Cortex XSOAR for Developers (Formerly Demisto)

Cortex XSOAR Content Release Notes for version 20.6.1 (59306)

Published on 23 June 2020

Welcome to the 20.6.1 Content release for Cortex XSOAR. Starting from the 20.6.0 release, we restructured our release notes to be based upon Content Packs. One of our team's top priorities is making our Content more accessible and understandable for both users and contributors. In this effort, we recently moved our Content repo to work in Packs format were there is a clear separation and grouping of Content artifacts. Each Content Pack provides a clear grouping of related Content artifacts used to either implement a use case, implement an integration or provide a clear set of functionality. Our new release notes are structured around Content Packs and you will see related Content artifacts grouped together according to Packs. We hope you will find this new format useful and clear.

End Of Life Notice

The following Integrations were deprecated on Nov 2019:

  • Azure Compute
  • Azure Security Center

These integrations will reach the end of life on July 31, 2020, due to changes to the backend authentication services needed for these Integrations. Use the Azure Compute v2 and Azure Security Center v2 integrations instead.

New: HIPAA - Breach Notification Pack v1.0.0

IncidentFields

  • HIPAA Notification

IncidentTypes

  • HIPAA Breach Notification

Layouts

  • HIPAA Breach Notification - Summary
  • HIPAA Breach Notification - New/Edit

Playbooks

HIPAA - Breach Notification

USA Health Insurance Portability and Accountability Act of 1996 (HIPAA) covers organizations that use, store, or process Private Health Information (PHI). The HIPAA Breach Notification Rule requires companies that deal with health information to disclose cybersecurity breaches; the disclosure will include notification to individuals, to the media, and the Secretary of Health and Human Services. This playbook is triggered by a HIPAA breach notification incident and follows through with the notification procedures.

DISCLAIMER: Please consult with your legal team before implementing this playbook.

** Source: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

New: Infocyte Pack v1.0.0

Integrations

Infocyte

Infocyte can pivot off incidents to automate triage, validate events with forensic data and enabling dynamic response actions against any or all host using both agentless or agented endpoint access.

New: PCAP Analysis Pack v1.0.0

Scripts

PcapMinerV2

PcapMIner V2 enables you to parse PCAP files by displaying all of the relevant data, including IP addresses, ports, flows, specific protocol breakdown, searching by regex, decrypting encrypted traffic, and more. This automation takes about a minute to process 20,000 packets (which is approximately 10MB). If you want to mine large files you can either: a) Use the pcap_filter parameter to filter your PCAP file and thereby make it smaller. b) Copy the automation and change the default timeout parameter, as necessary.

New: Polygon Pack v1.0.0

Integrations

Group-IB TDS Polygon

TDS Polygon is a Malware Detonation & Research platform designed for deep dynamic analysis and enhanced indicators extraction. TDS Polygon analyzes submitted files and urls and extracts deep IOCs that appear when malicious code is triggered and executed. Polygon could be used either for application-level tasks (like smtp-based mail filtering) and analytical purposes (files/urls analysis for verdict, report and indicators).

Playbooks

Detonate File - Group-IB TDS Polygon

Detonates files using the Group-IB TDS Polygon integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

Detonate URL - Group-IB TDS Polygon

Detonates URLs using the Group-IB TDS Polygon integration.

AWS - EC2 Pack v1.1.1

Scripts

AwsEC2GetPublicSGRules

Added support for security groups with only one ingress rule.

Playbooks

IP Whitelist - AWS Security Group

Syncs a list of IP addresses with an AWS Security Group. Moved from IPWhitelisting pack.

Base Pack v1.0.10

Scripts

CommonServerPython
  • Added support for the CVE indicator class.
  • Added safeget from the Python dict function.
  • Fixed an issue where the argToList function did not behave as expected. This fix breaks backward compatibility.
  • Fixed incorrect time zone parsing for timestamp_to_datestring.
CommonServerPowerShell

Updated the ReturnOutputs function to support object types.

BigFix Pack v1.0.1

Integrations

BigFix

Added the get_endpoints_details argument to the bigfix-get-endpoints command to see if details of endpoints should be retrieved or not.

