---
version: "Morpheus Release Notes"
language: "en"
---
# 14.0
## **Unified Configurations**
You can now configure our platform in one area seamlessly and efficiently for your **Playbooks** , **Integrations** , **Utility Commands** , **Schedules** , **Connections** , **D3 Agents** , **Global Lists** , **User Management**, and more.
1. Your work is preserved while navigating across the different pages in the left navigation pane. This way, you can continue where you left off when you come back.
2. A new **Back** button allows you to return to the previous pages you visited easily.
3. Most **Configurations** modules share a two-panel framework for improved consistency and efficiency.
## **Playbooks**
Playbooks in V14.0 underwent major changes. First, you can now handle the entire lifecycle of an Event with the **Event Playbook** and the Incident response lifecycle with an **Incident Playbook** . Second, the functionality of each type of Playbook has been enhanced to allow you to create more complex workflows. Third, the UI of the Playbook editor has been significantly improved based on user feedback to make it even easier to build a complex workflow without the need to code. We have also made a conceptual update to make it even easier to distinguish between a **Playbook** and a **Command**.
### **Revamped Playbook Testing**
In V14.0, we have completely rebuilt our testing system and made it the most comprehensive testing tool amongst all SOAR products. We built the new testing system with one aim: to allow users to perform in-depth testing at **all levels** of a Playbook. Our new testing system allows you to test **the entire Playbook** , or an **individual Task** , or an individual **input**.
#### **Playbook Level**
At the Playbook level, you can test the entire Playbook workflow with any ingested data in the system. For example, you can select an ingested Incident as data source to test your Playbook. After your test run, you will see icon(s) appear below each Task. This icon represents the current status of the Playbook task, and you can click on the icon(s) to view the **Playbook Task Details**in the pop-up window.
#### **Task Level**
At the Task level, you can test a Task with specified input parameters and view the resulting output. Testing a Task can help you ensure that it is well configured before moving on to creating the next step of your workflow.
#### **Input Level**
At the Input level, you can test your inputs to make sure it satisfies the Command parameters. Testing an input is especially useful when you are configuring a dynamic input - testing here can ensure the correct JSON path has been picked, or the correct data transformation has been applied.
#### Playbook Triggers
In V14.0, all Incident Playbooks contain a new**Trigger Task** by default. This allows you to create automated conditional workflows based on specific conditions. These Triggers enhance the Playbook's capabilities and make them more responsive to Incident form field values. You can connect workflows to the new**Trigger Task and these workflows will** run based on the specified conditions.
#### Playbook Permission Control
We have added new permission controls to allow for even more granular control over Playbook permissions. You used to only be able to control Playbook permission by User roles. In V14.0, you can now set specific **View** , **Edit** and **Publish** rights to specific users for each individual **Incident Playbook.**
#### **Command Preview**
A new **Command Preview** interfaceprovides you with visibility into **Input,** **Key Fields** , **Context Data, Return Data** , **Raw Data** , and **Result** when adding or configuring a **Playbook** **Task** . With this new feature, you can concretely understand how each **Command** can be used and configured directly within the **Playbook** editor.
#### **Playbook Task Enhancements**
##### **Data Formatter Task**
We have created an all new**Data Formatter Task** based on the powerful **Jinja Template Engine** with enhanced capabilities. Boasting over **130+** filters, the new **Data Formatter Task** has been created to allow you to easily transform your data to fit your needs.
The Data Formatter contains built-in tools such as the **Format Builder** , **Quick Start Guide,** and **Reference Guide** to accommodate users of all levels of technical proficiency.
##### Data Formatter Reference Documentation
Within the **Data Formatter Task** , you can accessour custom built-in documentation to help you get familiar with the **Data Formatters** . The documentation walks through the details of a **Data Filter**, how to use them, and best practices.
The documentation has 3 tabs:
* The **Quick Start** tab provides basic knowledge on **Data Formatters'** syntax and structure, and a quick walkthrough on using the **Data Formatter Task**.
* The **Data Formatters Reference** tabprovides a comprehensive list of **Data Formatters** , sample input and output data, and detailed explanations of how a **Formatter** operates. You can search directly in this list to find the most appropriate **Filters**for your workflow.
* The **Template Documentation** tab provides more complex knowledge of **Data Formatters**, and additional information on their syntax.
##### **Ongoing Surveillance Task**
A new **Ongoing Surveillance Task** has been added to allow you to schedule a Fetch Event command right inside a Playbook. You can configure the type of tactics, techniques, and procedures of the Events right when they are ingested.
All Events fetched from this Task can be viewed in the **Ongoing Events** tab in the **Investigation Dashboard** where you can view all **Ongoing Surveillances** you have, the essential details, and the ability to remove **Surveillances** that you no longer need.
##### **Merge Task**
The **Merge Task** takes in data from all preceding connected Tasks and combines the data based on specified conditions. Tasks that are connected after the Merge Task can then reuse this combined data.
There are 4 conditions that control how the data is combined:
1. By Playbook instance
2. By Task name
3. By Task instance
4. By specific JSON path
#### **Other New Playbook Features**
1. Create **Playbooks** where you can take actions upon event-ingestion. Previously, you could only use **Playbooks** on an Incident.
2. Create new **Integrations** and **Utility Commands** , and **Connections** on the fly within **Playbooks**.
3. Find **Workflows** , **Integrations** , and **Utility Commands** by searching through the new **Command Shortcuts**panel.
4. Manage each **Playbook** with the simplified menu bar to easily Clone, Share, Submit, and Publish Playbooks.
### **Integrations Enhancements**
You can now view all available **Integrations** in one list, organized by category. **Built-In** and **Custom Integrations** are differentiated with tags, providing more context for your workflow. Furthermore, you can access both the **Integration Command Settings** and the **Editors** (Python, Playbook, REST API, SQL) simultaneously.
### **Utility Commands**
With the new **Utility Commands** interface, you can now view all available **Utility Commands** in one list, organized by category. Tags have been added to differentiate between **Basic** , **Cyber** , and **System Utility Commands. Version Control** is now available across all **Utility Commands** . Lastly, you'll be able to view both **Command Settings** and **Editor** (Python, Playbook, REST API, SQL) simultaneously.
### **D3 Agent Management**
With our newly added **Agent Management** module, you can install **Agents** via a step-by-step installation wizard, and monitor them directly within the D3 SOAR Platform. You can also update the configured **Agents** using the installation wizard.
With **Agent** installation and management now available in the application, you can deploy multiple **Agents** to your on-premise environment at your discretion without requiring assistance from D3.
### **Schedules \& Data Ingestion**
A **Schedules \& Data Ingestion** module has been added to give you a consolidated view of all your scheduled jobs and data intakes in one central location.
You can now see more contextual information within the **Log** function in **Scheduled Jobs** and**Data Intake** . Depending on the type of **Command** or **Data Intake method** , the **Log** allows you to view all **Input** , **Output** , and **Error** data in a list according to each scheduled run. With this, you can determine if your scheduled jobs and data ingestion are working as expected.
### **Event Automation Rules Enhancements**
Event Automation Rules now enable you to have granular control over specific conditions that determine an Event's escalation/dismissal behavior. You can control how an Event is escalated into Incidents, categorized by: **matching fields, individual Event IDs, automation rules,** and**batches.**
### **Additional Configurations Features**
1. A new **Settings** module has been added to configure essential platform details such as SMTP Settings, and Time/Date format.
2. **Global List** updated to two-panel layout for improved configuration experience.
3. You can configure **Connection Health Checks** for**Custom Integrations**.
4. All **Users** , **Groups** , **Roles** , **Sites** pages have been consolidated under one **User Management** module.
## **Incident Workspace Improvements**
### **Create Ad-Hoc Tasks**
You can now create Ad-Hoc tasks in the Incident Workspace to assign specific tasks to users. This can help you keep track of Incident-related tasks as all created Ad-Hoc tasks will show up in the Pending Tasks tab.
---
version: "Morpheus Release Notes"
language: "en"
---
# 14.0.582
## **What's new in v14.0.582**
### **New: Multitenancy**
The new multi-tenancy feature allows you to share different content types from **a single master source** to **multiple tenant destinations** . This feature is perfect for MSSPs to manage clients from different regions and manage content sharing from a single master instance. There are **nine** types of content you can share:
1. Event Playbooks
2. Incident Playbooks
3. Integration
4. Utility Commands
5. Connections
6. Global List
7. Event Automation Rules
8. Incident Forms
9. Users / Group / Roles
On top of that, there are new system built-in commands to help you manage your tenants.
### **New: Event Playbooks**
With D3's incident playbooks, you were able to create complex incident workflows with our codeless playbook engine. In the newest version of D3 SOAR, D3's powerful playbook engine has been improved to support event playbooks. You can now create multiple standardized workflows for ingested events from different integrations and select which playbook to run for each scheduled event ingestion.
### **General Improvements**
#### **Webhook Redesign**
The webhookingestionmethod allows the Integration to send event or incident data (in JSON format) to be investigated in the system. This allows real-time, controlled event or incident data ingestion for SOC teams, and offers greater flexibility. In this version, we redesigned the UI to make it easier for you to create and manage webhook keys.
#### **Investigation Dashboard Enhancements**
The Investigation Dashboard is one of the essential modules every analyst employs during an investigation. We understand the significance of this dashboard and have made big improvements in this version to make it simpler to use.
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|  | ****Dashboard Advanced Filters**** You can now apply advanced filters to incidents within the Incidents tab to help you better search for the relevant incidents: **Data Within, Incident Type, Status, Severity, Owner, Tactic, and Technique.** |
|  | ****Add Custom Columns in Dashboard**** You can now add custom columns to the event and incident dashboard in the Application Settings. |
|  | ****Site List Enhancement**** The new site dropdown list allows you to search and bookmark important sites that are important to you. |
|  | ****Bulk Action on Events and Incidents**** You can now multi-select and perform bulk actions on multiple events/incidents. |
|  | ****New Dashboard Items**** Artifacts and Playbook Errors have been added to the investigation dashboard list. |
#### **Custom Artifacts**
In addition to the built-in artifact types offered by D3, you now have the power to create custom artifact types to fit your needs as well. Custom Artifact Types will have user-defined identities, additional fields and relationships, allowing SOC teams to have greater flexibility in artifact detection and organization.
#### **View/Clone Built-In Commands**
You can now view the implementation of our built-in commands and clone them if you want to customize the commands.
#### **Playbook Local Shared Data**
The local shared data allows you to store data in JSON format for tasks to reuse in a playbook. This storage area is local -- data stored here is only accessible by this playbook and this playbook only. This feature may be helpful in situations where there are data (e.g. URL reputations) you want to be accessible by any tasks regardless of their playbook path.
##### **Other Enhancements**
1. Manage email domain whitelist for users' emails
2. Configure "Shared to Internal Sites" recipient site within connections
3. Use dynamic placeholders for incident title/description
4. Ability to dynamically select a dropdown input in a playbook
5. Improved path picker usability within data formatter
6. Added new incident metadata fields in a playbook
7. Revamped user manual site
### Integration Enhancements
We are constantly improving our 300+ out-of-the-box integrations to help you build your workflow easier. In this version, we have updated/added 14 of the integrations:
#### New!
* AWS GuardDuty
* Google Kubernetes Engine
* F5 Load Balancer
* Stellar Cyber
* Fresh Service
* D3 Integration
#### Enhancements
* Docker
* Microsoft Sentinel
* Zendesk
* AWS EC2
* Azure Active Directory
* Datto Autotask PSA
* TheHive
* FortiAnalyzer
* Qualys
---
version: "Morpheus Release Notes"
language: "en"
---
# 15.1.39
## **Incident Overview Enhancement**
### **Timeline**
The new timeline feature within the incident workspace allows you to add investigation details and order them chronologically to visualize the lifecycle of the incident. Add details from the command centre or related events and incidents, or create your own custom supplementary notes.
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|  | **ADDING ITEMS FROM THE COMMAND CENTRE** You can now add investigation details, such as playbook results and changes to the incident, from the command center to the timeline. |
|  | **ADDING RELATED EVENTS AND INCIDENTS** Related events and incidents, such as the escalated event, can also be added to the timeline to show event and incident relationships within the incident lifecycle. |
|  | **CUSTOM TIMELINE NOTES** And of course, if there are custom notes or additional details you'd like to add to the timeline, you can do so right on the timeline. |
### **Playbook Notes**
Notes added in playbook tasks will appear in the incident overview under notes in its own category, for ease of track keeping and organization.
### **Incident Form Section**
We made enhancements to the UI of the incident form section for filling out nested responses. The new design has better clarity and overall user experience improvements for analysts during their investigation.
### **Playbook Enhancements**
In order to enhance the capabilities of our playbooks, we have enhanced REST API, conditional, and data formatter tasks such that they can stop on error. This can be useful for debugging and further ensuring that your playbooks run smoothly without issue.
## **Schedules and Data Ingestion**
In the schedules and data ingestion modules, you are able to create multiple recurring schedules for different integration commands. We observed that these schedules can quickly add up and make it difficult to locate what you are looking for -- therefore we have added the ability to filter and sort through all of your schedules and data ingestions.
Filter by file, schedule and webhook for data ingestion, and filter by integration command, system command, and utility command for schedules.
## **Investigation Dashboard**
### **Bulk Action Enhancements**
More bulk actions have been added to the investigation dashboard so you can perform actions quickly on multiple events and incidents at once.
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|  | **REASSIGN EVENTS** If you have several events that need to be taken over by a new investigator, you can batch select them and click on the batch action to reassign. |
|  | **COPY INCIDENT NO.** If you need the incident number of several incidents at once, select all the ones you need and click on the batch action to copy their incident number. |
### **Event Details Concurrent Users**
Multiple investigators on the same event details? Now you can see everyone who is working on each of the events at once to help identify and track changes.
## **Application Settings**
### **Tactics and Techniques Update**
D3 SOAR uses the latest tactics and techniques based upon the MITRE ATT\&CK framework. We know how important keeping up to date with the latest security frameworks is, therefore we have made it easy for you to keep your TTPs up to date with the latest MITRE updates with the click of a button.
