Cortex XSOAR Content Release Notes for version 20.7.0 (61242)#

Published on 07 July 2020#

Welcome to the 20.7.0 Content release for Cortex XSOAR. Starting from the 20.6.0 release, we restructured our release notes to be based upon Content Packs. One of our team's top priorities is making our Content more accessible and understandable for both users and contributors. In this effort, we recently moved our Content repo to work in Packs format were there is a clear separation and grouping of Content artifacts. Each Content Pack provides a clear grouping of related Content artifacts used to either implement a use case, implement an integration or provide a clear set of functionality. Our new release notes are structured around Content Packs and you will see related Content artifacts grouped together according to Packs. We hope you will find this new format useful and clear.

End Of Life Notice#

The following Integrations were deprecated in November 2019:

  • Azure Compute
  • Azure Security Center

These integrations will reach end of life on July 31, 2020, due to changes to the backend authentication services needed for these integrations. Use the Azure Compute v2 and Azure Security Center v2 integrations instead.

New: CrowdStrike Falcon X Pack v1.0.0#

Integrations#

CrowdStrike Falcon X#

Use the CrowdStrike Falcon X integration to submit files, file hashes, URLs, and FTPs for sandbox analysis and to retrieve reports.

Playbooks#

Detonate File - CrowdStrike Falcon X#

Detonates a file using CrowdStrike Falcon X sandbox.

Detonate URL - CrowdStrike Falcon X#

Detonates one or more files using the CrowdStrike Falcon Sandbox integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

New: DeHashed Pack v1.0.0#

Integrations#

DeHashed#

This integration allows you to check if your personal information, such as your email, username, or password, has been compromised.

New: Google Kubernetes Engine Pack v1.0.0#

Integrations#

Google Kubernetes Engine#

The Google Kubernetes Engine integration is used for building and managing container-based applications in Google Cloud Platform (GCP), powered by the open source Kubernetes technology.

Playbooks#

Google Kubernetes Engine Operations Generic Polling#

This playbook checks the operation status of the Google Kubernetes Engine. It runs until the operation completes, and facilitates the waiting between steps in Cluster configuration.

New: Manage Engine Service Desk Plus Pack v1.0.0#

Integrations#

Service Desk Plus#

Use this integration to manage Service Desk Plus requests. The integration allows you to create, update, and delete requests, assign groups and technicians to requests, and link/unlink requests and modify their resolution.

New: Microsoft Azure AD Connect Health Feed Pack v1.0.0#

Integrations#

Azure AD Connect Health Feed#

Use the Microsoft Azure AD Connect Health Feed integration to get indicators from the feed.

New: Quest Kace Pack v1.0.0#

Integrations#

Quest KACE Systems Management Appliance (Beta)#

Use the Quest KACE integration to provision, manage, secure, and service all network-connected devices.

New: Unit42 Feed Pack v1.0.0#

Integrations#

Unit42 Feed#

Unit42 feed of published IOCs, which contains known malicious indicators.

New: Workday Pack v1.0.0#

Integrations#

Workday#

Use the Workday integration to manage workers and employees.

New: Zoom Feed Pack v1.1.0#

Integrations#

Zoom Feed#

You can now use the new Zoom site configuration using the feed.

New: TAXII 2 Feed Pack v.1.0.0#

Integrations#

TAXII Feed#

Ingests indicator feeds from TAXII 2.0 and 2.1 servers.

ApiModules Pack v1.0.3#

Scripts#

CSVFeedApiModule#

Added the Tags parameter.

ArcSight ESM Pack v1.0.3#

Integrations#

ArcSight ESM v2#
  • Fixed a bug in which some fetches returned duplicate alerts.
  • Added the Use REST Endpoints integration parameter, which enables using REST endpoints for the as-get-entries and as-clear-entries commands.

Attivo Botsink Pack v1.0.1#

Integrations#

Attivo Botsink#

Fixed an issue where errors were not handled as expected.

Bambenek Consulting Feed Pack v1.0.1#

Integrations#

Bambenek Consulting Feed#

Added the Tags parameter.

Base Pack v1.1.0#

Scripts#

SaneDocReports#
  • Fixed SVG image rendering in doc reports.
  • Added the ability to add customer logos to doc reports.
  • Reverted changes made in v1.0.12.
SanePdfReports#
  • Fixed word overlapping in graphs.
  • Rolled back the Docker image to fix a conflict issue.
  • Updated the sane-pdf-reports Docker tag, which fixes the graph labels overlap bug.
CommonServerPython#
  • Fixed an issue where the to_context function did not return the proper outputs when the CommandResult object was supplied with only readable_outputs.
  • Fixed and issue where the to_context function returned null instead of an empty list when supplied with empty outputs.
  • Added wrapper functions for getting and setting integration context.

CSV Feed Pack v1.0.2#

Integrations#

CSVFeed#

Added the Tags parameter.