CSV Feed Pack v1.0.1

Integrations

CSVFeed

Updated the Docker image to support the auto-detection function.

Carbon Black Enterprise Response Pack v1.0.3

Integrations

Carbon Black Enterprise Response v2

Fixed an issue where the file context did not behave as expected in the cb-get-processes command.

Playbook

Search Endpoints By Hash - Carbon Black Response V2

Searches for endpoints by hash.

Check Point Firewall Pack v1.0.2

Integrations

Check Point

Deprecated the ipname argument from the checkpoint-block-ip command.

Chronicle Pack v1.1.0

Integrations

Google Chronicle Backstory
  • Added the gcb-list-events command.
  • Added deep link to all commands.

Cisco Threat Grid Pack v1.0.2

Integrations

Threat Grid

Fixed a bug in threat-grid-get-analysis-by-id command, which failed on a syntax error.

Common Playbooks Pack v1.5.0

Playbooks

New: Entity Enrichment - Generic v3

Enrich entities using one or more integrations.

Send Investigation Summary Reports

Updated the SearchIncidents command to SearchIncidentsV2.

Get Original Email - Generic

Added an output of email headers.

Common Scripts Pack v1.1.9

Scripts

SetGridField

Fixed an issue in which non-alphabetically sorted values given to the columns were not processed as expected.

VerifyJSON

Updated the Docker image to PowerShell 7.

TimeStampCompare

Removed an empty tag from the TimeStampCompare script.

DateStringToISOFormat

Added a new transformer script for converting arbitrary date strings to ISO-8601 format.

Common Types Pack v1.2.1

IndicatorTypes

domainRepUnified

Updated the Domain indicator type's default mapping to use the new transformer DateStringToISOFormat (where relevant).

Compliance Pack v1.0.1

IncidentFields

New: Secretary Notification
New: Management Notification
New: DPO Notification
New: Media Notification
New: Individuals Notification

Cortex Data Lake Pack v1.0.3

Integrations

Cortex Data Lake

Adjusted the integration to work with a setup of non-root user in a Docker container.

Cortex XDR - IOC Pack v1.0.1

Integrations

Cortex XDR - IOC

Fixed an issue where trying to push a non-existing indicator in xdr-iocs-push raised an error that failed the command.

Deprecated Content Pack v1.2.0

Playbooks

Malware Playbook - Manual

Deprecated. Use "Malware Investigation - Manual" playbook instead.

EWS Pack v1.1.2

Integrations

New: EWSO365

The new EWS O365 integration uses OAuth 2.0 protocol and can be used with Exchange Online and Office 365 (mail).

EWS v2
  • Fixed a bug in the test module which failed on a delegated mailbox.
  • Improved handling of errors raised in the incident fetch flow.

Elasticsearch Feed Pack v1.0.2

Integrations

ElasticsearchFeed

Fixed an issue where the Feed Type was not processed as expected while fetching indicators.

FalconHost Pack v1.1.1

Integrations

FalconHost

Added support for 3 commands from the Threat graph API:

  • cs-threatgraph-summary
  • cs-threatgraph-processes
  • cs-threatgraph-detections

Playbooks

Added rapid ioc hunting v2 playbook and replaced deprecated scripts.

FireEye ETP Pack v1.0.1

Integrations

FireEye ETP

Improved empty response handling.

FortiSIEM Pack v1.0.1

Integrations

FortiSIEM
  • Fixed an issue where the authentication did not work properly.
  • Fixed an issue where the fortisiem-get-events-by-incident command did not return results.

Google Cloud Compute Pack v1.0.1

Playbooks

IP Whitelist - GCP Firewall

Playbook to sync a list of IPs with a GCP Firewall. Moved from IPWhitelisting pack.

HelloWorld Pack v1.1.6

Integrations

HelloWorld
  • Improved the fetch-incidents command to prevent duplicate incidents.
  • Minor updates to documentation.

IBM QRadar Pack v1.0.3

Integrations

QRadar

Improved handling of unexpected responses.