## **Integrations**
We are always adding more to our out-of-the-box integrations, as well as making enhancements to existing ones. Below are some of the latest updates to integrations.
**BITDEFENDER** ^**New!**^
Bitdefender Control Center APIs allow developers to automate business workflows. D3's integration with Bitdefender provides the ability to manage groups and endpoints, create scan tasks, quarantine items and retrieve report results for each predefined report.
Below are the available commands:
listEndpoints
getEndpointDetails
deleteEndpoints
moveEndpoints
updateEndpointLabels
createScanTask
listScanTasks
addToBlocklist
removeFromBlocklist
listBlocklist
isolateEndpoints
restoreEndpoints
quarantineFiles
restoreQurantineFiles
listQuarantineItems
listReports
downloadReports
createGroup
listGroups
updateGroups
**THREATFOX** ^**New!**^
ThreatFox is a cybersecurity platform that collects and shares indicators of compromise (IOCs), helping IT security researchers and threat analysts protect their constituencies and customers from cyber threats. D3's integration with the ThreatFox latest REST API (version v1) provides the ability to get detailed IOC information from the ThreatFox platform.
Below are the available commands:
getIOCs
searchIOC
searchIOCByHash
listMalwares
getIOCsbyMalwareFamilyName
listIOCThreatTypes
listTags
getIOCByTag
### **Enhanced**
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|--------------------------------------------------------------------------------------------------------------------|
|  | **AUTOMOX** | Overall improvement made to the integration, all 22 commands have been updated |
|  | **AWS S3** | All 13 commands have been updated |
|  | **GMAIL** | The following commands have been updated: deleteEmails trashEmails untrashEmails downloadAttachment |
|  | **RECORDED FUTURE** | checkIPReputation command has been updated |
|  | **SOLAR CYBER** | fetchEvent command has been updated The following commands have updated descriptions: updateEvents getEventDetails |
---
version: "Morpheus Release Notes"
language: "en"
---
# 15.2.108
## **Playbook Enhancements**
### **Playbook Task: Unwind**
The new **Unwind** playbook task allows you to take an array of JSON objects and separate them into individual objects. Each JSON object can then be enriched individually with a different workflow. The unwind task will make it more accessible to manage and process large data sets from the playbook editor menu.
### **Event Playbook: Select an Existing Event for Testing**
You can now select an existing event as test data to simulate the on event ingestion trigger. This eliminates the need to manually build test data. This feature streamlines and speeds up the testing process for event playbooks. The original process of building custom trigger data will still be available by selecting **Custom Trigger Event**.
## **Investigation Dashboard Enhancements**
### **Critical and Informational Severity Levels**
There are now two new severity levels for incidents: **Informational** and **Critical** . These levels are in addition to the existing levels of **Low** , **Medium** , and **High**, with Informational being the least severe and Critical being the most severe. This allows for a more detailed and accurate categorization of incidents and can help improve incident response and management by allowing teams to prioritize and filter incidents based on more precise severity levels.
### **Auto-Fit Column Width**
A new button has been added to let you auto-fit the width of columns, making it easier to navigate and view your data.
### **New Column for Events: Event Escalation/Dismissal Method**
A new column indicating whether an event's escalation or dismissal was manual or automatic has been added to the events dashboard. This new feature allows MSSPs to easily track and use exported event dashboard data to generate reports on event handling, particularly for customers who want to see whether a particular event was processed automatically or manually.
### **Auto-Refresh Upon Event and Incident Ingestion**
The event and incident dashboards will now automatically refresh with real-time data. SOC teams and MSSPs using D3 SOAR can now stay up-to-date on the latest events and incidents as soon as they are ingested from their security tool stack to D3 SOAR. This not only provides a more efficient and streamlined workflow but also allows for faster incident response and improved security posture.
### **New Columns for Pending Tasks**
Additional columns are available on the Pending Tasks dashboard to help you prioritize and manage pending tasks more effectively.
With this update, you will now be able to add the following columns to the pending task dashboard:
* Incident Owner
* Incident Title
* Incident Owner Site
* Incident Severity
* Incident Date Created
* Incident Date Modified
* Incident Status
* Incident Playbook
* Tactic
* Technique
With these columns, you will be able to quickly identify the most important pending tasks and prioritize your incident management workflow.
## **Utility Commands**
### **Bulk Action Utility Commands**
Two new utility commands have been added to allow bulk actions for setting incident fields and updating dynamic form values. These utility commands can be added to playbooks to streamline the incident management workflow for MSSPs and SOC teams processing large volumes of incidents.
#### **Set Incident Fields In Bulk**
You can bulk update incident fields by creating a JSON array with the corresponding incident numbers and incident fields' key-value pairs.
#### **Update Dynamic Form Value By Incident Number In Bulk**
You can bulk update dynamic form values of incidents by creating a JSON array with the corresponding incident numbers and dynamic form fields' key-value pairs.
### **Refresh Incidents Overview**
The **Refresh Incidents Overview**utility command allows the system to automatically refresh the incident overview page of specified incidents after processing in playbooks. You will no longer have to manually refresh the incident overview page to see updated information. Incident response and management will be streamlined by providing real-time visibility into the status of incidents, making it easier to track and prioritize incidents based on their current status.
### **Remove Case Attachment and Remove Incident Attachment**
The **Remove Case Attachment** and **Remove Incident Attachment** utility commands can be used to remove attachments from specified arrays of case numbers and incident numbers, respectively. You can integrate this with playbook workflows to automate the case and incident management process. This is useful for housekeeping and removing a large number of sensitive attachments from the system, giving you greater control of your data.
## **Application Settings Enhancement**
### **Customizable Dynamic Input Method for Playbooks**
The dynamic input method for playbooks can now be selected at the application level, the playbook level and the playbook task level. This enhancement improves compatibility with playbooks created with previous versions of D3 SOAR and gives you more flexibility in how you use dynamic input methods to build playbooks.
## **Global List Enhancement**
### **Maximum Size Limit for Global List**
We have limited the maximum size of a global list to 20 MB. This will help improve the performance of the VSOC application and ensure seamless data processing between playbooks and global lists.
## **Event Automation Rules Enhancements**
### **Share Automation Rules Across All Client Sites**
Event automation rules can now be easily shared across all client sites. You can realize time-saving benefits by not having to create separate rules for each individual client site. This is beneficial for MSSPs who want to provide a more standardized security management service to their clients, by ensuring that all clients are protected by the same set of automation rules, minimizing the potential for security gaps.
### **Sharing Automation Rules to Specific Sites**
Event Automation Rules can now be shared with specific sites, making it easier to correlate new events with incidents that may be located on different sites when using incident suppression.
With this feature, you can now apply event automation rules to multiple sites, and select the specific sites within the event automation rule itself. This means that you will be able to correlate follow-up events to existing incidents across different sites, rather than just within the same site.
This enhancement improves the correlation of follow-up events to existing incidents and allows MSSPs to better protect clients' security systems across different sites. In turn, it will provide a more comprehensive security management service to clients and increase the efficiency of the incident management process.
## **Webhook Configuration Enhancement**
**Setting Up Webhook Keys: Sample Request Body**
We have improved the webhook configuration page for commands by including sample request body data, making it easier for you to set up and structure your requests.
### **Other Enhancements**
**Login Landing Site Selection**
In **My Preferences**, you can customize your preferred landing site upon logging into VSOC. With this setting configured to the user's role and responsibilities, SOC analysts and MSSPs can spend less time navigating the platform and more time focusing on incident response and security operations.
### **UI Updates to the Integrations Module**
Small updates to the design of the integrations module have been made for a better user experience. Integrations have been reorganized into more appropriate categories. Additionally, we've made some cosmetic changes such as increasing the size of the integration logos and providing more space for the integration descriptions.
---
version: "Morpheus Release Notes"
language: "en"
---
# 15.3.72
## **Incident Workspace Enhancements**
### **Events Summary**
The Events Summary section serves as an overview of an incident's source events. The section is logically organized by batches based on the escalation method (i.e., manual, event playbook, task, or automation rule) and presented clearly and concisely.
Each event from a particular batch is readily expandable to reveal additional details such as severity, time of occurrence, the last updated time and other mapped fields. The summary provides a direct link to the source event for quick access. To suit your preferences and incident response workflow, you can opt to only display a customized set of fields for events ingested from a given integration.
### **UI Enhancement: Editing Incident Summary Fields**
Modifying an editable incident summary field is now straightforward and quick. You can hover your cursor over the field and click it to make necessary edits to the incident summary.
### **Incident Viewing History**
The breadcrumb feature for linked incidents within the Incident Workspace is a useful addition to the incident response system. Analysts can trace their steps and understand the context of their incident investigations, making navigating through the incidents easier and ensuring that no critical information is missed.
## **Integration Enhancements**
### **Built-in Integration: REST API Callback**
The new **REST API Callback** system integration enables you to send asynchronous REST API requests from D3 SOAR. Callbacks enable you to receive data at a specified callback URL when a particular event is triggered.
For example, D3 SOAR may send a REST API call to a ticketing system to create a new ticket for an incident. The ticketing system responds with a callback URL that the D3 SOAR can use to receive notifications about the status of the ticket. D3 SOAR then registers this callback URL with the ticketing system and waits for notifications about the ticket status.
When the ticketing system updates the status of the ticket, it sends a notification to the callback URL registered by the D3 SOAR. D3 SOAR then processes the notification and updates the incident status accordingly.
### **Event Field Mapping: System Variables for Placeholder Fields**
Prior to this update, it was only possible to define placeholder fields for field mapping using previously mapped fields. Placeholder fields let you display customized information from a mapped field when viewing events from the investigation dashboard or event details. We've added the functionality to let you use a list of system variables to define placeholder fields. These system variables, such as SiteName and TimeStamp, can be used out-of-the-box, even if no fields are set up. Some of these fields provide data that was previously inaccessible by normal field mapping, such as connection data.
## **Playbook Enhancement**
### **Trigger: On Incident Status Change**
Incident playbooks can now be configured to trigger automatically whenever there is a change in an incident's status. Any tasks connected to this trigger run immediately after an incident's status changes. This enhancement enables security teams to automate their response efforts and take immediate action as soon as a critical incident occurs. It eliminates the need for manual intervention, ensuring consistency and accuracy in response actions.
## **Investigation Dashboard Enhancements**
### **Bulk Change Incident Status**
You can now bulk change the status of incidents on the Investigation Dashboard.
### **Incident Status: In Progress and On Hold**
Incident statuses represent the different stages of the incident response lifecycle. The "In Progress" and "On Hold" incident status has now been added. This is an addition to the existing statuses of **Open** and **Closed**. The ability to indicate whether an incident is in progress or on hold can provide more granular visibility into the investigation process and help organizations better manage their incident response efforts.
## **Utility Commands Enhancements**
### **Update Identical Event**
The **Update Identical Event** command is exclusively available within the event playbook, designed to streamline incident data management. When you use this command, it queries D3 SOAR's database to find an original event within the same integration matching your input search conditions.
Once the matching event is located, the mapped fields of the original event are updated with the new event's data. This preserves a complete history of all event field data in the newly introduced Events Summary in Incident Workspace. After the update is complete, the new event can be configured in a playbook to be dismissed with an additional playbook task, maintaining a clear and organized record of all incidents. You can view the data history for the mapped fields of the updated event by accessing the events summary in the Incident Workspace.
### **Link to Related Event Incident**
The **Link to Related Event Incident** command significantly improves and streamlines event correlation. Event correlation is the process of analyzing and identifying relationships between events occurring within an organization's security environment. By understanding these relationships, security teams can quickly identify potential security incidents, assess their impact, and take appropriate remediation actions.
This command is exclusively used in event playbooks to search for related events based on specified search conditions. If any of these related events have an associated incident, the new event will be linked to the incident of related events. By linking events to a common incident, analysts can quickly identify the root cause of an incident and understand the full scope of the incident.
### **Create Tenant Data Ingestion Schedule**
The **Create Tenant Data Ingestion Schedule**utility command brings automated client onboarding for our Managed Security Service Provider (MSSP) customers. With this new command integrated into a playbook workflow, MSSPs can easily automate data ingestion schedules for specific integrations on a tenant site, simplifying their client onboarding process and reducing the professional hours required for onboarding clients.
### **Dismiss Event After Creation**
The **Dismiss Event After Creation** utility command is designed to be used after the "On Event Ingestion" trigger in event playbooks, with the purpose of dismissing low-priority events automatically. This effectively frees up your security team's workload by freeing up their time to focus on mission-critical tasks.
### **Update Owner ID and Site ID**
The **Update Owner ID and Site ID**utility command lets you update an incident's Owner and Site ID. This utility command can be integrated with playbook workflows to automate the process of updating incident ownership and site location information.
### **Close Incidents in Bulk - New Input Parameter**
The **Bypass All Required Fields** parameter that lets you bypass required fields on incident dynamic forms. If the command is executed by a manual task or a test command, you must have necessary permissions to edit, close, and view the incident. If the command is executed in a playbook, the incident should be in the selected site. This adds greater flexibility and efficiency to bulk incident closing.
## **Tenant Management Enhancement**
### **Tenant Site Management**
A **Sites** tab has been added to **Tenant Management**, exclusively for multi-tenant instances. This new feature allows Managed Security Service Providers (MSSPs) to easily activate or deactivate a tenant instance's sites from the master tenant site. The activation and deactivation date of a site is visible, which can be used for record-keeping and auditing purposes. MSSPs can easily purge and manage client data when offboarding, streamlining the overall process.
