI/CD Security Risks 2025 • Appends LLM vulnerability defenses to OWASP Top 10 for LLM Applications 2025 • Introduces application-layer security rules for Secure Controls Framework (SCF) 2024.2 • Adds SaaS-specific configuration rules for SOC 2 benchmarks Breaking changes: • Removes 'CUSTOMIZE: Non-corporate accounts have access to Google Cloud Platform (GCP) resources' rule from all applicable compliance standards. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/april-2026 https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/april-2026 Wed, 01 Apr 2026 00:00:00 GMT Cortex Cloud adds OWASP Top 10 for Agentic Apps, DPDP Act 2023 standards and new detection rules for GitLab, GitHub, Windows 11 and more. • Adds `CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 1` to the Standards Catalog for foundational AWS security hygiene. • Adds `CIS Amazon Web Services Foundations Benchmark v6.0.0 - Level 2` to cover advanced defense-in-depth configurations for sensitive workloads. • Adds `CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 1` to provide specialized, high-security configurations for Azure environments handling sensitive data. • Adds `CIS Microsoft Azure Foundations Benchmark - v5.0.0 Level 2` to harmonize global security and privacy standards into a unified assessment model. • Adds `HITRUST CSF 11.7.0` as a baseline security roadmap for Azure tenants focusing on identity and access controls. • Adds `OWASP Top 10 for Agentic Applications 2026` as a dedicated security framework for managing risks of autonomous AI agents. • Adds `The Digital Personal Data Protection Act 2023` to establish a legal framework for digital privacy and user consent rights. • Updates CIS Critical Security Controls v8 with first SaaS-specific security configuration rules to identify SaaS misconfigurations. • Appends new rules to `CIS GitLab Benchmark 1.0.1` to detect insecure repository settings and protect CI/CD workflows. • Appends new rules to `CIS GitHub Benchmark 1.0.0` to provide automated oversight of GitHub security settings and supply chain protection. • Introduces network scanning rules for `CIS Microsoft Windows Server 2022 Benchmark v3.0.0` to audit OS-level configuration drifts. • Introduces network scanning rules for `CIS Microsoft Windows 11 Enterprise Benchmark v.4.0.0` to audit security baselines for endpoints. • Adds workload security rules mapped to `Cloud Security Assurance Program (CSAP) - IaaS` for South Korean public sector mandates. • Introduces attack surface management controls for cloud-native applications in `CSA Cloud Controls Matrix (CCM) 4.0.12`. • Adds application-layer security rules in `HITRUST CSF 11.2.0` to strengthen data protection within the HITRUST framework. • Appends AI governance and risk management rules to `ISO/IEC 42001:2023` for international safety alignment. • Adds workload security rules mapped to Korea – Information Security Management System (ISMS) for private sector compliance. • Appends data security and privacy controls to `NIST SP 800-53 Rev. 5` for robust audit trails. • Appends generative AI risk management rules to `NIST AI 600-1` to mitigate transparency and bias risks. • Adds attack surface management and pipeline security rules in `OWASP TOP 10 CI/CD Security Risks 2025`. • Appends LLM vulnerability defenses to `OWASP Top 10 for LLM Applications 2025` covering prompt injection and data poisoning. • Adds application-layer security rules in `Secure Controls Framework (SCF) 2024.2` to reduce software-based regulatory failures. • Introduces SaaS-specific security configuration rules in `SOC 2` for real-time compliance visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-april-2026 https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/features-introduced-in-2026/features-introduced-in-april-2026 Wed, 01 Apr 2026 00:00:00 GMT Prisma Cloud adds AWS SDK for Java 2.x support, OCI compartment OCID for agentless scanning, nginx_unit detection, and FIPS env var config • Adds `FIPS_ENABLED` environment variable to `twistlock.cfg` to toggle FIPS mode without UI interaction. • Adds OCI compartment support in Agentless Scanning via the `OCID` field (in addition to compartment name) for programmatic configuration. • Adds vulnerability detection for `nginx_unit` application server binaries. • Adds Package URL (PURL) augmentation for binary packages to improve software composition analysis accuracy. • Adds configurable cap on the number of clusters stored per image in MongoDB to prevent excessive document growth. • Adds block login capability via feature flag for access key logins in the CWP UI. • Supports CIS