Intezer Pack v1.0.1

Integrations

Intezer v2

Updated the integration to the latest Docker image.

JSON Feed Pack v1.0.1

Integrations

JSON Feed

Updated the description of the indicator type field.

Joe Security Pack v1.0.2

Integrations

Joe Security

Fixed a bug in the joe-analysis-info command where a DBotScore.Indicator wasn't returned when a URL was passed.

Malware Pack v1.1.0

Playbooks

New: Malware Investigation - Manual

Master manual playbook for investigating suspected malware presence on an endpoint.

IncidentTypes

Malware

Associated the new playbook Malware Investigation - Manual to the malware incident type.

McAfee DXL Pack v1.0.0

Playbook

Enrich DXL with ATD verdict v2 Playbook

Replaced deprecated scripts.

Enrich McAfee DXL using 3rd party sandbox v2 Playbook

Replaced deprecated scripts.

McAfee ePO Pack v1.0.1

Playbook

McAfee ePO Endpoint Compliance Playbook v2

Replaced deprecated scripts.

McAfee ePO Repository Compliance Playbook

Replaced deprecated scripts.

McAfee ePO Endpoint Connectivity Diagnostics Playbook

Replaced deprecated scripts.

Microsoft Defender Advanced Threat Protection Pack v1.1.2

Integrations

Microsoft Defender Advanced Threat Protection

Updated the permission scope for self-deployed applications to be Microsoft Defender Advanced Threat Protection default.

Microsoft Teams Pack v1.0.2

Integrations

Microsoft Teams

Fixed an issue where notifications to be sent to the dedicated channel were not handled appropriately.

Mimecast Pack v1.0.2

Integrations

MimecastV2

Added a pagination mechanism for URL log requests.

MongoDB Pack v1.0.4

Integrations

MongoDB

Fixed an issue where nested dictionaries containing a datetime object were not parsed properly.

PAN-OS Pack v1.0.5

Playbooks

PAN-OS - Create Or Edit Rule

Removed transformers that were no longer needed.

PAN-OS DAG Configuration

Removed transformers that were no longer needed.

Integrations

Panorama

Added logs for uncommitted items.

Palo Alto Networks BPA Pack v1.1.0

Integrations

BPA

Added the option to exclude passed checks in the pan-os-bpa-get-job-results command.

Palo Alto Networks Cortex XDR - Investigation and Response Pack v2.0.0

Integrations

Cortex XDR - IR
  • Fixed a bug in the xdr-get-endpoint command where only the last endpoint was displayed in context.
  • Added 6 commands.
    • xdr-blacklist-files
    • xdr-whitelist-files
    • xdr-quarantine-files
    • xdr-get-quarantine-status
    • xdr-restore-file
    • xdr-endpoint-scan

Playbooks

New: Cortex XDR - Malware Investigation

Investigates a Cortex XDR incident containing internal malware alerts. The playbook:

  • Enriches the infected endpoint details.
  • Lets the analyst manually retrieve the malicious file.
  • Performs file detonation. The playbook is used as a sub- playbook in 'Cortex XDR Incident Handling - v2'
New: Cortex XDR - Port Scan - Adjusted

Investigates a Cortex XDR incident containing internal port scan alerts. The playbook:

  • Syncs data with Cortex XDR.
  • Notifies management about a compromised host.
  • Escalates the incident in case of lateral movement alert detection. The playbook is used as a sub- playbook in 'Cortex XDR Incident Handling - v2'
New: Cortex XDR Alerts Handling

This playbook is used to loop over every alert in a Cortex XDR incident. Supported alert categories: - Malware - Port Scan

New: Cortex XDR Incident Handling v2

This playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident. The playbook syncs and updates new XDR alerts that construct the incident and triggers a sub-playbook to handle each alert by type. Then, the playbook performs enrichment on the incident's indicators and hunting for related IOCs. Based on the severity, it lets the analyst decide whether to continue to the remediation stage or close the investigation as a false positive. After the remediation, if there are no new alerts, the playbook stops the alert sync and closes the XDR incident and investigation.