## **Append Extra Information to Request URLs for Bi-Directional POST Requests**
The D3 SOAR webhook has undergone improvements to support bi-directional POST requests. This upgrade allows for updates to be made to data from both D3 SOAR and external systems, ensuring that corresponding data is updated on both ends. One practical example of this is with ServiceNow, where new incidents are received as tickets and updated tickets are sent back to D3 SOAR after processing. With the use of a webhook, the information to update the corresponding incident is appended to the end of D3 SOAR's webhook request URL (e.g. **/UpdateEvents** is appended to the request URL as **https://demo.d3soar.com/xyz/VSOC/api/Data/ServiceNow/Webhook_Test/CreateEvents/UpdateEvents**), which is added to the "WebhookExtraInfo" field in the event data. This additional data can then be incorporated into a playbook workflow, effectively updating the corresponding incident or event in D3 SOAR.
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.5.49
## **Playbook Editor Enhancements**
### **Refreshed Playbook Editor UI**
We're excited to introduce the latest update to our playbook editor, featuring a sleek, modern design that optimizes workspace and user interaction. Here's what's new:
#### **Playbook Task Bar**
The playbook tasks have been relocated to a new horizontal bar at the bottom of the editor, providing a cleaner appearance and expanding the workspace for better playbook visibility. The feature for command searching is now integrated within the command task node, enabling quick access to integration and utility command searches upon hovering over it.
#### **Playbook Task Templates**
Both command and conditional tasks now feature configuration templates. To explore these templates, hover over the respective task on the horizontal playbook task bar. In version 16.5, the command task includes a template for constructing nested playbooks, while the conditional task offers a template for creating boolean conditions.
#### **Redesigned Root Node**
The root node in the playbook editor has been redesigned, now directly integrating the playbook trigger options. This removes the need for an additional trigger node, simplifying the overall interface. To modify the playbook's name, description, and dynamic input method, simply click on the root node to open the configuration dialogue.
#### **Floating Components**
In line with modern design principles, the update introduces adaptable floating elements, such as the playbook editor toolbar and task configuration dialogues. These can be dragged and resized, offering a more flexible and efficient editing environment.
## **Incident Field Mapping: Dynamic Fields**
Previously, incident field mapping was limited to a set of incident-specific system fields with the ingested data of Fetch Incident commands. With this update, you can now configure custom incident field mappings by incident type, within the **Incident Form Editor** . Each **Info Activity** in an incident form will be available in the corresponding incident type as a dynamic field to configure for field mapping.
## **Tenant Management Enhancements**
### **Tenant Site Status**
The configuration options for tenant site statuses have been updated to "Enable", "Suspend", and "Disable", replacing the former "Activate" and "Deactivate". These status options, along with the newly added**Update Tenant Site Status** utility command, greatly facilitate automated client tenant onboarding and offboarding for Managed Security Service Providers (MSSPs). Here's a detailed overview:
* **Enable**: In this mode, all systems and operations, such as health checks, event fetching, and incident fetching, function seamlessly. Automation rules and connections are restored to their normal working condition after reactivation.
* **Suspend**: Under this status, all operational schedules are paused, and the health check feature is deactivated. However, automation rules and connections retain their last states (active or inactive). While new events or incidents can't be added to dashboards, editing existing records and executing related playbooks is possible. Tenant sites in the suspended state are still available for selection in playbook tests.
* **Disable**: This status effectively renders all site-related functionalities hidden and unselectable. This includes schedules, automation rules, connections, dashboards, and playbook tests. Access to historical records is also restricted in this state. Additionally, the site will not be visible in the dropdown menu for site selection.
The **Update Tenant Site Status** utility command can be leveraged to allow these status changes to be automated by playbooks. This streamlines the process of onboarding and offboarding clients, making it more efficient and less prone to errors. MSSPs can automate much of the client lifecycle management, from initiating services with "Enable" to temporarily pausing with "Suspend", and finally, securely offboarding with "Disable".
### **Utility Commands**
#### **Role-based Access Control**
We've introduced a role-based access control system for utility commands. This feature allows only specific roles to configure and execute certain commands. To set this up, go to **Configuration** \> **Organization Management** \> **Roles** . Once you select a role, visit the **Details** tab and locate the **Configuration Module** section. For administrator roles, the "Privileged Commands" permission will be visible under this section, comprising two sub-permissions: "Set Privileged Commands" and "Access Privileged Commands." These are automatically enabled for admin roles and cannot be modified. For other general access roles, only the "Access Privileged Commands" permission will be available to configure.
Administrators have the flexibility to designate which utility commands are considered privileged on a command-by-command basis. To do this, navigate to **Configuration** \> **Utility Command** . Select the utility command you wish to modify, and in the **Settings** tab, you will see the **Role Access** setting. Here, use the **Privileged** checkbox to mark the command as privileged. This designation restricts its use to only those users who have privileged rights. Privileged users will be able to:
1. Search and view the command within the **Utility Commands** module under **Configuration.**
2. Add the command when configuring playbooks.
3. Run it as an ad hoc command within an incident.
#### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
|-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Add New Artifacts in Event Playbook | Adds a new artifact to an event when it is ingested and processed in an event playbook. This command can only be used in the event playbook with the "On Event ingestion" trigger. |
| Update Tenant Site Status | Updates the status of a tenant site for a specified region and tenant with three options: Suspend, Disable, and Enable. |
#### **Updated Commands**
The following utility commands have been updated in this release of D3 SOAR.
|-------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| Save and Link Artifacts to Incident | When the "Artifact Type" parameter is not defined, the command will automatically add it to an existing system or custom artifact type based on the defined artifact fields. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Carbon Black Cloud V2 | VMware Carbon Black Cloud provides endpoint detection and response (EDR) solutions, advanced threat hunting, and vulnerability management. D3 SOAR is providing REST operations to function with VMware Carbon Black Cloud. **Note:** This is D3 SOAR's second version of the Carbon Black Cloud integration, which supports API V7. |
| Binalyze AIR | Binalyze AIR is a Digital Forensics \& Incident Response (DFIR) platform that enables organizations to quickly and effectively investigate security incidents and mitigate potential threats. |
#### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| FortiGate | New commands: **Create Address Group** ,**List Addresses** ,**List Address Groups** |
| Rapid 7 InsightIDR | New commands: **Create Comments** , **Search Users** , **List Attachments** , **List Investigation Comments** **Fetch Incident**: Added a step to call the getInvestigationEvidence API to obtain "indicator_occurrences" from the investigation and append it to the incident raw data located at $.data\[\*\].indicator_occurrences. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.6
## **Incident Workspace Enhancements**
### **Incident Overview: HTML Editor Mode For Incident Form Inputs**
The "Text" and "Text Area" incident form fields for now include an HTML editor for inputs. This allows you to enter HTML code directly into the "Text" editor. When you switch to the "HTML" editor mode, you'll be able to view the HTML content as it appears when rendered. This view also lets you make additional edits. For instance, if you insert an HTML table in the "Text" editor, switching to the "HTML" editor will display the table as it would appear on a webpage, enabling you to modify individual table cells as needed.
## **Application Settings Enhancement**
### **New Web Config Key: HideTTPNodesOnLinkAnalysis**
We've added a new web config key within the application settings to help you declutter your **Link Analysis** view in the **Incident Workspace**. With this new option, you can now choose to hide TTP nodes.
## **Utility Command Enhancements**
### **Custom Utility Commands: Dropdown and Multi Select Input Field Types**
The **Dropdown** and **Multi Select** input field types are now available as input parameters when creating utility commands, providing greater flexibility in command customization.
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
| **Commands** | **Functionality** |
|--------------|------------------------------------------------------------------------------------|
| Get D3 Log | Retrieves D3's audit and monitor logs detailing user activity recorded by D3 SOAR. |
### **Updated Commands**
The following utility commands have been updated in this release of D3 SOAR.
| **Commands** | **Changes** |
|---------------------------------------|---------------------------------------------------------------------------------------|
| Link Incidents With Related Artifacts | The "Order" parameter will now sort incidents by IR ID instead of reporting UTC time. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
| **Integration Name** | **Description** |
|-----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ManageEngine ServiceDesk Plus MSP | ManageEngine ServiceDesk Plus MSP is a help desk and asset management software solution that MSPs can use to deliver efficient IT service to their customers. Using ServiceDesk Plus MSP, help desk agents and IT managers can monitor and maintain the IT assets and requests of several organizations from a single console. Within the application, each organization is referred as an Account. You can create separate configurations, workflows, approvals, and SLAs for each of the accounts. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
| **Integration Name** | **Changes** |
|-------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Any.Run | New commands: **Get Report, Test Connection, Create URL Analysis, Create File Analysis, Get Analysis Task Result, Get IOC Report, Get MISP Report, List Analysis History, Get HTML Summary Report, Get Graph Report** Converted existing commands from C# to Python: **Check File Reputation, Check URL Reputation, List Analysis** |
| AWS GuardDuty | **Fetch Incident**: Added the "Update Field Mappings" parameter to enables D3 to update existing mapped fields within an existing incident, rather than creating a new incident. |
| BMC Remedy AR | New commands: **List Incident Entry v2, Update Incident Entries By Request IDs** All commands: Added a logic to execute the logout process to manually end the login session. Deprecated commands: **List Incident Entry** |
| ManageEngine ServiceDesk Plus | **Create Request \& Update Requests**: Enables file upload to requests. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.7
## **Incident Workspace Enhancements**
### **Incident Overview: Quick Access Pane**
To improve user experience, we are introducing the quick access pane - a faster way of traversing the dashboard located on the right side of the dashboard. You can leap to different sections within the Overview such as Event Summary, Your Pending Tasks, and Tactics \& Techniques.
### **Incident Form Editor**
Due to the changes in the quick access panel UI, the Incident Form Editor has also been modified when editing the incident overview.
## **Playbook Enhancements**
### **Playbook Tasks: Auto Retry on Error Setting**
The new "Auto-Retry on Error" function within playbook tasks ensures continued playbook operations by automatically retrying failed tasks. This minimizes the need for manual re-runs and keeps your security workflows moving smoothly. After enabling auto-run, you have the following options to configure for the auto-retry on the error option:
* **Automatic Retries**: Set the playbook to retry a task up to 5 times if it fails.
* **Customizable Delays**: Define specific intervals between retries, with options for seconds, minutes, or hours.
## **Reporting Dashboard Enhancements**
### **New Widget: Table**
With our latest update, the Table Widget has been introduced to enrich your reporting dashboard capabilities. This widget allows for the data to be displayed in a structured table format, offering you the flexibility to customize your view by adding or removing columns according to the fields queried. Due to access control limitations, the Table Widget is not compatible with the email scheduler feature for sharing purposes.
## **Data Ingestion Enhancements**
### **Data Reacquire Option to Prevent Missed Ingestion Data**
The Data Reacquire option automatically schedules a task to re-fetch data after a scheduled task finishes, to be executed at a future time (e.g., 30 or 120 minutes later), ensuring data completeness. It can be enabled through a checkbox on the schedule configuration page. This option, doubling the request count, is recommended for system integrations to capture data not collected by the REST API within the first minute after creation.
## **Utility Command Enhancements**
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
| **Commands** | **Functionality** |
|-----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Create a PDF File from Input HTML | Creates a PDF file from an HTML text input. |
| Create Incident With Conditions | Improves event data processing by allowing concurrent task execution and reducing ingestion job times. Configured as the last task in an event playbook, it handles incident creation and escalation sequentially and atomically after the playbook runs, preventing duplicate incidents. This command streamlines the event-to-incident process efficiently. |
| Test Search Conditions for Creating Incidents | Find incidents that match the specified search criteria and organize the results by the date and time each incident was created, listing them from earliest to latest. Use this command to verify that the input search conditions are correct for the **Create Incident With Conditions** command. |
## **Integrations**
### **Marketplace Home Page**
We are excited to launch the first stage of our Integration Marketplace---the new cards UI. The redesigned integrations page provides a clear and concise overview of your integrations with immediate insights into their connection status and available actions. It's the first milestone in our roadmap towards a fully-featured Integration Marketplace, with many enhancements planned for the near future. Stay tuned for more updates as we continue to expand and refine your integration management experience.
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
| **Integration Name** | **Description** |
|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| HYAS Insight | HYAS Insight is a comprehensive threat intelligence and attribution tool that aids organizations in identifying and understanding cyber threats. It provides detailed insights into the infrastructure and methods used by attackers, enabling faster and more accurate threat detection and response. The platform stands out for its ability to trace and attribute attacks back to their source, offering a critical edge in combating cybercrime. |
| HYAS Protect | HYAS Protect is a cybersecurity solution designed to offer proactive defense against digital threats. It utilizes advanced intelligence gathering and analysis techniques to identify and block malicious activities, safeguarding networks and data from cyber attacks. This system is known for its capability to detect threats before they cause harm, ensuring a high level of security for its users. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
| **Integration Name** | **Changes** |
|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Microsoft Entra ID | The **Reset Password** command's email notification modified with the following changes: * Updating the email subtitle to "Microsoft Entra ID (formerly Azure Active Directory) Account - {userId} Password Reset." * Enriching the email body with additional details in addition to the new password |
| VirusTotal v3 | New command: **Retrieve Widget HTML Content** |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.8
## **Application Setting Enhancement**
### **New Setting: Login Authentication**
To improve user experience, we are introducing Login Authentication - which configures login authentication for users and sites. Users can implement their own Identity Management platforms by clicking**+ New Certificate** under the Certificate tab. The default login method will apply to all users and sites unless specified otherwise. To customize settings for specific users and sites, utilize the Site and User tabs.
Currently, four types of Login Methods are supported:
* General Authentication
* SAML- ADFS
* SAML OKTA
* SAML Azure
* SSO-MSAD
## **Integrations**
### **Update To Connection Parameters**
Verify and revise all tooltips associated with the connection parameters.