AWS Foundations Benchmark v6.0.0 (Levels 1 and 2). • Supports CIS Microsoft Azure Foundations Benchmark v5.0.0 (Levels 1 and 2). Breaking changes: • The retention period for audit events stored in the Prisma Cloud database changed from 120 days to 30 days, impacting features relying on historical audit data such as Audit Trail & Investigation and Alert Details older than 30 days. • AutoFocus Anomaly policies are removed due to AutoFocus End of Life, affecting traffic-based anomaly detection and any custom policies using AutoFocus attributes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/release-notes-34-04-156 https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/release-notes-34-04-156 Sun, 29 Mar 2026 00:00:00 GMT Prisma Cloud Compute Edition 34.04 adds FIPS via env var, nginx_unit vuln detection, and UI access key restriction • Adds `FIPS_ENABLED` environment variable support in `twistlock.cfg` to configure FIPS mode • Adds vulnerability detection for `nginx_unit` application server binaries • Adds feature flag capability to restrict UI login via access keys for the CWP login page Breaking changes: • Defenders below release `v31` will disconnect from the Console • Support is no longer available for Defender versions previous to `31.00` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-03-04 https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-03-04 Sun, 15 Mar 2026 00:00:00 GMT Cortex Analytics 2026.03.04 adds detectors for cloud database exfiltration and Microsoft Teams phishing. • Added detector '[Low] Data exfiltration from cloud database' • Added detector '[Low] Possible phishing attack via Microsoft Teams' • Added detector '[Medium] Azure Privilege Escalation Using an Application' • Added detector '[Low] Possible Insider Threat Activity' • Added detector '[Low] Potential extraction of NAA Account Credentials in Microsoft Configuration Manager' • Added detector '[Low] Suspicious LDAP queries followed by shared folder access' • Added detector '[Informational] Windows CGO, actor process and action module with anomalous characteristics' • Added detector '[Informational] A Cloud DB instance was exported to an unknown destination' Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/ngfw/new-features/by-version/panos/12-1#a0dfbdeb644cea3ee3634a4aca7206d3 https://docs.paloaltonetworks.com/ngfw/new-features/by-version/panos/12-1#a0dfbdeb644cea3ee3634a4aca7206d3 Sun, 01 Mar 2026 00:00:00 GMT PAN-OS 12.1 adds High Availability active/passive support for PA-7500 firewalls using HSCI. • Enables traditional High Availability active/passive configurations on PA-7500 Generation 5 hardware • Supports High Speed Chassis Interconnect (HSCI) for HA1 and HA2 session and configuration synchronization Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#5d886e4b060edc370d3a9c226c6d9ea1 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#5d886e4b060edc370d3a9c226c6d9ea1 Sun, 01 Mar 2026 00:00:00 GMT Prisma Access 6.1 introduces NGFW as ZTNA Connector automation and Server Initiated Traffic for automated private app onboarding. • Enables configuring an existing Next-Generation Firewall (NGFW) as a Zero Trust Network Access (ZTNA) Connector to automate connectivity, NAT configurations, and application onboarding. • Adds Server Initiated Traffic support for the NGFW Connector, allowing data center application servers to initiate outbound TCP, UDP, and ICMP sessions to GlobalProtect users and Remote Network hosts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-18 https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-18 Sun, 01 Mar 2026 00:00:00 GMT Cortex Analytics content release adds detections for uncommon net group/localgroup execution and /etc/passwd access. • Adds detection capability for `Uncommon net group command execution` patterns including high-severity unsigned administrator command variants • Adds detection capability for `Uncommon net localgroup command execution` patterns via web server or scripting engines • Adds detection capability for `Uncommon access to /etc/passwd` by potential webshells, credential dumpers, or security testing tools • Adds low-severity detection for `LOLBAS executable injects into another process under an uncommon CGO` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/ngfw/new-features/by-version/panos/12-1#0838919132a82d54e1c9a2c683aee637 https://docs.paloaltonetworks.com/ngfw/new-features/by-version/panos/12-1#0838919132a82d54e1c9a2c683aee637 Sun, 01 Mar 2026 00:00:00 GMT PAN-OS 12.1 adds customizable capacity settings in Panorama to scale SD-WAN VIFs up to 16 members • Panorama allows customization