PaloAltoNetworks_XDR

Added a test for the quarantine file playbook.

Cortex XDR - quarantine file

Added a playbook that gets the status of a quarantined file.

Phishing Pack v1.6.0

Playbooks

Get Original Email - EWS

Added the email headersmap output. This enables phishing incidents to display email headers if the original email was retrieved.

Phishing - Core
  • Fixed an issue where URL screenshots did not display in the layout.
  • Merged 2 conditions into 1 to clean up playbook.
  • Added checks to verify that the Rasterize integration is enabled before attempting to rasterize HTML-formatted emails, and before taking URL screenshots.
Process Email - Core
  • Added checks to verify that the Rasterize integration is enabled before attempting to rasterize HTML-formatted emails, and before taking URL screenshots.
  • Email headers will now show in phishing incident layouts.
Process Email - Generic
  • Added a check that verifies whether the Rasterize integration is enabled before attempting to rasterize HTML-formatted emails.
  • Added a check that verifies whether the Rasterize integration is enabled before attempting to rasterize HTML-formatted emails.
  • Simplified the flow of the playbook by merging tasks where possible and renaming tasks to better reflect their purpose.
  • Email headers will now show in phishing incident layouts.
Get Original Email - EWS

Added an output of email headers.

Layout

Phishing

The phishing layout now displays the email headers if the email was attached as file or was retrieved using mail listener integrations.

Plain Text Feed Pack v1.0.1

Integrations

Plain Text Feed

Updated the Docker image to support the auto-detection function.

Prisma Access Pack v1.0.1

Playbooks

Prisma Access Whitelist Egress IPs on SaaS Services
  • Added a call for the Okta Zones subplaybook.
  • Moved the names of the AWS security group, GCP firewall, and Okta Zone into playbook inputs. If the input is not set, the related subplaybook will be skipped.

Prisma Cloud Pack v1.2.0

Integrations

RedLock
  • Added a default classifier and mapper.
  • Added support for multi-environment instances.
  • Added the get-remediation-details command.

Proofpoint Protection Server Pack v1.0.2

Integrations

Proofpoint Server Protection
  • Improved parsing of responses returned from Proofpoint.
  • Added support for Proofpoint Protection Server version 8.14.2.

RTIR Pack v1.0.3

Integrations

RTIR
  • Fixed an issue where headers with 'ID' in their name got malformed when running rtir-search-ticket command and in fetch-incidents.
  • Improved parsing of ticket attachments.

Recorded Future Feed Pack v1.0.1

Integrations

Recorded Future Feed

Improved parsing of IOC objects.

Red Canary Pack v1.0.2

Integrations

RedCanary
  • Removed timeline details for a detection fetched as an incident.
  • Fixed an issue in which acknowledged detections were fetched as incidents.
  • Improved processing of outputs for endpoint details.

Securonix Pack v1.1.1

Integrations

Securonix
  • Added the max parameter to the securonix-list-incidents command.
  • Added the max_fetch parameter to the integration configuration. The default and maximum value is 50.
  • Fixed an issue where duplicate incidents were fetched.

SentinelOne Pack v1.0.1

Integrations

SentinelOne V2

Improved processing of datetime strings.

ServiceNow Pack v1.1.4

Integrations

ServiceNow v2

Improved handling of authentication errors returned from ServiceNow.

Slack Pack v1.2.1

Integrations

SlackV2

Added stability improvements for long-running execution.

VirusTotal Pack v1.0.1

Integrations

VirusTotal

Fixed an issue where the url command lacked the default url argument.

Zscaler Pack v1.0.1

Integrations

Zscaler

Added the multiple argument to the url command, which when set to "false" enables users to submit singular URLs that contain commas.

ipinfo Pack v1.0.1

Integrations

ipinfo

Added support for HTTPS connection.

okta Pack v1.0.2

Integrations

Okta v2

Added 3 commands.

  • okta-get-zone
  • okta-update-zone
  • okta-list-zones

Playbooks

Allow IP - Okta Zone

Syncs a list of IP addresses with an Okta Zone.

Assets

Edit this page
Report an Issue