Cortex XSOAR Content Release Notes for version 20.9.1 (114694)

Published on 15 September 2020

New: Azure Log Analytics Pack v1.0.0

Integrations

Azure Log Analytics (Beta)

Log Analytics is a service that helps you collect and analyze data generated by resources in your cloud and on-premises environments.

Playbooks

Azure Log Analytics - Query From Saved Search

Executes a query from a saved search in Azure Log Analytics.

New: Microsoft Cloud App Security Pack v1.0.0

Classifiers

Microsoft CAS Classifier

Classifies Microsoft CAS Alerts.

Microsoft CAS

Maps incoming Microsoft CAS fields.

Integrations

Microsoft Cloud App Security

Microsoft Cloud App Security is a multimode Cloud Access Security Broker (CASB). It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats across all your cloud services. Use the integration to view and resolve alerts, view activities, view files, and view user accounts.

New: Palo Alto Networks IoT Pack v1.0.0

IncidentFields

  • IoT Incident URL
  • ServiceNow Record ID
  • ServiceNow Table Name

IncidentTypes

  • IoT Alert
  • IoT Vulnerability

Integrations

Palo Alto Networks IoT

The Palo Alto Networks IoT security (previously Zingbox) integration is used for exporting the alerts and vulnerabilities found in the IoT security portal to XSOAR for incident response and enrichment.

Playbooks

PANW IoT ServiceNow Tickets Check

A playbook used in a recurring job to check the ServiceNow ticket status for the Palo Alto Networks IoT (previously Zingbox) alerts or vulnerabilities.

PANW IoT Incident Handling with ServiceNow

Creates a ServiceNow ticket after an incident is enriched by the Palo Alto Networks IoT security portal (previously Zingbox Cloud).

Scripts

iot-security-alert-post-processing

A post-processing script that resolves an alert in the IoT security portal using the API.

iot-security-check-servicenow

Closes an XSOAR incident when the corresponding IoT ServiceNow ticket is closed. You should run this script in a job.

iot-security-get-raci

The RACI model of the IoT incident used to evaluate the Responsible (R) and Informed (I) parties in the RACI model.

iot-security-vuln-post-processing

A post-processing script that resolves a vulnerability incident in the IoT security portal using the API.

New: Security Intelligence Services Feed Pack v1.0.0 (Partner Supported)

IndicatorFields

SISCategory

Category of the indicator.

SISExpiration

Expiration time of the indicator.

SISMalwareType

Type of malware received from the feed.

SISMatchType

Match type of the indicator.

Integrations

Security Intelligence Services Feed

A PassiveTotal with Security Intelligence Services Feed that provides you with newly observed domains, malware, phishing, content, and scam blacklists. Supports hourly ingestion.

New: ServerLogs Pack v1.0.0

Dashboards

Server Logs

Dashboard to tail the latest server and Docker logs.

Scripts

ServerLogs

Uses the SSH integration to grab the host server logs.

ServerLogs_docker

Uses the SSH integration to grab the Docker host server logs.

New: ThreatConnect Feed Pack v1.0.0

Integrations

ThreatConnect Feed

Fetches indicators from ThreatConnect.

AWS - Security Hub Pack v1.0.2

Integrations

AWS - Security Hub

Maintenance and stability enhancements.

AlienVault OTX Pack v1.0.2

Integrations

AlienVault OTX v2
  • Updated the Docker image.
  • Fixed the file command so that it does not fail for hashes for which there is no analysis.

Amazon DynamoDB Pack v1.0.1

Integrations

Amazon DynamoDB

General documentation improvements.

ApiModules Pack v1.0.6

Scripts

MicrosoftApiModule
  • Added support for authorization to multiple resources.
  • Updated Docker image to the latest version.

ArcSight ESM Pack v1.0.6

Integrations

ArcSight ESM v2

Increased the maximum per fetch limit to 300. The recommended limit is 50.

Base Pack v1.3.0

Scripts

CommonServerPython
  • Maintenance and stability enhancements.
  • Added the return_results function and the CommandResults class to the Script Helper documentation.
  • Enhanced the dict_safe_get function, which now supports a nested list/dictionary and returns the type validation.
  • Added the build_number argument to the is_demisto_version_ge function and adjusted the is_versioned_context_available function accordingly.
  • Added the timeline object to the CommandResult class.
SaneDocReports
  • Fixed a trend percentage calculation issue.
  • Maintenance and stability enhancements.
New: GetIndicatorsByQuery

Returns indicators that match the defined query and exports them to a file.