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| Microsoft Teams Bot | New command: **Reply Channel Message** **Send Activity**: Modified command output. Changes could be implemented as a workaround to mention channels. |
| Okta | **List Users**: Add an optional parameter to get user roles. |
| Carbon Black | **Fetch Event**: Enhance the field mapping to allow for mapping multiple observations in the event summary. |
| Tenable Security Center | **Query Vulnerability Details**: * Add optional parameter - Vulnerability Status. * Update the Severity parameter to minimum Severity, providing the severity range from specific severity to critical. * Update the Plug IDs parameter. If the input value is a text array, D3 will automatically convert it to a number array. **Run Vulnerability Query By Query ID** * Update the data type of the key field **PlugID**from text array to number array. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.8.351.17
## **New General Features**
### **Configuration Home Dashboard**
-20241126-010116.png?cb=35a54143505d5f1b2166228f6ef21316)
The home dashboard within the Configuration module provides an intuitive interface to help new users familiarize themselves with the platform. This dashboard serves as a quick-access hub for configuring essential components of the system. From this central location, users can perform on-the-spot actions such as adding incident playbooks, while other options direct users to the relevant sections for configuration tasks.
### **Read Only License**
D3 is introducing a new license type: **Read-Only License**. This license type is tracked separately from other licenses and provides restricted access capabilities.
Key Features of Read-Only License
* **Read-Only License Tracking**: These licenses are tracked independently from other license types.
* **View-Only Permissions**: Users with a Read-Only License can only view data and are not permitted to modify it.
Setting Up Read-Only Roles and Assigning Users
1. Navigate to **Configuration** \> **Organization Management** \> **Roles** , then click on the %204-20250505-183729.png?cb=58841a85af0aa8806f6e9099a6d5efcf) button.
-20250505-183246.png?cb=4c6878cd0961db2a75e413972ace0646)
2. Assign a name to the read-only role, set the access type to **ReadOnly** , select the operation modules to grant access, then click on the %202-20250505-184314.png?cb=2f3a66fbd6710c85f1543826fd9685e8) button.
-20250505-184040.png?cb=a2f54e6cf8c2c837ebe569b9b660551d)
3. Select one or more users to assign to this role, click on the %201-20250505-185657.png?cb=848a374d736b0e8a33940f3f87cc3c70) button, then click on the %202-20250505-184314.png?cb=2f3a66fbd6710c85f1543826fd9685e8) button.
-20250505-185408.png?cb=914f0f26707e736e2bb05b194266c75c)
4. Verify that the assigned user(s) are added and marked as active.
-20250505-190231.png?cb=dc7dd66034b5fe2b9ceba9caa0313509)
Modules Accessible Under the Read-Only License
1. **Investigation Dashboard**
-20241127-004922.png?cb=93e3885bf61c143ce07697fc7495b00d)
* **Event** (Not controlled by Role Token. Always read-only)
* **Incident View** (Controlled by Role Token)
* **Pending Task** (Controlled by Incident View Role Token).
* **Playbook Error**(Controlled by Incident View Role Token)
2. **Reporting** (Controlled by Reporting View Role Token)
-20241127-004400.png?cb=31cdc2e32035b6707fa83619f0b01fda)
3. **Monitor** (Controlled by Reporting View Role Token).
-20241127-004604.png?cb=1a4a82e7410796eff815707b6f4642a8)
4. **Global Navigation Bar**
-20241127-000130.png?cb=e0c8dbeede078dd01527cb2fe5c169c6)
* **New Incident**: Hidden
* **Chat**: Hidden.
## **Enhancements**
### **Interaction Task**
-20241127-192943.png?cb=77f90835021a20b4903b174b586c7c32)
Interactive Tasks have been enhanced beyond basic input options. With the new Question Builder UI, Interactive Tasks now support more input types, including booleans, JSON, numbers, date, time, and combined date and time fields. An additional Reply Channel dropdown gives users the option to send a reply URL to an email, enabling inputs and submissions to complete Interactive Tasks via an external channel.
Previous Question Builder
**Interaction Task Question Builder**
HTML Text Radio Buttons Dropdown menu Checkboxes Read-only Text
%201-20241127-182223.png?cb=79e6eda6c8b8d4a571198eac87b9a0e9) New UI and Features
**Reply Channel**
-20241127-194117.png?cb=9631c7bb5e9111f090795a7e75b17cd9)
* **Reply in Pending Task**: Inputs and submissions are performed within the Interaction Task Details.
* **Reply in Email** (new): Inputs and submissions are performed through an external link.
-20241127-195902.png?cb=11257970861f5a1c6ed5c1f0f8f3dc67)
-20241127-195506.png?cb=eac5abd9853b9f439bafe667e51d5227)
**Interaction Task Question Builder UI**
-20241127-200359.png?cb=3eb69008f739f62a8508db3a0b9ec026)
* A Read-Only toggle is now available for all question types, replacing the previous Readonly text question type.
* The Read-Only toggle and the Required toggle cannot be enabled simultaneously.
* Question order can be rearranged by hovering over the -20241127-200850.png?cb=81f38936ff20cc00bf9ba6affae97a60) icon and dragging it to the desired position relative to other questions.
**Playbook Task Details**
Checkboxes RADIO BUTTONS BOOLEAN DROPDOWN MENU
-20241127-193704.png?cb=d28ba043395d488c5788091323eb4192)
JSON
-20241127-193727.png?cb=9f8471a22f2341e5242b38e25f034812)
NUMBER DATE Time date and Time
-20241127-193912.png?cb=12f1f85d696dc7c3ad92f56e79b6f429)
### **Sample Data Copy Button**
-20241127-015602.png?cb=12c786f656e7af8358ee99ead6d88246)
Sample input and output data across D3 can now be easily copied using the new copy button, making it more convenient for users to work with examples. This feature streamlines the process of replicating sample data into workflows, reduces manual effort, and minimizes errors when reusing data.
### **Built-In Artifact Types**
-20241127-021330.png?cb=e095bf3589779c6a40dafa77bde8663b)
There is now a comprehensive view of all [**artifact types**](https://docs.d3security.com/user-docs/16.8/artifacts#Built-In-Artifact-Types), including both built-in and custom. Built-in artifact types are displayed with distinct visual indicators and cannot be edited. The read-only display for built-in types safeguards essential data from unintended changes, while preserving the familiar UI to ensure a consistent user experience.
### **Tooltips for Enhanced Data Visibility**
-20241127-030135.png?cb=58f5e345b7de2ded09968d49fddd69f4)
A tooltip now appears when table cell values are cut off due to limited horizontal space. This enhancement ensures that users can view the full content of each cell without needing to manually remove columns.
## **Integrations**
### **New Integrations**
|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Palo Alto Networks PAN-OS | Facilitates the management of both Palo Alto Networks Firewall and Palo Alto Networks Panorama. |
| Exabeam Security Operations Platform | Provides advanced SIEM capabilities powered by scalable security log management, behavioral analytics, and automated threat detection, investigation, and response (TDIR). |
| Barracuda Web Application Firewall | Protects applications, APIs, and mobile app backends against a variety of attacks including the OWASP Top 10, zero-day threats, data leakage, and application-layer denial of service (DoS) attacks. By combining signature-based policies and positive security with robust anomaly-detection capabilities, Barracuda Web Application Firewall can defeat today's most sophisticated attacks targeting web applications. |
| Wiz | A unified cloud security platform designed for both cloud security and development teams, offering capabilities for prevention, active detection and response. |
| Proofpoint Protection Server | An email security gateway that protects organizations from spam, phishing attacks, and malware threats. With filtering techniques and real-time threat detection, providing comprehensive protection for email communication. This integration can be used to manage your email security gateway appliance. |
| Duo Admin | Enables organizations to read their Duo account's authentication logs and administrator logs as well as read or update account settings. To use this integration, access to the Duo Admin API is required. |
| SentinelOne Singularity Operations Center | A comprehensive cybersecurity platform designed to deliver unified prevention, detection, and response across a security estate. It streamlines modern endpoint, cloud, and identity protection through a centralized, autonomous solution tailored for enterprise security. The platform leverages advanced static and behavioral AI to enable machine-speed threat detection and response, empowering endpoints and workloads, regardless of their location or connectivity, to act intelligently against cyber threats. |
### **Updated Integrations**
|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| VirusTotal v3 | Check IP reputation, Check file reputation, Check URL reputation commands now execute successfully when the queried IP, URL, or file hash is not found in VirusTotal, clearly indicating the item's absence. |
| Rapid7 InsightVM | **New Commands**: * Get Asset Tags * Assign Asset Tags * Remove Asset Tags * List Tags **Connection**: Introduced an optional connection parameter, 2FA Token, to enable support for two-factor authentication. |
## **Utility Commands**
### **New Utility Commands**
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Modify Incident Form | Modifies the incident forms by either adding or deleting a section. |
| Get Site Connections | Retrieves a list of all configured connections for a specified site. The resulting list can be used for tasks such as dynamically selecting a connection name or managing scenarios with multiple connections, allowing for the retrieval of specific information for each connection. |
### **Updated Utility Commands**
|------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| Dismiss Event After Creation | A new input parameter, Reason Code, has been introduced to clarify the reason for event dismissal. The available options are: None, False Positive, Testing, and Duplicated. |
| Set Incident Notes HTML | Updated the command to prevent adding a new note when its content is identical to the previous one. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.0
## **Reporting Dashboard Revamp**
The **Reporting \& Analytics** dashboard module has been completely revamped as the **Reporting Dashboard**, with a new user interface and new functionalities. The new reporting features offer personalized dashboards to security executives and managers to visualize and monitor their Key Performance Indicators (KPIs) in real time.
This module comprises two main parts: Widgets and Dashboards.
**Widgets** provide visual representations of data extracted from four sources: Artifact, Event, Global List, and Incident. You can create queries using the query builder to extract data from these sources and select specific time ranges and sites to display within the widget. Once created, these widgets can be added to Dashboards.
**Dashboards** are collections of widgets that can be tailored to meet different reporting needs, including KPI monitoring, SLA monitoring, and SOC team management. The dashboard view can also be filtered by sites and time range and exported as PNG.
In addition, you can use the email scheduler feature to automate the sharing of dashboards, by conveniently scheduling one-time or recurring emails to recipients. Recipients receive a viewable link in the email, providing easy access to the interactive dashboard without requiring additional logins, facilitating streamlined communication and data-driven decision-making.
## **MSSP Client Access Portal**
The MSSP (Managed Security Service Provides) client portal is an innovative addition enhancing communication, visibility, and collaboration between MSSPs and their clients.
**Once the MSSP client portal license is purchased and activated**, MSSPs can create user accounts with customized roles specifically designed for their clients. These roles, configured with the "Client" access type, provide MSSP clients with limited access to the SOAR platform, including the investigation dashboard and reporting dashboard. Here are some highlighted key features:
* **Incident Review**: Clients can view incidents and events from the investigation dashboard, allowing them to view summarized and in-depth incident details.
* **Interaction Capabilities**: Clients can take limited actions, such as running ad hoc commands and responding to pending tasks that require SLA approvals.
* **Messaging**: MSSPs can improve response times and promote collaboration by using the portal to communicate with their clients and request approvals via the message center.
* **Reporting and Analytics Dashboard**: MSSPs can curate reports and data visualizations to provide clients with valuable insights into their security operations.
* **Investigations Tab**: Clients can view insights on each incident curated by the MSSP, organized by Summary, Findings, Mitigations, and Recommendations.
The client portal serves as a centralized hub, consolidating all necessary functionalities for efficient and effective collaboration. It empowers MSSPs and their clients to seamlessly interact, share information, and work together towards their security goals.
## **Incident Workspace Enhancement**
### **Key Fields**
The **Incident Summary** section within the **Overview Tab** has been renamed to **Key Fields** , allowing for the inclusion of custom fields. Just like the previous **Incident Summary** section, **Key Fields** displays and allows you to edit the default incident fields filled in by an analyst or playbook during the event escalation or incident intake process. The notable enhancement is the introduction of the **Custom Fields** section, which provides flexibility in field mapping. Previously, these fields were limited to a predetermined set of system fields.
### **Your Pending Tasks**
The **Your Pending Tasks**section provides an overview of your top six most urgent ad-hoc tasks and playbook tasks related to the selected incident. This section will only display tasks assigned to you.
The tasks are organized based on their due dates. From left to right, these tasks are colour-coded based on urgency, with red indicating the tasks past their due dates, followed by yellow for tasks due within one hour. Tasks without a coloured stripe are those with deadlines further in the future or no deadline. Tasks with a required tag must be completed before an incident can be closed, while suggested playbook tasks need your input to run or skip the task. Clicking on a task will bring up the full task details.
### **Investigations Tab**
The **Investigations Tab** is a brand new tab added to Incident Workspace.
This tab is a centralized location designed for analysts to input and manage investigation information related to an incident. It consists of four sections: **Summary** , **Findings** , **Remediations \& Mitigations** , and **Recommendations** . Analysts can input incident investigation information to the appropriate sections by using JSON-defined data tables or HTML, allowing them to record details such as notes, findings, and recommendations. The **Findings** section is further divided into subsections for **Initial Findings** , **Data Enrichments** , **Data Correlations** , **Indicators of Attack (IOA)** , and **Indicators of Compromise (IOC)**. Analysts can manually input information through the user interface or use utility commands in playbooks for automated data population, saving time and ensuring accurate capture of critical details.
Two new utility commands are available to help automate populating the investigation sections.
### **Export Incident Report Enhancement**
The incident template has been revised to match the updated and new components of the Incident Workspace. These revisions apply to both the exported templates in Microsoft Word and PDF formats.
### **Incident Messaging**
Incident messaging allows SOC analysts to communicate about investigations, and for MSSPs to collaborate with clients. New features include mentioning and direct messaging, requesting approval, and Slack integration. Plans for integration with other messaging services are in development for future releases.
## **Data Ingestion**
### **MITRE TTP Search and Event Automation Rules Settings**
Upon configuring a new data source across different components in D3 SOAR, such as API Keys, JWT, Data Ingestion, Schedule, Upload File (from the Investigation Dashboard), and Ongoing Surveillance Task, two checkboxes will appear that allow you to customize the behaviour of ingested events. The first checkbox enables the automatic mapping of ingested events from the data source to MITRE tactics and techniques. The second checkbox enables event automation rules for event dismissal and escalation.