Carbon Black Enterprise Protection Pack v1.0.2#

Playbooks#

Carbon black Protection Rapid IOC Hunting#

Updated the playbook to use the Carbon Black Enterprise Protection v2 integration .

Check Point Firewall Pack v1.0.3#

Integrations#

Check Point#

Fixed an issue where the checkpoint command did not work as expected.

Common Playbooks Pack v1.5.1#

Playbooks#

Block IP - Generic v2#

Added the FortiGate Ban IP command to the Block IP - Generic v2 playbook.

Common Scripts Pack v1.2.3#

Scripts#

ParseEmailFiles#
  • Fixed an issue where errors were not handled as expected.
  • Fixed an issue where EMLfiles with the content type "message/rfc822" were not recognized as expected.
SetGridField#

Fixed an issue where the script failed on mixed-types error.

JSONtoCSV#

Improved the error message when an invalid JSON entry is given.

Common Types Pack v1.4.0#

Layouts#

domainRepUnified#

Added the Feed Related Indicators section to the layout.

unifiedFileRep#

Added the Feed Related Indicators section to the layout.

ipRep#

Added the Feed Related Indicators section to the layout.

urlRep#

Added the Feed Related Indicators section to the layout.

FalconHost Pack v1.1.2#

Integrations#

FalconHost#
  • Added support for IPv4 and IPv6 indicator types to the cs-device-ran-on command.
    • Deprecated the following commands:
      • cs-resolve-detection: Use the cs-falcon-resolve-detection command from the CrowdStrike Falcon integration instead.
      • cs-detection-details: Use the cs-falcon-search-detection command from the CrowdStrike Falcon integration instead.
      • cs-detection-search: Use the cs-falcon-search-detection command from the CrowdStrike Falcon integration instead.

Infocyte Pack v1.0.1#

Integrations#

Infocyte#

Fixed a bug where fetch_incidents printed an error message if no new incidents/alerts were found.

JsonWhoIs Pack v1.0.3#

Integrations#

JsonWhoIs#

Fixed a bug when running the integration resulted in the exceptions must derive from BaseException error.

Kafka Pack v1.0.1#

Integrations#

Kafka V2#
  • Fixed an issue in which the offset for the fetch did not function as expected.
  • Improved error handling in the kafka-print-topics command.

Kenna Pack v1.0.3#

Integrations#

Kennav2#

Fixed an issue where the limit argument did not work when set above 25 in the kenna-search-fixes command.

Machine Learning Pack v1.1.0#

Scripts#

HashIncidentsFields#

Search for incidents by arguments with an option to hash some of the incident's fields.

Office 365 Feed Pack v1.1.2#

Integrations#

Office 365 Feed#

Added the Tags parameter.

PAN-OS Pack v1.2.0#

Integrations#

Panorama#
  • Added outputs to the panorama-get-logs command.
  • Added the source_zone and destination_zone arguments to the panorama-create-rule command.

PANW Comprehensive Investigation Pack v1.2.0#

Layouts#

PANW Endpoint Malware#

Added the new layout Palo Alto Networks - Endpoint Malware Investigation v2.

Playbooks#

Palo Alto Networks - Endpoint Malware Investigation v2#

Added the new playbook Palo Alto Networks - Endpoint Malware Investigation v2.

PCAP Analysis Pack v2.1.0#

Playbooks#

New: PCAP Search#

This playbook is used to parse and search within PCAP files.

New: PCAP Parsing And Indicator Enrichment.#

This playbook is used to parse and extract indicators within PCAP files and perform enrichment on the detected indicators.

Palo Alto Networks BPA Pack v1.2.0#

Layout#

Panorama Best Practice Assessment#

Added the Panorama Best Practice Assessment incident layout.

Playbooks#

Run Panorama Best Practice Assessment#

Marked the generate_zip_bundle fiter to fetch the report bundle ZIP file.

Comprehensive PAN-OS Best Practice Assessment#

Added Comprehensive PAN-OS Best Practice Assessment to the pack.

Palo Alto Networks Cortex XDR - Investigation and Response Pack v2.0.0#

Playbooks#

New: Cortex XDR - Malware Investigation#

Investigates a Cortex XDR incident that contains internal malware alerts. The playbook does the following:

  • Enriches the infected endpoint details.
  • Lets the analyst manually retrieve the malicious file.
  • Performs file detonation.

The playbook is used as a sub-playbook in the Cortex XDR Incident Handling - v2 playbook.

New: Cortex XDR - Port Scan - Adjusted#

Investigates a Cortex XDR incident that contains internal port scan alerts. The playbook does the following:

  • Syncs data with Cortex XDR.
  • Notifies management about a compromised host.
  • Escalates the incident in case of lateral movement alert detection.

The playbook is used as a sub-playbook in the Cortex XDR Incident Handling - v2.