DBotMLFetchData
  • Added the Created field to the collected features.
  • Maintenance and stability enhancements.
DBotPredictPhishingWords
  • Maintenance and stability enhancements.
  • Changed the name of the labelProbabilityThreshold argument to confidenceThreshold.
  • Changed the default value of the run once parameter to true.
CommonServerPowerShell

Added the TableToMarkdown method.

DBotTrainTextClassifierV2

Fixed a typo in an error message.

DBotSuggestClassifierMapping

Maintenance and stability enhancements.

SanePdfReports

Maintenance and stability enhancements.

Blueliv ThreatCompass Pack v1.0.1

Integrations

Blueliv ThreatCompass

Documentation and metadata improvements.

CVE Search Pack v1.0.2

Scripts

cveSearch

Maintenance and stability enhancements.

cveLatest

Maintenance and stability enhancements.

Cisco Threat Grid Pack v1.1.0

Playbooks

Detonate File - ThreatGrid

Samples are now submitted as private by default.

Common Playbooks Pack v1.8.0

Playbooks

Detonate File - Generic

Fixed a bug where a change in the Detonate File - ThreatGrid inputs did not populate into the Detonate File - Generic playbook. Detonate File - ThreatGrid now submits private samples by default.

Common Scripts Pack v1.2.41

Scripts

ParseEmailFiles
  • Fixed an issue where S/MIME .eml files were not parsed properly.
  • Fixed a bug in which a double period (..) in a new line was not processed correctly due to the SMTP standard.
RunPollingCommand

Improved error handling.

SetAndHandleEmpty

The stringify and append parameters now work as expected.

LookupCSV

Added support for values that contain commas in CSV files.

JSONtoCSV

Maintenance and stability enhancements.

DeleteContext

Updated the script to execute using the DBot role.

Cortex Data Lake Pack v1.2.2

Integrations

Cortex Data Lake
  • Fixed an error with parsing of authentication responses.
  • Updated the Docker image from 1.0.0.10370 to 1.0.0.10828.

CrowdStrike Falcon Pack v1.2.0

Integrations

CrowdStrike Falcon

Updated the fetch_incidents function to be more comprehensive and handle a high volume of incidents.

CrowdStrike FalconX Pack v1.0.2

Integrations

CrowdStrike Falcon X
  • Maintenance and stability enhancements.
  • Updated the Docker image.

Cybereason Pack v1.0.2

Integrations

Cybereason
  • Enhanced access to the dictionary/list. Accesses the dictionary and list in a safe manner in order to produce an informative error log entry, if it exists.
  • Fixed filters in the cybereason-query-malops command.
  • Fixed the cybereason-query-malops and fetch-incidents commands to retrieve all Malop types.

DUO Admin Pack v2.0.2

Integrations

DUO Admin

Maintenance and stability enhancements.

Demisto REST API Pack v1.1.1

Scripts

DemistoUploadFile

Maintenance and stability enhancements.

Developer Tools Pack v1.0.1

Scripts

VerifyContextFields

Maintenance and stability enhancements.

VerifyContext

Maintenance and stability enhancements.

StringContains

Maintenance and stability enhancements.

WhileLoop

Maintenance and stability enhancements.

DomainTools Iris Pack v1.0.3 (Partner Supported)

Integrations

DomainTools Iris

Updated the Content Pack support information.

EWS Pack v1.3.0

Integrations

EWS v2

Maintenance and stability enhancements.

EWS O365
  • Added the send-mail command.
  • Maintenance and stability enhancements.

Elasticsearch Pack v1.1.1

Integrations

Elasticsearch v2
  • Added support for schema mapping per index.
  • Updated the integration Docker image to the latest version.

Elasticsearch Feed Pack v1.0.6

Integrations

Elasticsearch Feed
  • Changed the default Feed Type from Cortex XSOAR Feed to Cortex XSOAR MT Shared Feed.
  • Updated the Docker image.

Email Communication Pack v1.2.2

Layouts

A new layout for the Email Communication pack, which assists with communicating and responding to emails in the Cortex XSOAR system.

Endace Pack v1.1.1 (Partner Supported)

Playbooks

Endace Search Archive and Download

Maintenance and stability enhancements.

Endace Search Archive Download PCAP

Maintenance and stability enhancements.

Google Vault Pack v1.0.2

Integrations

Google Vault

Fixed a bug that caused excessive memory usage.

IBM QRadar Pack v1.0.9

Playbooks

QRadar - Get offense correlations

Maintenance and stability enhancements.

Scripts

QRadarFullSearch

Maintenance and stability enhancements.

QRadarGetOffenseCorrelations

Maintenance and stability enhancements.

QRadarClassifier

Maintenance and stability enhancements.

QRadarGetCorrelationLogs

Maintenance and stability enhancements.