## **JWT Authentication**
JSON Web Token (JWT) is an open and widely accepted industry standard, defined in RFC 7519. They provide a secure and efficient way of transferring claims between two parties, ensuring the authenticity and integrity of the data. JWTs can now be used to authenticate data ingestion and remote commands via webhook in D3 SOAR. Additionally, token creators have the ability to reassign, regenerate, rename, and delete tokens as needed.
To enable JWT authentication in D3 SOAR, navigate to **Configuration** \> **Application Settings** \> **Web Config** , and set the value of the **"EnableEnhanceWebhookAuthentication"** configuration key to True.
## **IOA/IOC Link Analysis**
The **IOA/IOC Link Analysis** tab under the Investigation Dashboard visualizes the relationships between indicators of attack (IOAs) and indicators of compromise (IOCs) from events and incidents. You can view analyses from the past 7 or 30 days to gather historical attack patterns. Each node represents an artifact entity, coloured red (IOA), yellow (IOC), or both. Arrows show the direction of the labelled relationship. Clicking on a node reveals more information, and the "Add Investigation Details" command lets users define artifact relationships for automated link analysis.
## **Incident Playbook Enhancements**
### **Trigger: On Incident External Action**
The **On Incident External Action**trigger in incident playbooks combines external action data with raw incident data, allowing users to perform a comprehensive investigation on an incident using a defined playbook workflow. By ingesting events through the D3 API with a unique key, multiple requests with the same key ID are aggregated into a single incident. This trigger feature enables users to initiate additional workflows for investigating a specific incident without the need to log into D3 SOAR directly.
## **Utility Commands Enhancements**
The following utility commands have been added to this release of D3 SOAR.
|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Add Investigation Details | Adds investigation details in HTML rich text to the sections in the Investigation Tab. |
| Add Investigation Table Content | Adds data tables defined in JSON format to the relevant Incident Workspace's Investigation Tab. You can use this utility command to populate any of the sections in the Investigation Tab, as well as highlight important key details. |
| Get Incident Static Field | Returns all static incident fields and corresponding values of the specified incident, which are shown in the overviewtab in Incident Workspace. |
| Get Related Incidents by Artifact | Searches for incidents related to the specified artifact(s). |
| Link Event To Incident | Searches for a pre-existing incident by applying a specific set of search conditions and updates the custom fields of the first identified incident that meets the search conditions. The corresponding event is also added to the same incident. If no matching incident is found, a new incident is created. |
| Set Incident Field HTML | Adds HTML content to a specified incident's description, note or conclusion, which is shown in the overviewtab in Incident Workspace. |
| Trigger Incident External Action | Activates the "On Incident External Action" trigger in incident playbooks for the first incident that matches the specified search conditions. |
### **Connections Module Enhancement**
The connections module now has a newly added **Webhook Keys** tab. This tab allows you to efficiently manage and view all the webhook keys you have created and are currently available for your account. This addition is especially beneficial for our MSSP (Managed Security Service Provider) users who need to manage webhook keys for various tenants and client sites. With the Webhook Keys tab, you can conveniently access and remove keys created from your account in a centralized location, streamlining your key management process.
## **Application Settings Enhancements**
### **Dashboard Columns**
With this new update, you can now easily manage the default and custom columns displayed in your investigation dashboard. When you add a new custom column, it will be automatically saved to the investigation dashboard. To enable or disable the column, simply click the "more" icon located on the top right corner of event and investigation lists.
### **Logo Customization**
You can now customize the branding of your incident reports and email approval pages to better reflect your company or MSSP's corporate identity.
By default, the incident report and send email templates are equipped with D3's logo. You can now upload your own logo to replace the default one. Additionally, you can also include your company URL in the header of the incident report. Every time an incident report is generated or an email approval page is sent, your logo will be prominently displayed, providing your team and clients with a consistent and professional brand experience.
## **Proxy Agent Update**
We have released a new version of the proxy agent along side D3 SOAR version 16.0. To ensure compatibility, please upgrade your proxy agent to version 16.0.18.0. For instructions on how to update a proxy agent, please refer to the Agent Management section in the user guide.
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|-------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| CrowdStrike Falcon Intelligence | Crowdstrike Falcon Intelligence enables organizations of all sizes to better understand the threats they face and improves the efficacy of their other security investments with actionable and customized intelligence to defend against future attacks, making proactive security a reality. |
| CrowdStrike Threat Graph | CrowdStrike Threat Graph is the brains behind the Falcon cloud-native platform. The CrowdStrike Security Cloud leverages Threat Graph to correlate trillions of security events per day with indicators of attack, threat intelligence and enterprise telemetry from across customer endpoints, workloads, identities, DevOps, IT assets and configurations. The CrowdStrike Security Cloud creates actionable data, identifies shifts in adversarial tactics, and maps tradecraft in the patented Threat Graph to automatically prevent threats in real-time across CrowdStrike's global customer base. |
| CyberInt | Cyberint, the Impactful Intelligence company, fuses threat intelligence with attack surface management, providing organizations with extensive integrated visibility into their external risk exposure. Leveraging autonomous discovery of all external-facing assets, coupled with open, deep \& dark web intelligence, the solution allows cybersecurity teams to uncover their most relevant known and unknown digital risks - earlier. |
| D3 Tool Kit | D3 toolkit is a collection of software development tools and resources that help developers increase their productivity and efficiency, improve the quality of their applications, facilitate collaboration among team members, and stay up-to-date with the latest technologies and trends in software development. |
| Kaspersky Security Center OpenAPI | Kaspersky Security Center takes the complexity out of security administration and IT systems management. The API is for controlling Kaspersky Security Center administration tools. It also allows integration with the ability to periodically retrieve detailed information about events. |
| Microsoft 365 Defender (Email \& collaboration) | Microsoft 365 Defender, part of Microsoft's XDR solution, leverages the Microsoft 365 security portfolio to automatically analyze threat data across domains, building a complete picture of each attack in a single dashboard. This integration allows organizations to fetch security incidents, update security incidents and run advanced hunting queries to inspect unusual activity, detect possible threats, and even respond to attacks. D3's integration for Microsoft 365 Defender (Email \& collaboration) is using Exchange Online PowerShell to provide the operation on the Tenant Allow/Block list, which allows the user to Allow/Block email addresses, domains, URLs, and files. |
| Recorded Future - SecurityTrails | SecurityTrails is a total inventory that curates comprehensive domain and IP address data for users and applications that demand clarity. By combining current and historical data of all Internet assets, SecurityTrails is the proven solution for 3rd-party risk assessment, attack surface reduction and threat hunting. This integration enables organizations to query risk issues and correlate domain and IP address data for risk assessment and threat hunting. |
| Screenshot Machine | The Screenshot Machine is explicitly built to capture a full-page screen or small website thumbnail or to create a PDF from web pages online. |
| Sevco | Sevco is an Asset Intelligence platform to aggregate inventory of users and devices and the relationships between them and monitor the changes over time. This product is a newly identified Cybersecurity Asset Attack Surface Management (CAASM) as an emerging technology focused on enabling security teams to solve persistent asset visibility and vulnerability challenges. |
| Sucuri SiteCheck | Sucuri SiteCheck scanner remotely checks any URL for security threats, malware, defacements, out-of-date CMS, blacklisting, and other important security issues. It visits a website like an everyday user would to verify the source code for malicious behaviour or security anomalies. |
| unshorten.me | Unshorten.me is a free service to Un-Shorten the URLs created by URL shortening services. Unshorten.me can un-shorten URLs created by different services like goo.gl (Google), fb.me (Facebook), t.co (Twitter), bit.ly, TinyURL, ow.ly, among others. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| AlienVault OTX | Converted all existing C# commands to Python |
| Atlassian Jira Service Management | Enhanced user interface for authenticating connections. |
| Atlassian Jira Software | New commands: **List Fields** , **Get Account IDs** **Create Issue** \& **Edit Issue**: Added support for adding and updating custom fields **Assign** **Issue to User** \& **Edit Issue** : Enhanced to support Markdown for the parameters **Description** , **Summary** , and **Custom Fields**. **Add Comment to Issues** : Enhanced to support Markdown for the **Comment** parameter. Converted eight existing C# commands to Python: **List Projects** , **Add Comment To Issues** , **Create Issue** , **Delete Issues** , **Get Comment From Issues** , **Get Create Meta** , **Search Issues** , **Upload File To Issue** |
| BrightCloud Threat Intelligence | New command: **Check File Reputation** |
| Checkpoint Firewall | New commands: **Show Application Site Categories** ,**Block Domains, Show Policy Packages** ,**Block URLs** ,**Discard Changes** ,**Show Changes** ,**Install Policy** , **Show Sessions** |
| Cisco Adaptive Security Appliance | Updated all commands to support SSH connections |
| Cofense Vision | New commands: **Search** , **Get Search Result** , **Get Attachment** |
| CrowdStrike | New commands: **Search Vulnerable Hosts By CVE** , **List Vulnerabilities** , **Get Host Vulnerabilities** , **Get Vulnerability Details** , **Get Vulnerability Evaluation Details** Converted eight existing C# commands to Python: **Fetch Event** , **Download Files, Find Hosts, Find IOC Observed Host, Isolate Host, Resolve Detection, Upload RealTime Response Script, Execute Command On Single Endpoint(Deprecated)** |
| CrowdStrike Discover | New commands: **List Assets, List Accounts, List Logins** |
| Darktrace | New commands: **Get Device Info, Get Device Summary, List PCAPs, Create PCAP, Get Status, Tag Devices, Get Device Tags, List Actions, Create Actions, List Tags** **Acknowledge** \& **Unacknowledge:** Updated to remove key field results, which previously caused an error message to return. |
| Kenna Security | New commands: **Test Connection** , **Search Assets** , **listApplications** |
| KnowBe4 PhishER | Added the headers "User-Agent" and "X-KB4-Integration" for all commands, with the values being "KnowBe4/1.0/{Command Display Name}" and "Acme Integration" respectively. |
| Maltiverse | **Check File Reputation**: Added support for MD5, SHA-1, SHA-512 hashes. |
| Microsoft 365 Defender | New command: **Fetch Event** |
| Microsoft Purview Audit Logs Activities | **Get Audit Log**: Added the "User Principal Name" parameter to allow for filtering retrieved logs by user principal name. |
| Microsoft Sentinel | **Fetch Event** : The string representation of **$.value\[\].alertDetails\[\].entities** is converted into a JSON array and assigned to the **$.value\[\].alertDetails\[\].entities_json**property. **Update Incident Status**: Added an input parameter and a corresponding key field named "Close Comment" to input an incident close comment using the command. **Fetch Incident**: Added the "Update Field Mappings" parameter to support bi-directional syncing of incident data in D3 SOAR. |
| Microsoft Teams | New command: **Send Message V2** |
| OpenCTI | New commands: **List Connectors** , **Add Observable** , **List Observables** |
| Palo Alto Networks Firewall | New command: **Retrieve Logs** |
| Proofpoint Targeted Attack Protection | New command: **Get Threat Details** |
| Rapid7 InsightVM Cloud | New commands: **Search Asset** ,**Search Vulnerability** ,**Get Asset by ID** |
| Splunk v2 | New commands: **Upload Files** ,**Start Search** ,**Get Search Status** ,**Get Search Result** Updated commands: **Fetch Event** , **Get Recent Notable Events** , **Search** **Fetch Event**: Added support for fetching notable events. All field mappings have been updated accordingly to support this change. **Submit Event**: Enhanced to allow an event to be created with an event JSON object. **Search** \& **Get Recent Notable Events**: Updated to trigger a 2-step API call, initiating a search using startSearch and retrieving results using getResult to obtain events. **Search**: Enhanced to handle more flexible search statements, including tstats. Converted all existing C# commands to Python |
| Trend Micro Cloud One | Added the "User-Agent" header with the value "TrendMicroCloudOne-D3-Integration-v1" to each command sent, providing identification and information about the integration making the request. |
| VirusTotal v3 | **Get IP Report** \&**Get Domain Report**: Enhanced to parse and convert WHOIS data retrieved from the path $.data.attributes.whois into JSON format, displaying it under the field $.data.attributes.whois_json. This change is only applicable for raw data and context data outputs. |
### **Deprecated Integration Commands**
The following integrations have been deprecated in this release of D3 SOAR.
|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Deprecated Commands** |
| AlienVault OTX | Get Pulse Details Search Pulses Check IP Reputation Get Domain Information Get URL Information Get File Information |
| Azure Active Directory | Get Managed Device List Managed Devices |
| CrowdStrike | Execute Command On Single Endpoint |
| Microsoft Exchange Server | Block Email Fetch Event Search Email Remove Email |
| Google Chronicle Search API | Fetch Event by Rule Run Rule Get Operation Status Update Rule Get Rules Results Get Rules Create Rule |
| Google Cloud PubSub | Fetch Event |
| iZOOLogic | List Authorised Executives List Clients Fetch Event List Brands |
| MongoDB | Create DB |
| Recorded Future | Check IP Reputation |
| Sophos Central | Fetch Event |
| Trend Micro Cloud One | Remove Domain Entries From Permit List Add Domains To Permit List Create Domain Filter Configuration List Domain Policy Configurations Distribute Permit List And Domain Filter To Appliances Update Domain Filter Config Status |
| VirusTotal v3 | Get Sigma Analysis Reports |
| Zendesk | Add User Fetch Event |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.1
## **Global User Indicator**
The user icon in the upper right corner has been replaced with an icon that indicates the user's initials. This provides a convenient reference point for administrators who are managing multiple accounts, roles, and sites, allowing them to quickly identify the logged-in user.
## **Reporting Dashboard Enhancement**
### **Drill Down Details Popup**
We have improved the widget details viewing experience in the **Reporting Dashboard** module. Instead of being redirected to a new page, a popup now appears with additional details when clicking into a widget. This change ensures a smoother workflow and eliminates the need to leave the dashboard module.
## **Investigation Dashboard Enhancement**
### **New Column for Events: Event Playbook**
A new column has been added to the events dashboard to provide visibility into the specific event playbook applied to each event, streamlining event management and enabling improved incident analysis for more effective security response and compliance auditing.