New: Cortex XDR Alerts Handling#

This playbook is used to loop over every alert in a Cortex XDR incident. Supported alert categories:

  • Malware
  • Port Scan
New: Cortex XDR Incident Handling v2#

This playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident.

Palo Alto Networks PAN-OS EDL Service Pack v1.0.3#

Playbooks#

PAN-OS EDL Service Configuration#

Added a conditional task that validates if an EDL security rule with the same name already exists.

Phishing Pack v1.7.0#

Playbooks#

Process Email - Generic#

The task that updates the email headers in the layout will no longer continue on errors.

Process Email - Core#

The task that updates the email headers in the layout will no longer continue on errors.

Proofpoint Feed Pack v1.0.1#

Integrations#

Proofpoint Feed#

Added the Tags parameter.

Rasterize Pack v1.0.3#

Integrations#

Rasterize#
  • Fixed an issue where the rasterize-image command returned an image instead of a PDF file.
  • Added support for additional languages.

Recorded Future Feed Pack v1.0.2#

Integrations#

Recorded Future RiskList Feed#

Added the Tags parameter.

Remedy On-Demand Pack v1.0.1#

Integrations#

Remedy On-Demand#

Fixed an issue where the remedy-incident-update and remedy-get-incident commands required the request ID instead of the entry ID.

RiskSense Pack v1.0.1#

Integrations#

RiskSense#

Added the *risksense-apply-tag, which applies tags as part of the playbook.

Playbooks#

CVE Exposure - RiskSense#

Blocks IP addresses and applies the tag to assets that are vulnerable to the specified CVE.

Scripts#

DisplayCVEChartScript#

Displays a bar chart based on the CVEs count and the trending CVEs count with the different colors.

ServiceNow Pack v1.1.5#

Integrations#

ServiceNow v2#

Fixed the test button to work with debug mode.

Slack Pack v1.3.1#

Integrations#

SlackV2#

Increased integration context reliability by using versions (supported in Cortex XSOAR v6.0 and later).

Symantec Management Center Pack v1.0.1#

Integrations#

Symantec Management Center#

Added support for the content type LOCAL_CATEGORY_DB.

TAXII Feed Pack v1.0.1#

Integrations#

TAXII Feed#

Added the Tags parameter.

ThreatConnect Pack v2.0.1#

Integrations#

ThreatConnect#

Deprecated. Use the ThreatConnect v2 integration instead.

New: ThreatConnect v2#

Use the ThreatConnect v2 integration to manage your threat intelligence environment.

ThreatQ Pack v1.0.3#

Integrations#

ThreatQ v2#

Fixed an issue where the the URL schema was enforced in the url command.

TruSTAR Pack v2.0.0#

Integrations#

TruSTAR v2#

The TruSTAR v2 integration introduces rewritten code, tests, docstrings on code functions, and new commands. For commands that return indicators, the data is put in 3 contexts:

  • The standard context, without the malicious field because TruSTAR doesn't currently have a score for every indicator.
  • DBotScore context with score as 0 for the same reason.
  • TruSTAR context with all the information returned by the command.
    • trustar-get-reports
    • trustar-get-enclaves
    • trustar-related-indicators
    • trustar-indicators-metadata
    • trustar-indicator-summaries
    • trustar-get-whitelisted-indicators
    • trustar-move-report
    • trustar-trending-indicators
    • trustar-get-indicators-for-report
    • trustar-search-indicators
    • trustar-submit-report
    • trustar-delete-report
    • trustar-correlated-reports
    • trustar-add-to-whitelist
    • trustar-remove-from-whitelist
    • trustar-report-details
    • trustar-update-report
    • trustar-search-reports
    • trustar-get-phishing-indicators
    • trustar-get-phishing-submissions
    • trustar-set-triage-status
    • trustar-copy-report
TruSTAR#

Deprecated - Use the TruSTAR v2 integration instead.

US - Breach Notification Pack v1.0.3#

Layout#

US Breach Notification#
  • Added a new widget to the layout.
  • Added Notifications status to the layout.

Playbooks#

Illinois - Breach Notification#

Added setincidents to the playbook for the new layout.

New York - Breach Notification#

Added setincidents to the playbook for the new layout.

California - Breach Notification#

Added setincidents to the playbook for the new layout.

Residents Notification - Breach Notification#

Added setincidents to the playbook for the new layout.

Zscaler Pack v1.0.2#

Integrations#

Zscaler#
  • Added the multiple argument to the url command, which when set to "false" enables users to submit singular URLs that contain commas.
  • Improved list handling for the zscaler-category-add-url and zscaler-category-add-ip commands.

iDefense Pack v1.0.1#

Integrations#

iDefense#

Fixed an issue where the Set API token parameter was visible in the integration configuration window.

Okta Pack v1.0.3#

Integrations#

Okta#

Deprecated. Use the Okta v2 integration instead.

Assets#

Edit this page
Report an Issue