of firewall capacity settings for flexible and efficient SD-WAN deployments • Supports scaling to up to 16 members per VIF while maintaining optimal system performance • Enables balancing of system resources between SD-WAN rules, interfaces, and members based on deployment needs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#9bce23a36049c65909ed5dfd564537c8 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#9bce23a36049c65909ed5dfd564537c8 Sun, 01 Mar 2026 00:00:00 GMT Prisma Access 6.1 adds customizable re-auth frequency (10h–30d), warning timers and aggressive auth for Dynamic Privilege Access. • Adds a configurable re-authentication frequency setting to control user refresh token lifetime globally across your deployment, with intervals ranging from 10 hours to 30 days • Adds customizable warning timers that notify users before re-authentication is required, preventing unexpected disconnections and workflow disruption • Enables aggressive authentication to force immediate re-authentication when users connect or extend gateway sessions for stricter security enforcement • The gateway session timeout setting has been renamed for clarity Breaking changes: • The `gateway session timeout` setting name has changed, requiring updates to any existing configuration references or documentation pointing to the old name Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#b4c171fb3e4735449927e7ffbb857d46 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#b4c171fb3e4735449927e7ffbb857d46 Sun, 01 Mar 2026 00:00:00 GMT Prisma Access 6.1 adds compute locations in Brazil Southeast and UK West • Adds new compute locations for Brazil Southeast and UK West to reduce latency and meet data residency requirements. • Introduces `IP pool group 13` as the mapping target for the Brazil Southeast location. • Introduces `IP pool group 4` as the mapping target for the UK West location. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#8351a0bcb1e81db9c721f2799a5e59b6 https://docs.paloaltonetworks.com/prisma-access/new-features/by-version/prisma-access/6-1-preferred-innovation#8351a0bcb1e81db9c721f2799a5e59b6 Sun, 01 Mar 2026 00:00:00 GMT Prisma Access 6.1 Preferred Innovation adds Post-Quantum Cryptography (PQC) support for TLS traffic inspection. • Supports hybrid post-quantum encryption schemes combining ECC with NIST-standardized ML-KEM algorithms for TLS key establishment Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/release-notes-34-04-145 https://docs.prismacloud.io/ce-release-notes/prisma-tm-cloud-compute-edition-release-information/release-notes-34-04-145 Sun, 01 Mar 2026 00:00:00 GMT Prisma Cloud Compute Edition 34.04 adds Debian 13, TLS 1.3, GCP Gen 2, Nftables and CIS Bottlerocket support. • Adds Debian 13 (Trixie) as a supported operating system for Defenders • Adds TLS 1.3 protocol support for secure communications • Adds support for GCP Cloud Function Gen 2 discovery and protection via the Cloud Run Admin API • Adds Nftables support for Cloud Native Network Firewall in Defenders to replace iptables on modern Linux systems • Adds CIS Bottlerocket Benchmark controls 1.3.1, 1.4.3, and 1.4.4 compliance checks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-11 https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-11 Mon, 23 Feb 2026 00:00:00 GMT Adds 6 new detectors and modifies logic for 70 detectors in Cortex Analytics content release 2026.02.11. • Adds the 'AWS Security Service Enumeration' detector (Low) to detect AWS security service discovery. • Adds the 'Machine Account NTLM Relay' detector (Low) to identify NTLM relay attacks using machine accounts. • Adds the 'Sensitive browser credential files accessed by a rare non browser process' detector (Informational/Low) for file access anomalies. • Adds the 'A cloud storage configuration was modified' detector (Informational) to track cloud storage config changes. • Adds the 'An RDS snapshot was exported to an unknown bucket' detector (Informational/Failed attempt) for unauthorized RDS data exfiltration attempts. • Adds the 'Unusual internal access to network device management interface' detector (Informational) for anomalous network admin access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-22-2026 https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-22-2026 Sun, 22 Feb 2026 00:00:00 GMT Cortex XDR February 2026 release introduces Broker VM upgrade reliability improvements for version 30.0.63. • Broker VM upgrade process reliability and stability improved in version 30.0.63 to reduce downtime during upgrades. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/palo-alto-networks