## Incident Workspace Enhancement
### **Editing History for Incident Notes**
The **Notes** section in the **Overview Tab** has been enhanced to include a comprehensive edit history for incident notes. Whenever a note is edited, an "Edited" link will be displayed, allowing you to access the complete edit history with a single click. Additionally, the incident note edit history is also viewable in the incident's **Command Centre.**
This serves to enhance accountability, collaboration, and documentation by effectively tracking and displaying all modifications made to incident notes. It facilitates auditing processes, ensuring transparency and thoroughness in recording and reviewing changes.
### **New Column for the Events Tab: Event Playbook**
A new column has been added to the **Events Tab** to provide visibility into the specific event playbook applied to the incident's events.
### Collapsible Sections in Overview Tab
In the **Overview Tab** , the **Events Summary** , **Investigation Team** , **Linked Incidents** , **Files** , **Notes**, and custom incident form sections are collapsible. Sections are collapsed by default if they contain no data.
## **Data Ingestion**
### **New Additional Settings for Webhook: JSON Path and Global List for Site Mapping (Shared to All Client Sites)**
Two parameters under **Additional Settings** have been added for webhook data ingestion under **Shared to All Client Sites**:
**JSON Path for Site**: An optional parameter that allows you to specify the JSON path containing site information in the retrieved data. By specifying the JSON path, you can directly extract the site name or ID from the retrieved data.
**Global List for Site Mapping** : An optional parameter that works in conjunction with the **JSON Path for Site** parameter. It selects a global list that maps field values from the JSON path to their corresponding site names. Based on the specified global list, data is ingested into the correct site by matching the extracted value from the JSON path with the appropriate site name.
For Managed Service Providers (MSSPs) managing multiple client sites, these settings can offer some key benefits:
1. **Streamlined Management**: MSSPs can manage all client sites with a single webhook URL, reducing setup complexity.
2. **Efficient Data Handling**: With global list site mapping, data is automatically segregated and ingested into the correct site, increasing efficiency and reducing errors.
3. **Reduced Maintenance and Enhanced Scalability**: Fewer webhook URLs means less maintenance, and adding new client sites as simple as updating the global list.
4. **Improved Security**: Automatic data ingestion mitigates the risk of data spillage between client sites.
### **New Additional Setting for Schedule: Schedule Job Tolerance (Minutes)**
The **Schedule Job Tolerance Scope** parameter has been added to the data ingestion schedule configuration page. This sets how many minutes data can be ingested before or after the specified start and end time, so that no data is lost. The data will start being ingested from the time that is {Start Time - Tolerance Scope}. The schedule job tolerance scope is calculated separately and does not change any **Tolerance Scope** command parameters.
### **New Additional Setting for Schedule \& Webhook: Run Playbook Sequentially**
You can enable the **Run Playbook Sequentially** option if you select an event playbook in **Additional Settings** while setting up a data ingestion schedule or webhook. It enables the sequential processing of event playbooks for datasets containing multiple alerts. This enhances the correlation between events and incidents by ensuring that alerts are processed in a specific order, resulting in a more streamlined event and incident correlation process.
## **Playbook Editor Enhancement**
### **Select Connection by Category**
When setting up integration command connections, this newly added option is primarily intended for Managed Security Service Provider (MSSP) playbooks and D3's out-of-the-box playbooks. These often include a codeless playbook nested within them that contains parallel command tasks of different integrations from the same category, such as "Check IP Reputation".
The key function of this feature is to allow the playbook to execute only those parallel tasks that share a common connection name, contingent upon whether the integration for these tasks has a valid connection with the common name in your SOAR environment. Tasks without valid connections will remain in an "N/A" state and will not produce errors. This increases the playbook's adaptability and its capability to manage connections that are not available.
Additionally, the **Dynamically Select Connection** feature allows the insertion of additional Jinja logic to accommodate a variety of use cases. One typical example is the mapping of different client sites to distinct connection names.
## **Utility Command Enhancement**
### **Link Artifacts Related Incidents**
The **Link Artifacts Related Incidents** command has been redesigned with input parameters to let you fine tune the incident-artifact correlation logic. The configurable input parameters include:
1. **Artifacts Types**: You now have the ability to filter correlated artifacts based on specific artifact types.
2. **Artifact Names**: Correlate incidents using specific artifact names.
3. **Incident Link Criteria**: Decide how you'd like to link your artifacts - whether through partial or full matches based on specified criteria.
4. **Incident Sites**: Define the scope of your search for related incidents by specifying sites. The system will search within the list of sites you provide, whether they're internal or client-specific. If no specific sites are mentioned, the system defaults to searching where the incident occurred.
5. **Incident Status** : Filter your artifact correlations based on the status of the incidents. Options include **Open** , **Closed** , **In Progress** , and **On Hold**.
6. **Incident Time Range**: Define a time range to search for incidents, based on their creation date.
7. **Limit**: Set a limit on the number of linked incidents. If the limit is not specified or exceeds 50, the system will default to linking a maximum of 50 incidents that fit the specified criteria.
8. **Order**: Determine the order in which your incidents link - ascending or descending. By default, the system links incidents in descending order, starting with the most recent.
The utility command has multiple use cases. It can help identify and link incidents involving newly discovered threat artifacts, aiding in threat identification and enhancing cyber defense. It can also be used to connect incidents with similar threat artifacts, enabling more informed incident response strategies, and to identify recurring threats for proactive security measures.
## **Organization Management Enhancement**
### **Roles: Edit Closed Incident Permission**
An option that allows you to set a time range for **Re-open Closed Incident** has been added under the **Edit Incident** permission settings when configuring **Roles** . System administrators have the option to choose between two settings when it comes to reopening closed incidents: "**Always** " or "**Within a specified number of days after each closure of Incident**".
## **Proxy Agent Update**
We have released a new version of the proxy agent alongside D3 SOAR version 16.1. To ensure compatibility, please upgrade your proxy agent to version 16.1. For instructions on how to update a proxy agent, please refer to the Agent Management section in the user guide.
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Devo Alerts | Devo SIEM is a cloud-based data logging and security analytics platform designed to improve access to security data across an enterprise. Security teams have access to real-time and historical data to quickly respond to their organization's threat landscape. This integration allows organizations to query and manage alerts as well as other data sources. |
| EmailRep | EmailRep is a system of crawlers, scanners, and enrichment services that allow users to collect data on email addresses, domains, and internet personas. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| Kaspersky | New commands: **Get Execution File, Get Open Ports, List Execution Files** ,**Scan Quarantines Files** ,**Unquarantine Files** **List Host Tasks** : Added the **TaskNames** key field |
| Microsoft Purview Audit alert_v2 | This is an updated version of the Microsoft Purview Audit integration, incorporating all pre-existing commands. It is strongly recommended to use this enhanced version of the integration for optimal performance. **Fetch Event**: Updated to enable correlation between alertID and audit logs returned by the Management API. |
| Microsoft Teams | New commands: **List Chats** , **List Chat Messages** , **Send Chat Message** |
| MISP | New commands: **Add Object To Events** ,**Add Tags to Attributes** , **Add Tags to Events** ,**Fetch Event** ,**List Attribute Types \& Categories** ,**List Organizations** ,**List Tags, Remove Tags From Attributes** ,**Remove Tags From Events** ,**Search Events, Search Object Templates** ,**Search Tags** ,**Test Connection** Enhanced three checkReputation commands to the latest coding convention: **Check IP Reputation,** **Check FileReputation,** **Check URL Reputation**. Converted the following C# commands to Python: **Add Event,** **Edit Event** , **Publish Event**. **Search Attributes**: Updated the format of return data and enhanced error handling messaging. |
| OpenCTI | New commands: **Create Observable** ,**List Authors** ,**List External References** ,**List Labels** ,**List Markings** |
| Trend Micro Cloud One | New commands: **Add Firewall Rules To Computers** , **Add Firewall Rules To Policies** ,**Create Policy** ,**List Policy Default Settings** , **Modify Policy** ,**Remove Firewall Rules From Computers** ,**Remove Firewall Rules From Policies** ,**Search Computers** ,**Search Firewall Rules** ,**Search Policies** |
| Trend Micro Vision One | New command: **Get Endpoint Info** |
### **Deprecated Integration Commands**
The following integration commands have been deprecated in this release of D3 SOAR.
|-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Deprecated Commands** |
| Trend Micro Cloud One | Add Domains To Permit List Create Domain Filter Configuration Distribute Permit List And Domain Filter To Appliances List Domain Policy Configurations Remove Domains From Permit List Update Domain FilterConfigStatus |
#### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|---------------------------|---------------------------------------------------------|
| **Integration Name** | **Changes** |
| Twilio | Added new command "List SMS Messages" |
| Kaspersky Security Centre | New Commands "Get user by source IP", "Get Host Status" |
| Azure AD | "List Users" command enhancement |
| Microsoft Teams | Adaptive Card Enhancement |
| Microsoft 365 Defender | Fetch Incident Enhancement |
### **16.1.77.0**
Release date: 2023-07-24
#### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|----------------------|----------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| SentinelOne | Added new functionalities: Create a Power Query And Get QueryID Ping a Power Query If Results Haven't Been Retrieved |
| Fortigate | Command enhancement for BlockIP and BlockURL |
| JIRA | Fetch Event Command Enhancement: Add field for comments |
| Cisco ESA | Added new commands: Fetch Event Block domain Block email ID |
### **16.1.80.0**
Release date: 2023-07-25
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.2.136
## **Web Server Update Notice: .NET 4.8 Framework Required**
Starting with D3 SOAR version 16.2, hosting web servers must be compatible with the .NET 4.8 framework.
* **SaaS Clients**: No action is required on your part.
* **On-Premise Clients** : Ensure your hosting web server is updated to support the .NET 4.8 framework. Visit the [++.NET Framework 4.8 download page++](https://dotnet.microsoft.com/en-us/download/dotnet-framework/net48), then download and run the .NET 4.8 runtime installer on your server. If internet access is disabled for your server, visit [++Microsoft .NET Framework 4.8 offline installer for Windows page++](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-8-offline-installer-for-windows-9d23f658-3b97-68ab-d013-aa3c3e7495e0) for more information about the offline installer.
## **Reporting Dashboard Enhancements**
### **Reporting Dashboards and Widgets: Enhanced Permission Controls**
The permission controls have been enhanced for both widgets and dashboards, offering more precise access control. You now have two main ways to configure permissions:
* **By Site**: Assign permissions based on specific sites. Choose whether each site has viewer or editor permissions. Dive deeper by setting additional permissions by group and role within each site.
* **By User**: Allocate permissions directly at the user level. Specify whether an individual user has viewer or editor access.
#### **New Private Mode**
We've also introduced a Private Mode feature. When activated, only the original creator of a dashboard or widget will have the rights to view and edit it.
## **Widget Query Builder: Time-Based Filtering by Most Recent Hours**
We've updated the widget query builder to include a new time filter feature. You can now focus your queries on data from a minimum time frame of just 1 hour, up to a maximum of 999 hours, for customized, high-precision insights.
## **Incident Workspace Enhancements**
### **Investigation Tab: Fully Editable Sections**
All sections within the **Investigation Tab** can be directly edited from the user interface, including both HTML and JSON content. All edits are logged by the command center for auditing and traceability.
### **Overview Tab: Customizable Layouts by Incident Type**
The **Overview Tab** now allows for greater customization across different incident types. You can rearrange or toggle most sections---excluding **Key Fields** ---to fit your needs. For example, you can configure one layout for brute-force incidents and another for malware incidents. To modify these settings, go to **Configuration** \> **Incident Form Editor** and select the incident type you wish to customize.
## **Monitor Module Update**
In this update, we're introducing a change to the **Monitor** module's naming convention. When MITRE tactics are enabled within the module, it will now be displayed as **MITRE ATT\&CK Monitor** . Additionally, users who have roles designated with "Client" access permissions for the Managed Security Service Provider (MSSP) portal will now have the capability to view the **Monitor** module.
## **Playbook Task Details Enhancement**
### **Pending Playbook Tasks: Expandable HTML Input Fields**
We've improved the user experience for pending playbook tasks that require manual HTML input. For example, a playbook with the **Send Email** utility command prompts analysts to send a summary email to a client. HTML input fields are also common for **Interaction Tasks**. The input parameter box for such tasks is now expandable, making it easier to interact with.
You can view these playbook task details in the **Investigation Workspace** under both the **Playbook** and **Pending Task** tabs. Additionally, these details can be accessed directly within the playbook editor by clicking on the light bulb icon of a task after test running a playbook.
## **Application Settings Enhancement**
### **New Web Config Key: HideEventNodesOnLinkAnalysis**
We've added a new web config key within the application settings to help you declutter your **Link Analysis** view in the **Incident Workspace**. With this new option, you can now choose to hide event nodes.
## **Utility Commands**
The following utility commands have been added to this release of D3 SOAR.
|----------------------|---------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Add Incident Tags | Adds or overwrites incident tags of the specified incident. |
| Remove Incident Tags | Removes incident tags from the specified incident. |
| Get PDF File Content | Extracts all text and hyperlinked URLs from PDF files attached as Playbook Files, Artifact Files, or Incident Attachment Files. |
## **Integrations**
### **Deprecated Integration Commands**
The following integration commands have been deprecated in this release of D3 SOAR.
|----------------------|-----------------------------------------------------------------------------------------------------|
| **Integration Name** | **Deprecated Commands** |
| CrowdStrike Falcon X | All commands have been deprecated. Replaced by the **CrowdStrike Falcon Intelligence** integration. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.3.53
## **View Credentials While Editing**
In select areas within D3 SOAR where credential modifications are required, a visibility toggle icon (depicted as an eye icon) has been introduced to aid in password entry and verification. This feature has been deployed across various areas of the platform, as listed below:
* **Preferences**: Under the "Change Password" option.
* **Organization Management**: Navigate to "Users" then "Change Password."
* **Connections Module**: While creating or editing a connection.
* **Integration Configuration**: While creating or editing connection credential parameters and Password Vault connections.