IBM X-Force Exchange Pack v1.0.1

Integrations

IBM X-Force Exchange v2
  • Fixed an issue where the url and domain commands failed for URLs that don't exist in the server.
  • Updated the Docker image.

Infinipoint Pack v1.0.2 (Partner Supported)

Integrations

Infinipoint
  • Updated the infinipoint-run-queries command name to infinipoint-execute-action.
  • Documentation and metadata improvements.
  • Updated the integration Docker image to the latest version.

IronDefense Pack v1.1.2 (Partner Supported)

Integrations

IronDefense

Updated the Content Pack support information.

MISP Pack v1.0.3

Scripts

misp_download_sample

Maintenance and stability enhancements.

misp_upload_sample

Maintenance and stability enhancements.

Machine Learning Pack v1.2.0

Scripts

HashIncidentsFields
  • Added support for wildcards in the fieldsToHash field.
  • Added the un-populate and removeLabels arguments.
DBotPredictOutOfTheBox

Changed the name of the labelProbabilityThreshold argument to confidenceThreshold.

MailListener - POP3 (Beta) Pack v1.0.1

Integrations

MailListener - POP3 Beta

Fixed an issue where fetch-incidents failed for emails that contain special characters.

Microsoft Graph Security Pack v2.0.1

Integrations

Microsoft Graph Security

Fixed an issue in which some alerts were not being fetched.

Mimecast Pack v1.1.2

Integrations

Mimecast v2

Fixed an issue where the mimecast-get-group-members command failed if only one group existed in the context.

MongoDB Pack v1.1.0

Integrations

MongoDB
  • Fixed an issue where it was not possible to apply filters in the _id field.
  • Added the sort argument to the mongodb-query command.

OTRS Service Management XSOAR Pack Pack v1.0.1

Integrations

OTRS

Fixed an issue where running the otrs-create-ticket and otrs-update-ticket commands with the attachment parameter failed.

PAN-OS Pack v1.6.0

Integrations

Palo Alto Networks PAN-OS

  • Added 19 commands.

    • panorama-get-licences
    • panorama-get-security-profiles
    • panorama-apply-security-profile
    • panorama-get-ssl-decryption-rules
    • panorama-get-wildfire-configuration
    • panorama-get-wildfire-best-practice
    • panorama-enforce-wildfire-best-practice
    • panorama-url-filtering-block-default-categories
    • panorama-get-anti-spyware-best-practice
    • panorama-get-file-blocking-best-practice
    • panorama-get-antivirus-best-practice
    • panorama-get-vulnerability-protection-best-practice
    • panorama-get-url-filtering-best-practice
    • panorama-create-anti-spyware-best-practice-profile
    • panorama-create-antivirus-best-practice-profile
    • panorama-create-vulnerability-best-practice-profiles
    • panorama-create-url-filtering-best-practice-profile
    • panorama-create-file-blocking-best-practice-profile
    • panorama-create-wildfire-best-practice-profile

  • Updated the Docker image to the latest tag.

PANW Comprehensive Investigation Pack v1.3.2

Playbooks

Palo Alto Networks - Endpoint Malware Investigation v3

Added a new playbook, which includes bug fixes for an earlier version and a new hunting sub-playbook.

PCAP Analysis Pack v2.3.3

Playbooks

PCAP Parsing And Indicator Enrichment

Fixed a typo in some fields taken from the context.

Scripts

PcapMinerV2

Fixed a bug in the SMTP extraction process.

Palo Alto Networks Cortex XDR - Investigation and Response Pack v2.3.9

Integrations

Palo Alto Networks Cortex XDR - Investigation and Response
  • Maintenance and stability enhancements.
  • Added the HTTP Timeout parameter, which sets the timeout for HTTP requests to the Cortex XDR API.
  • Added the Maximum number of incidents per fetch integration parameter.

Playbooks

Cortex XDR - Malware Investigation

Added a check to see if the malicious file already exists before retrieving it.

Scripts

XDRSyncScript

Added the playbook_to_run argument.

Palo Alto Networks WildFire Pack v1.2.0

Playbooks

WildFire - Detonate file

Added support for the PE file type.

PassiveTotal Pack v2.0.0 (Partner Supported)

Integrations

PassiveTotal v2

New PassiveTotal integration with enhancement scripts.

PassiveTotal

Scripts

PTEnrich (Deprecated)

Fixed an issue with the integration display and description.

RiskIQPassiveTotalComponentsScript

An enhancement script to enrich PassiveTotal components for Domain and IP indicator values.

RiskIQPassiveTotalHostPairChildrenScript

An enhancement script to enrich PassiveTotal Host Pair of children for Domain and IP indicator values.

