Cortex XSOAR Content Release Notes for version 20.9.0 (98126)

This content release includes new content packs and updates to existing content packs.

Published on 1 September 2020

New Content Packs

New: Email Communication Pack v1.2.0

Do you have to send multiple emails to end users? This content pack helps you streamline the process and automate updates, notifications and more.

IncidentFields

  • Add CC To Email

IncidentTypes

  • Email Communication

Scripts

PreprocessEmail

Preprocessing script for email communication layout. This script checks if the incoming email contains an Incident ID to link the mail to an existing incident, and tags the email as "email-thread".

For more information about the preprocessing rules, refer to: https://demisto.developers.paloaltonetworks.com/docs/incidents/incident-pre-processing

SendEmailReply

Sends email massages with the configured mail sender integration.

New: Genians Pack v1.0.0 (Partner Supported)

Integrations

Genians

Use the Genians integration to block IP addresses using the assign tag and unassign tag.

New: McAfee ESM Pack v1.0.0

Integrations

McAfee ESM v2

Run queries and receive alarms from McAfee ESM. The integration supports McAfee version 10 and above.

New: Microsoft Advanced Threat Analytics Pack v1.0.0

Classifiers

Microsoft Advanced Threat Analytics - Classification

Classifies Microsoft Advanced Threat Analytics suspicious activities.

Microsoft Advanced Threat Analytics
Microsoft Advanced Threat Analytics - Incoming Mapper

Maps Microsoft Advanced Threat Analytics suspicious activity fields.

IncidentFields

  • Suspicious Activity End Time
  • Suspicious Activity ID
  • Suspicious Activity Severity
  • Suspicious Activity Start Time
  • Suspicious Activity Status

IncidentTypes

  • Microsoft ATA Suspicious Activity

Integrations

Microsoft Advanced Threat Analytics

Use Microsoft Advanced Threat Analytics integration to manage suspicious activities, and monitor alerts and entities.

New: NTT Cyber Threat Sensor Pack v1.0.0 (Partner Supported)

Classifiers

NTT Cyber Threat Sensor - Classifier

Classifies NTT Cyber Threat Sensor incidents.

NTT Cyber Threat Sensor
NTT Cyber Threat Sensor - Incoming Mapper

Maps incoming NTT Cyber Threat Sensor fields.

IncidentFields

  • FAERE Description
  • Graph Plot

IncidentTypes

  • TD Incident

Integrations

NTT Cyber Threat Sensor

Retrieves alerts and recommendations from NTT CTS.

Playbooks

Handle TD events

Enriches TD events

New: PiHole Pack v1.0.0 (Community Supported)

Integrations

PiHole

Pi-hole is a network-level advertisement and Internet tracker blocking application that acts as a DNS sinkhole and optionally a DHCP server, intended for use on a private network.

New: QueryAI Pack v1.0.0 (Partner Supported)

Integrations

Query.AI

Query.AI is a decentralized data access and analysis technology that simplifies security investigations across disparate platforms without data duplication.

Updated Content Packs

Access Investigation Pack v1.2.2

Layouts

layout-edit-Access.json

Set the default incident type for the layout

layout-details-Access.json

Set the default incident type for the layout

Base Pack v1.1.17

Scripts

WordTokenizerNLP

Updated the script Docker image to the latest version.

CommonServerPython
  • Added the following code objects, which simplifies creating widgets.
    • TextWidget
    • TrendWidget
    • NumberWidget
    • BarColumnPieWidget
    • LineWidget
    • TableOrListWidget
  • Fixed an issue with the mirroring mapper scheme.
  • Fixed an issue in the return_outputs function where the content type was incorrect.
SaneDocReports

Fixed an issue with the table readable headers.

CheckPhish Pack v1.0.1

Integrations

CheckPhish
  • Updated the default API URL.
  • Adjusted the error handling to use the new API format.

Cisco AMP Pack v1.0.1

Integrations

Cisco AMP

Fixed an issue that caused the amp_move_computer to fail.

Cisco Umbrella Investigate Pack v1.0.1

Integrations

Cisco Umbrella Investigate

Fixed an issue where the umbrella-ip-dns-history command failed when no IP results were found.

Code42 Pack v2.0.3 (Partner Supported)

Integrations

Code42

Fixed a bug where File Category would not map correctly when creating incidents from Code42 alerts.

Cofense Triage Pack v1.1.4 (Partner Supported)

Integrations

Cofense Triage v2

Fixed an issue in the cofense-get-attachment command.

Common Playbooks Pack v1.7.1

Playbooks

Extract Indicators From File - Generic v2

Added support for UTF-8 Unicode text files.

Common Scripts Pack v1.2.34

Scripts

WhereFieldEquals

Fixed an issue where WhereFieldEquals returned a string instead of a list.

FeedRelatedIndicatorsWidget

Fixed an issue where the indicator link value was incorrect.

Common Types Pack v1.8.8

Layouts

  • File Indicator
  • layout-edit-Vulnerability.json
  • layout-details-Vulnerability.json

CrowdStrike Falcon Streaming Pack v1.0.7

Integrations

CrowdStrike Falcon Streaming v2
  • Improved error handling of unsupported media types.
  • Improved handling when the stream response client is not completed.
  • Maintenance and stability enhancements.