* **Playbook Editor**: While creating or editing a connection within a command task with an integration command.
Please note that once a password has been saved, the eye icon will not be available when revisiting the credentials. To re-activate the visibility toggle, you must clear the existing password entries and re-input the passwords.
## **Utility Command Enhancement**
### **Correlate Events: Associated Incident Numbers Added to Output Context Data**
The updated **Correlate Events** utility command now returns incident numbers linked to the correlated event in the output **Context Data**. This is particularly useful when events have been escalated to incidents, and there's a need to consolidate multiple events into a single incident.
Previously, while correlated events could be grouped together, the corresponding incidents needed to be closed individually. With the inclusion of incident numbers alongside correlated events, you now have the ability to bulk-close related incidents with subsequent playbook tasks.
### **Enhanced Query Functionality in Event and Incident Management Utility Commands**
We have improved the **Search Condition**parameters for the following event and incident management utility commands:
* **Link Event to Incident**
* **Link to Related Event Incident**
* **Update Identical Event**
* **Trigger Incident External Action**
Previously, functionality of the **Search Condition** for event and incident queries was limited to exact matches on event or incident fields as demonstrated below.
JSON
{
"EventType": "aaa",
"__CustomField": "bbbb"
}
It does not extend support for more advanced query operations such as comparisons (greater than or less than), time range specifications, 'In' operator usage, or regular expression matching.
With the new enhancement, the **Search Condition** parameters now support a broader spectrum of query syntaxes and capabilities such as range queries, regex matching, and more. You can seamlessly filter incidents based on attributes like type, status, severity, or a specific date range, among other criteria.
For example:
JSON
{
"Type": "Phishing",
"Status":"Open",
"Severity": { "$in": ["Critical", "High"] },
"Title": { "$regex": "email", "$options": "i" }
}
Or
JSON
{
"CreatedUtcTime": {
"$gt": {
"$date": "2023-08-01T00:00:00Z"
},
"$lt": {
"$date": "2023-08-08T00:00:00Z"
}
},
"ExternalKey": { "$regex": "^Phishing" }
}
These examples show how the enhanced **Search Condition** parameters can be utilized with the new enhancements to precisely find your incident and event data to perform command actions.
### **Creating a File from Input Text Array: Added Support for HTML Files**
The **Create a File from Input Text Array** utility command has been enhanced to support HTML file generation using a text array input. To do this, simply select 'HTML' as the **Output Type** when configuring the command's input parameters.
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Fresh Service | Freshservice provides an intelligent, right-sized service management solution for modern businesses of all sizes. Freshservice does this by taking a fresh approach to building and delivering modern employee experiences and unified service management ---empowering businesses to achieve efficiency, fast time-to-value, and improved employee satisfaction and productivity. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|---------------------------|---------------------------------------|
| **Integration Name** | **Changes** |
| Microsoft Exchange Server | New command: **Parse Attached Email** |
---
version: "Morpheus Release Notes"
language: "en"
---
# 16.4.57
## **Application Settings Enhancement**
### **More Logo Customization Options**
With this new release, you can now personalize and reinforce your brand's presence across various elements of the application. Here's what's new:
**Application-Wide Logo Display** : Solidify your brand identity within D3 SOAR with a system-wide logo, prominently placed at the top-left corner of every page. To set this up, go to **Configuration** \> **Application Settings** \> **Logo Customization**.
**Site-Specific Logos for MSSPs** : Tailoring to the unique needs of Managed Service Security Providers (MSSPs), our update enables the display of distinct logos for each client managed by MSSPs. This customization extends across all client-specific interfaces and incident report templates, maintaining a cohesive brand image for each client's site. This can be configured at **Configuration** \> **Organization Management** \> **Sites.**
## **Incident Workspace Enhancements**
### **Updated UI Design**
We've refined the user interface of the Incident Workspace to deliver a sleeker, more uniform experience.
### **Incident Overview: Linked Artifacts**
We've introduced a new **Linked Artifacts** section in the Incident Overview tab for immediate visibility of all artifacts connected to the incident.
### **Incident Overview: Tabbed Dynamic Form Layout**
Dynamic forms within the Incident Overview tab are now efficiently organized into tabs within the **Dynamic Form** section. This consolidation provides a more orderly representation of incident-related forms, eliminating the need for separate sections for each form.
## **Playbook Enhancements**
### **Conditional Task: Updated Configuration UI**
The conditional task settings have been restructured with a tabbed interface for an intuitive arrangement of configuration options. This update simplifies navigation and improves the user experience by logically grouping related settings.
### **Incident Playbooks: On Playbook Task Error Trigger**
We've introduced the **On Playbook Task Error** trigger to enhance error management within incident playbooks. This feature, active by default for command, data formatter, conditional, and REST API tasks, triggers a follow-up workflow when an error occurs, such as sending an email alert to an analyst. It's designed for quick response and can be disabled as needed.
To prevent potential infinite error loops, workflows initiated by this trigger will not reactivate the trigger if they fail. When the follow-up workflow is activated, you can access the task's name and error message in the returned playbook data located at the paths **$.Trigger.taskName** and **$.Trigger.taskErrorMessage**, respectively.
## **Data Ingestion Enhancement**
### **Event and Incident Creation Count Indicator**
An event and incident creation count indicator has been added to event and incident intake logs. This feature systematically tallies the outcomes of each ingestion job. Accessing the event intake logs now provides a count of newly created events, while the incident intake logs display the total number of incidents generated.
## **Utility Commands**
The following utility commands have been added to this release of D3 SOAR.
|------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Clone and Schedule Data Ingestions | Clone a new schedule from the current schedule connection to a new schedule connection within the integration. If the current schedule connection is empty, then create a new schedule in the new schedule connection within the integration. |
| Share Global Lists across Sites | Shares global lists across sites. |
| Publish Playbooks across Sites | Publishes live playbooks across sites. |
## **Integrations**
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|---------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| iZOOLogic | New commands: **Get Case Details** , **Get DLR Incident Details** , **Get WSS Scanning Details** , **Get WSS Scanning Vulnerability Details** , **List Authorised Executives** , **List Whitelisted Executives** **Fetch Event** : Added new options for the **Event Type** parameter: **Incident** , **Data Loss Recovery** , **Brand Abuse Monitoring** , **Executive Monitoring** , **Social Media Monitoring** , **Domain Names** **Monitoring** , **Mobile App Monitoring** , **Case Message** New event sources: **DLR Incident** , **Domain Monitoring** , **Brand Abuse Monitoring** , **Executive Monitoring** , **Mobile App Monitoring** , **Social Media Monitoring** , **Case Messages** Added default field mappings for all event sources |
| Microsoft 365 Defender | New commands: **Create Alert Comment** , **Fetch Event** , **Get Alerts** , **Get Incident Alerts** , **Update Alerts** |
| Palo Alto Networks Firewall V10 | New commands: **Block IPs By Adding To AddressGroup** |
| Stellar Cyber | New commands: **Fetch Incident, Update Incidents** The**Search Events** command has been renamed to **Search Incidents** with an updated description. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.0
## **New Features**
### **My Dashboards**
.png?cb=e05113d52dca2a6bdabc872c7663b204)
The new **My Dashboards** feature on the investigation dashboard enables users to add dashboards configured in the [**Reporting Dashboard**](https://docs.d3security.com/user-docs/?contextKey=ReportingDashboard&version=latest) tab, allowing them to personalize their data visualization to focus on the metrics most critical to their operational needs.
Refer to [**My Dashboards**](https://docs.d3security.com/user-docs/?contextKey=MyDashboards&version=latest) for details.
### **Interaction Task Response Link**
Two new interaction task reply channels have been introduced for use in conjunction: **Create Interaction Response Link** and **Await Interaction Response Result**. The former one generates a response link that can be shared with recipients. The latter one monitors the specified link, awaiting a response within a defined timeframe and updating the task status accordingly.
View Example
Suppose the following investigation playbook is provided:
%201.png?cb=5a69b41ab091044ba1bba223ac32015a)
1. Set up the first interaction task.
2. Set up the second interaction task.
3. Test the playbook, then click on the  icon for the first interaction task to obtain the response URL.
4. Send the URL to the relevant recipients. The form accessed via the URL will appear as follows:
%201%20(1).png?cb=612bac82566c79ec8639e45664e4f39c)
5. Click on the  icon for the second interaction task to check on the response status.
* If the recipient does not respond within the allotted timeframe, an overdue message will be displayed in the **Key Fields** and **Context Data** tabs.
* If the recipient responds by submitting the form within the allotted timeframe, their response will be displayed in the **Key Fields** and **Context Data** tabs.
%201.png?cb=674ce9da91dc934c9b398c27696dbbbc)
### **Log Request Details**
The Log Request Details feature allows users to view raw data sent and received by built-in and custom integration commands. Users can select the **Log Request Details**checkbox to view the request details in the Result Log after testing the command.
View Details
* This feature is restricted to users with **Debug Mode** and **Playbook** [++**access**++](https://docs.d3security.com/user-docs/?contextKey=Roles&version=latest).
* Sensitive data, such as tokens in the header, may be revealed by the functionality.
* This feature is available for Python commands, covering 90% of D3's built-in integration commands.
### **Add or Update Artifact Reputation**
Users can add or update the reputation of existing artifacts more efficiently with the[**Add or Update Artifact Reputation**](https://docs.d3security.com/release-notes/morpheus-releases/17-0.md#Add-or-Update-Artifact-Reputation-Command) utility command and certain integration check reputation commands ---**Check IP Reputation** , **Check URL Reputation** , and **Check File Hash Reputation**.
View Example - Add or Update Artifact Reputation
1. Navigate to the **Configuration** module, then click the **Utility Commands**sub-module.
2. Enter **Add or Update Artifact Reputation** in the search bar, then select the matching result.
3. Click the **Test**tab and select a site.
4. Fill the input parameters as necessary, then click the **Test Command**button.
Ensure that the Artifact Type and Artifact Name correspond. For example, selecting **Internal Endpoint**as the type while providing an external IP address will result in an error.
5. Navigate to the **Investigation Dashboard** module, select the site, then choose the **All Artifacts** view.
6. Search for the artifact by its name and click the matching result.
**RESULT**
If the command execution was successful, the updated reputation details are displayed in a dedicated section on the **Overview** (only shows the most updated data) and in the **Reputation**tab (also shows historical data) within the Artifact Details pop-up window.
The details displayed in the **Reputation Result** section in the **Overview**tab.
The details displayed in the **Reputation**tab.
**Adding or Updating Artifact Reputation** **with a Check Reputation Command**
1. Navigate to the **Configuration** module, then click the **Integrations**sub-module.
2. Select a check reputation command, such as VirusTotal v3's [**Check IP Reputation**](https://docs.d3security.com/integration-docs/integration-docs/virustotal-v3#VirusTotalv3-_heading=h.pg34hicaf4j7CheckIPReputation) command.
3. Click the **Test**tab, then add or select a connection.
Ensure that the chosen connection is allowed to run system IP reputation checks by selecting the **Used for system IP reputation check**checkbox on the edit or add connection form.
4. (Optional) Select the **Retrieve real-time reputation results**checkbox.
If users select the checkbox, the command will perform a live query for reputation data instead of retrieving cached results. Refer to [**Retrieve Real Time Reputation Results**](https://docs.d3security.com/release-notes/morpheus-releases/17-0.md#Retrieve-Real-Time-Reputation-Results)for details.
5. Fill the input parameters as necessary, then click the **Test Command**button.
6. Navigate to the **Investigation Dashboard** module, select the site, then choose the **All Artifacts** view.
7. Search for the artifact by its name and click the matching result.
**RESULT**
If the command executed successfully, the reputation details of the artifact will be updated and displayed in a dedicated section on the **Overview** tab (only shows the most updated data) and in the **Reputation**tab (also shows historical data) within the Artifact Details pop-up window.
The reputation details updated by the Check IP Reputation command displayed in the **Reputation Result** section in the **Overview**tab.
The reputation details updated by the Check IP Reputation command displayed in the **Reputation**tab.
### **Download Button for Query Results**
Users can now download query results in the Reporting Dashboard as a .xlsx file by clicking the **Download**button. They can download results after running a query or from an existing widget on the dashboard.
After Running a Query
From Existing Widget
### **Save Draft**
Previously, version history was limited to live playbooks. A **Save Draft** button has been introduced for playbooks and user-defined commands, allowing users to save progress without submitting changes.
Version History - Before vs. After
++**Before**++
++**After**++
### **Playbook Dashboard Filters**
Users can now filter playbooks by integrations used and last modified time on the Incident Playbook and Event Playbook dashboards. These filters are available as dropdown options.
### **Notification for Triage Updates**
Users viewing a custom triage they do not own will now receive a notification when it is updated or removed by the triage owner. Refer to [**Editing and Deleting Custom Views**](https://docs.d3security.com/user-docs/?contextKey=CustomViews&version=latest#id-(dummy)CustomViews-EditingandDeletingCustomViews)for details.
## **Enhancements**
### **General Enhancements**
#### **Investigation Dashboard Custom Triage**
The process for creating and reordering custom triages has been refined for a smoother experience. Refer to [++**Setting Up a Custom Triage**++](https://docs.d3security.com/user-docs/?contextKey=SettingUpACustomTriage&version=latest) for details.
#### **Incident Workspace Description Editor**
The incident description editor has been enhanced for improved usability and performance.
Incident Description Editor - Before vs. After
++**Before**++
++**After**++
### **Artifact Enhancements**
#### **Adding Artifacts from Overview**
.png?cb=8f47b675608bb824d5039b86bbc9cc1b)
Users can add artifacts from the Overview tab in the incident workspace using the Linked Artifacts widget.
View Details - Link Artifacts to the Incident
Users can click the  button to [**link an existing artifact**](https://docs.d3security.com/user-docs/?contextKey=LinkedArtifacts&version=latest#id-(dummy)LinkedArtifacts-_heading=h.30j0zllLinkfromexistingartifacts) to the incident or [**create a new artifact**](https://docs.d3security.com/user-docs/?contextKey=LinkedArtifacts&version=latest#id-(dummy)LinkedArtifacts-_heading=h.n1fphse17px0Linkfromnewartifacts) to link to the incident.