RiskIQPassiveTotalHostPairParentsScript

An enhancement script to enrich PassiveTotal Host Pair of parents for Domain and IP indicator values.

RiskIQPassiveTotalPDNSScript

An enhancement script to enrich PDNS information for Domain and IP indicator values.

RiskIQPassiveTotalSSLScript

An enhancement script to enrich SSL information for email, RiskIQSHA1, and RiskIQSerialNumber indicator values.

RiskIQPassiveTotalTrackersScript

An enhancement script to enrich web trackers information for Domain and IP indicator values.

RiskIQPassiveTotalWhoisScript

An enhancement script to enrich Whois information for Domain and email indicator values.

Phishing Pack v1.10.3

Scripts

New: PhishingDedupPreprocessingRule

An out-of-the-box, deduplication pre-processing script based on a machine learning algorithm.

Prisma Cloud Pack v1.2.4

Integrations

Prisma Cloud (RedLock)

Added the Redlock.Alert.AlertRules output to the redlock-get-alert-details command, which lists the names of the alert rules that triggered the alert.

QueryAI Pack v1.0.2 (Partner Supported)

Integrations

Query.AI

Updated the Request Timeout field.

QueryAI_description.md

Documentation and metadata improvements.

Red Canary Pack v1.0.4

Integrations

Red Canary

Fixed an issue where the redcanary-get-detection command would cause a timeout.

SafeBreach - Breach and Attack Simulation platform Pack v1.0.7 (Partner Supported)

Integrations

SafeBreach v2
  • Maintenance and stability enhancements.
  • Fixed an issue where test-module failed with an SSL issue even when Trust any certificate is enabled.
  • Updated the Docker image.

ServiceNow Pack v1.3.0

Classifiers

ServiceNow - Incoming Mapper
  • Fixed an issue where the date format was incorrect.
  • Updated the classifier with the new integration parameters.
ServiceNow v2

Added the following integration parameters.

  • Incident Mirroring Direction
  • File Entry Tag
  • Work Note Entry Tag
  • Comment Entry Tag

Integrations

ServiceNow v2
  • Maintenance and stability enhancements.
  • Fixed a minor bug in the servicenow-create-ticket command.

Layouts

Fixed a typo in the tab name.

Sixgill Darkfeed - Core Edition Pack v1.1.4 (Partner Supported)

Integrations

Sixgill DarkFeed Threat Intelligence
  • Added support for additional sub-feeds with a larger variety of IOCs from the underground.
  • Updated the connector.

Script

SearchIndicators

Maintenance and stability enhancements.

SplunkPy Pack v1.2.1

Integrations

SplunkPy

Added a validation for HEC URL and HEC tokens in the test function.

Scripts

SplunkPySearch

Maintenance and stability enhancements.

Tanium Pack v1.0.3

Integrations

Tanium v2

Updated the tn-ask-question command to automatically parse parameters from question text.

ThreatConnect Pack v2.0.8

Integrations

ThreatConnect v2
  • Added support for fetching indicators from multiple owners.
  • The DBotScore calculation now works as expected.

ThreatQ Pack v1.0.5 (Partner Supported)

Integrations

ThreatQ v2
  • Added Content-Type to request headers.
  • Updated the Docker image.

TruSTAR Pack v2.1.0 (Partner Supported)

Integrations

TruSTAR v2
  • Added support for multiple new filtering arguments to the trustar-search-indicators and the trustar-search-reports commands.
  • Added the redact argument to the trustar-submit-report command, which gives users the option to redact a report before submission.
  • Fixed an issue where the trustar-get-phishing-submissions and the trustar-get-phishing-indicators commands did not work due to changes in the TruSTAR API.
  • Added support for the limit argument in the trustar-get-phishing-submissions and the trustar-get-phishing-indicators commands.

Whois Pack v1.1.5

Integrations

Whois

Maintenance and stability enhancements.

Yara Pack v1.0.1

Scripts

YaraScan

Maintenance and stability enhancements.

Zscaler Pack v1.0.4

Integrations

Zscaler

Fixed an issue where URLs were sent to the Zscaler server with the protocol prefix.

illuminate Pack v1.0.2 (Partner Supported)

Integrations

illuminate

Updated the Content Pack support information.

urlscan.io Pack v1.0.2

Integrations

urlscan.io
  • Fixed an issue with the submission visibility in the following commands.
    • qurlscan-submit.
    • urlscan-submit-url-command.
  • Improved the error message when the rate limit has been breached.
  • Added a warning when the rate limit is 10 or less.

Assets

Edit this page
Report an Issue