CyberArk Pack v1.0.2

Integrations

CyberArk PAS
  • Added documentation for the integration.
  • Updated the the cyberark-pas-credentials-verify command to use the new API.
  • Added the cyberark-pas-account-get-details command.

DUO Admin Pack v2.0.1

Integrations

DUO Admin

Updated the integration Docker image to the latest version.

Endace Pack v1.1.0 (Partner Supported)

Integrations

Endace
  • Added support for directionless IP and port search.
  • Improved error handling messages.
  • The hostname parameter is now mandatory.

Playbooks

Endace Search Archive and Download

This playbook is deprecated. Use the Endace Search Archive Download PCAP v2 playbook instead.

Deprecated: Endace Search Archive Download PCAP

This playbook is deprecated. Use the Endace Search Archive Download PCAP v2 instead.

Endace Search Archive Download PCAP v2
  • Added support for directionless IP and port search, user friendly timeframe values.
  • Updated the playbook input and output variables and their definitions.

Expanse Pack v1.1.1 (Partner Supported)

Integrations

Expanse

Updated the version number in the user-agent header.

GDPR Pack v1.0.5

Layouts

  • layout-edit-GDPR_Data_Breach.json
  • layout-details-GDPR_Data_Breach.json

GitHub Pack v1.1.1

Integrations

GitHub

Improved error handling of parameter errors.

Gmail Pack v1.0.5

Integrations

Gmail

Removed the event argument from the gmail-list-users command. If you currently use this argument it will be ignored when executing the command. If you do not install this upgrade, the following integration components will fail:

  • Test button
  • gmail-list-users command
  • gmail-search-all-mailboxes command

IBM QRadar Pack v1.0.8

Integrations

IBM QRadar

Added a parameter that enables you to specify the number of addresses to enrich per API call.

IronDefense Pack v1.1.1 (Partner Supported)

Classifiers

IronDefense

Added a new classifier.

IronDefense - Incoming Mapper

Added a new incoming mapper.

IronDefense - Classifier

Added a new classifier.

Integrations

IronDefense
  • Added the ability to retrieve IronDefense alerts and events.
  • Improved integration descriptions.

Layouts

  • layout-details-IronDefense_IronDome_Notification.json
  • layout-details-IronDefense_Event_Notification.json
  • layout-details-IronDefense_Alert_Notification.json

Malware Pack v1.2.3

Layouts

  • layout-edit-Malware.json
  • layout-details-Malware.json

Malwarebytes Pack v1.0.2 (Partner Supported)

Integrations

Malwarebytes

Added Code for Usage Analytics.

McAfee ESM v10 and v11 Pack v1.0.3

Integrations

Deprecated: McAfee ESM v10 and v11

Use the McAfee ESM v2 integration instead.

Microsoft Graph User Pack v1.2.0

Integrations

Microsoft Graph User

Fixed an issue where the next_page argument in the msgraph-user-list command did not work as expected.

Palo Alto Networks Cortex XDR - Investigation and Response Pack v2.3.3

Integrations

Palo Alto Networks Cortex XDR - Investigation and Response

Added a default classifier and mapper.

PassiveTotal Pack v1.0.1

Integrations

PassiveTotal

Limited the number of related domains that display in the War Room for enrichment commands.

Phishing Pack v1.10.2

Layouts

layout-quickView-Phishing

Set the default incident type for the layout.

layout-mobile-Phishing

Set the default incident type for the layout.

Phishing Incident

Set the default incident type for the layout.

layout-edit-Phishing

Set the default incident type for the layout.

Proofpoint TAP Pack v1.1.0

Integrations

Proofpoint TAP v2

Fixed an issue in the proofpoint-get-forensics command where the command failed when getting a threat by campaignId.

ServiceNow Pack v1.2.1

Classifiers

New: ServiceNow Classifier

Classifies ServiceNow tickets.

New: ServiceNow - Outgoing Mapper

Maps outgoing ServiceNow incident fields.

New: ServiceNow - Incoming Mapper

Maps incoming ServiceNow incident fields.

Integrations

ServiceNow v2
  • Added the ability to mirror tickets between ServiceNow and Cortex XSOAR.
  • Removed unnecessary import.

Layouts

ServiceNow Ticket

SplunkPy Pack v1.1.3

Integrations

SplunkPy
  • Fixed an issue where the splunk-parse-raw command failed when the raw argument received input in JSON format.
  • Fixed an issue in which some incidents were not fetched.

Symantec Endpoint Protection Pack v1.0.2

Integrations

Symantec Endpoint Protection v2

Fixed an issue in which the domain parameter was not parsed correctly.

Tanium Pack v1.0.2

Integrations

Tanium v2

Added the completion-percantage argument to the following commands.

  • tn-get-saved-question-result
  • tn-get-question-result

ThreatConnect Pack v2.0.5

Integrations

ThreatConnect v2

Fixed an issue where the DBotScore calculation did not work as expected.

Assets

Edit this page
Report an Issue