After linking artifacts to the incident, users can access their details and [**execute commands**](https://docs.d3security.com/user-docs/?contextKey=LinkedArtifacts&version=latest#id-(dummy)LinkedArtifacts-_heading=h.g6ixksgfcqamExecuteaCommand) on them. Linked artifacts are also displayed in the**Link Analysis**tab.
#### **Retrieve Real-Time Reputation Results**
A new checkbox option allows users to always retrieve real-time reputation data when running check reputation integration commands.
* If unchecked, the first execution makes an API call, while following runs within the timeframe specified in the **Artifact Reputation Fresh Minutes** field will retrieve cached data from that last API call made within the set time period. Once that timeframe has passed, the artifact reputation is treated as expired, and the next execution will call the API again.
* If checked, every execution retrieves live data---or makes an API call in real-time---instead of retrieving the cached reputation data.
The checkbox within the command task configuration in a playbook.
The checkbox within the **Test**tab of a check reputation integration command.
Changing the Artifact Reputation Fresh Minutes Field Value
In **Configuration** \> **Application Settings** \> **Web Config** , users can configure the duration (in minutes) after which an artifact's reputation is considered expired and should be updated. By default, this value is set to **60 minutes**.
**READER NOTE**
* The **Retrieve real-time reputation results**checkbox is controlled by a Web Config token. This role token is hidden by default. Contact D3 Security to enable visibility.
* Check reputation commands from Spamhaus and Maltiverse do not include the checkbox, as they always retrieve real-time reputation data by default.
#### **Configurable Retention for Artifact Reputation Records**
Users can now configure how long artifact reputation records are retained with the **Artifact Reputation History Expired Days** setting. After the specified period, the reputation records of artifacts are automatically deleted. The artifacts themselves will **not**be deleted. By default, records are retained for 30 days.
**READER NOTE**
* The Artifact Reputation History Expired Days setting is hidden by default. Contact D3 to enable its visibility.
* To remove artifact reputation records, a purge data script must be set up. If not already configured, contact D3 Support for assistance with scheduled data purges.
Changing the Artifact Reputation History Expired Days Field Value
Users can navigate to **Configuration** \>**Application Settings** \>**Web Config** to modify the retention period (in days) for artifact reputation history. By default, reputation records are removed after 30 days.
### **Playbook Enhancements**
#### **Playbook Dashboards UI**
The Incident Playbook and Event Playbook dashboards now feature a folder structure on the left with filters to view all, built-in, or custom playbooks. On the right, users can see playbook details, including name, live or draft status, task count, top three integrations (if any), and user permissions.
#### **Custom Python Command Icon**
.png?cb=f080edf329b42b2bfef3dcacf9ebbb42)
All custom Python commands in a playbook are now marked with a  icon. Commands using a previous version without the latest Python updates applied are marked with the  icon.
Clicking on the  and  icons will render the code and code comparison windows respectively.
View Code Window and Code Comparison Window
++**Code Window**++
++**Code Comparison Window**++
#### **Parent-to-Child Playbook Incident Data and Command Input Persistence**
Previously, retesting a child playbook command required re-entering input, and separately caused the loss of incident data from the parent playbook. Now, users can retest a nested playbook while preserving both command input and incident data.
View Example - Retesting Nested Playbooks
1. Create a simple playbook utility command, then click on the root node.
2. Enable the **Command Task** setting to use this playbook utility command within a parent playbook.
3. Configure a command input parameter.
4. Submit this playbook utility command.
.png?cb=a5c0e6498910c8a9c68ef3bf9b31c28d)
5. Create an investigation playbook incorporating the previously submitted playbook utility command, providing a sample value for the configured input parameter, then click on the  button.
.png?cb=c0d506bbe4efa156d7c6b95ce84a2858)
6. Select an incident, then click on the **Run Test** button.
7. Click on the -20250415-173231.png?cb=c2f2060766798d4454effe245422909d) icon to view the executed playbook utility command.
8. Click on %202-20250225-202524.png?cb=e08c598ad75bb1e26c28eafa2512a6d8) then  within the nested playbook.
++**Before version 16.9**++
++**Starting from version 16.9**++
9. Click on the  icon of any task node.
++**Before version 16.9**++
++**Starting from version 16.9**++
#### **Playbook Execution Path Performance Enhancement**
Before optimization ("Before"), frequent query executions increased CPU and worker usage. Now ("After") repeated executions are reduced, optimizing SQL Server performance.
Playbook execution paths are now cached in memory, reducing SQL Server load by minimizing repetitive calculations. This optimization enhances performance, making large playbook executions faster and more efficient.
#### **Incident Data Retrieval**
Incident data retrieval has been enhanced for more efficient data handling. When using JSON paths to retrieve incident data, playbooks fetch only the fields used during execution, rather than loading the entire dataset into memory. If a user references a broad dataset (e.g., `{{ PlaybookData | jsonpath('$.DataSource.incident') }}`) but only utilizes a specific key-value pair within it, only that required field is fetched in real time.
Execution Duration - Before vs. After
++**Before**++
++**After**++
**READER NOTE**
It is recommended that users explicitly define specific JSON paths whenever possible to retrieve only necessary field values and avoid loading large datasets.
Restricting Retrieval of Certain Large Data Fields
A new setting has been introduced that restricts certain large data fields to only be retrieved using their specific JSON paths. If enabled, for example, `{{ PlaybookData | jsonpath('$.DataSource.incident') }}` will not return the raw data of the incident, but it can instead be retrieved using `{{ PlaybookData | jsonpath('$.DataSource.incident.RawData') }}`.
By default, this setting is disabled. To enable it, [**contact D3 Support**](https://d3security.com/company/contact/).
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
|---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| **Add or Update Artifact Reputation** | Adds or updates an artifact's reputation based on the selected type and specified name. Reputation details can be viewed in the **Overview** or **Reputation** tab within the **Artifact Details**pop-up window. Refer to [**Add or Update Artifact Reputation**](https://docs.d3security.com/release-notes/morpheus-releases/17-0.md#Add-or-Update-Artifact-Reputation) for more information. |
| **Get Global List MetaData** | Retrieves the metadata of global lists, including ID, name, description, site list, status, and last modified time, based on global list names, global list IDs, or site names. |
| **Get Site Connections** | Retrieves all configured connections for a specified Site, including integration name, connection name, connection status, automated health check status, last test timestamp, and last test result. The returned data enables dynamic connection selection, status monitoring, and management. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|-------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| **Acronis** | Acronis is a provider of cybersecurity and data protection solutions, offering a suite of products designed to secure and manage data for individuals, small businesses, and enterprises. This integration allows organizations to ingest alerts into D3 vSOC, as well as create and dismiss alerts. |
| **Big Panda** | BigPanda is an IT operations management (ITOM) platform designed to help organizations monitor, analyze, and resolve issues within their IT environments more efficiently. It primarily focuses on IT incident management and event correlation by aggregating alerts from various monitoring tools and systems into a single platform. |
| **Cisco Meraki** | Cisco Meraki provides cloud-managed networking for Wi-Fi, routing, security, and IoT. This integration enables organizations to retrieve organization and network details, monitor security events, manage firewall rules, control destination lists, and fetch network alerts and event history. |
| **Cisco Umbrella Cloud Security** | Cisco Umbrella Cloud Security is a cloud-based security platform that serves as the first line of defense against internet-based threats. It provides secure web gateways, DNS-layer security, and cloud-delivered firewall capabilities, ensuring comprehensive protection for users, devices, and data across various locations, both on and off the network. This integration enables organizations to manage destination lists, including adding or removing destinations from specified lists. |
| **Deep Instinct V2** | Deep Instinct V2 (using latest REST API version v1) is an endpoint security platform that aims to prevent, detect, and respond to zero-day malware, ransomware, and other advanced threats before they can compromise endpoints or networks. It functions as an endpoint detection and response (EDR) tool, among other capabilities, offering flexible and customizable cybersecurity solutions for modern security operations. |
| **ExtraHop Reveal(x) v2** | ExtraHop Reveal(x) uses wire data and artificial intelligence to analyze the behavior that impacts critical assets. |
| **F5 Application Security Manager (WAF)** | F5 Application Security Manager (WAF) is a unified cloud security platform designed for both cloud security and development teams, offering capabilities for prevention, active detection and response. |
| **Grafana** | Grafana is an open-source platform for monitoring, observability, and data visualization. It enables organizations to create dynamic, interactive dashboards that display metrics and logs from various sources. This integration enables clients to send Loki log messages and Metrics to Grafana. |
| **HaloPSA** | HaloPSA (Professional Services Automation) is a cloud-based software platform designed to help Managed Service Providers (MSPs) and IT service businesses manage their operations efficiently. It provides tools to automate workflows, streamline service delivery, and manage client relationships. |
| **LimaCharlie** | Limacharlie is a cloud-based cybersecurity platform designed to provide organizations with powerful tools for threat detection, response, and management. It functions as an endpoint detection and response (EDR) tool, among other capabilities, offering flexible and customizable cybersecurity solutions for modern security operations. |
| **Microsoft Purview eDiscovery V2** | Microsoft Purview eDiscovery V2 (formerly known as Microsoft 365 eDiscovery) is a comprehensive solution designed to help organizations locate, preserve, collect, and review electronically stored information (ESI) for compliance, legal, and investigative purposes. It is part of Microsoft's Purview suite of tools, which provide security, compliance, and risk management for organizations using Microsoft 365. This integration works with Microsoft Purview eDiscovery (Premium). |
| **Qualys Cloud Agent** | The Qualys Cloud Agent integration enables the management of Cloud Agents, activation keys, and configuration profiles for the agents. |
| **SailPoint IdentityIQ** | SailPoint IdentityIQ is an identity and access management software platform custom-built for complex enterprises. It delivers full lifecycle and compliance management for provisioning, access requests, access certifications, and separation of duties. |
| **Shodan** | Shodan is a specialized search engine that scans and indexes internet-connected devices and systems. |
| **SOC Radar Incident V3** | SOCRadar is an Extended Threat Intelligence (XTI) SaaS platform that combines External Attack Surface Management (EASM), Digital Risk Protection Services (DRPS), and Cyber Threat Intelligence (CTI). SOCRadar Threat Intelligence is enriched with External Attack Surface Management and Digital Risk Protection, and maximizes the efficiency of your SOC team with false-positive free, actionable, and contextualized threat intelligence. This integration enables organizations to ingest and manage SOC Radar incidents(alarms). This integration is developed based on incident APIv3. |
| **TAXII 2 Threat Feed** | Ingest threat indicator feeds from a TAXII 2 server using the Trusted Automated eXchange of Indicator Information (TAXII) protocol version 2.0 or 2.1. This integration enables organizations to retrieve threat intelligence data, which is typically represented in STIX (Structured Threat Information Expression) format. |
| **Vectra AI** | Vectra Cognito with its new name Vectra Platform is an AI-driven cloud and network threat detection \& response (NDR) platform provides customers a path to protect their journey to hybrid and multi-cloud, harness Security AI to help organizations build cyberattack resilience with broad attack coverage, clarity, and controls from the data center to the cloud. |
| **VulDB V2** | VulDB (Vulnerability Database) is an independent vulnerability intelligence platform that provides detailed information on security vulnerabilities across various software, hardware, and network components. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **Fluency** | **New Command(s)** * Fetch Incident |
| **FortiGate** | **New Command(s)** * List Policies * Update Policy |
| **Freshservice** | **New Command(s)** * Fetch Event |
| **LogRhythm Rest** | **Enhanced Command(s)** * Fetch Event: Added the Including Drilldown parameter and added field mappings. |
| **Microsoft Entra ID Protection (Azure AD Identity Protection)** | **New Command(s)** * Fetch Event |
| **Microsoft Entra ID** **(Azure Active Directory)** | **New Command(s)** * Delete OAuth2 Permission Grants * List OAuth2 Permission Grants |
| **Microsoft Intune** | **New Command(s)** * Create Windows Update For Business Configuration * List Windows Update For Business Configurations * Update Windows Update For Business Configuration |
| **Microsoft Sentinel** | **Enhanced Command(s)** * Fetch Event: Introduced a new event source type (Event Source for Sentinel Incidents) for improved ingestion. |
| **Office 365** | **New Command(s)** * List Message Rules **Enhanced Command(s)** * Send Email: Renamed the Sender Email parameter to Mailbox Address and added the Send As and Reply To parameters. |
| **Tenable.io** | **New Command(s)** * Add Agents To Groups * List Agents By Group * List Agent Groups * Remove Agents From Groups |
| **Veeam Backup \& Replication** | **New Command(s)** * Create Malware Event |
### **Deprecated Integrations**
|-------------------------|-----------------|
| **Integration Name** | **Replacement** |
| **Github (Deprecated)** | Github |
| **VulDB (Deprecated)** | VulDB V2 |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.1
## **New Features**
### **Task Node Action Bar**
An action bar has been added to playbook task nodes, appearing on hover to provide quick access to key task management controls, and to display the task node ID for identification and reference. Users can activate or deactivate a task node using the  toggle. Deactivating a node blocks its execution as well as that of all subsequent task nodes. The  (delete) button permanently removes the task node from the playbook.
### **Incident Type Manager Sub-Module**
The new **Incident Type Manager** sub-module serves as the centralized interface for managing all incident types, with the Incident Form Editor now integrated within it. General configuration for each incident type is now available through a new interface under the General tab. Each incident type also includes an independently managed workspace library, enabling the creation of [**custom incident workspace dashboards**](https://docs.d3security.com/release-notes/morpheus-releases/17-1.md#incidentWorkspaceBuilder) composed of selected widgets.
View UI
**READER NOTE**
The former Incident Form Editor sub-module is now available as a tab named **Incident Form Builder** within each incident type in the Incident Type Manager sub-module.
For the full documentation, refer to [**Incident Type Manager**](https://docs.d3security.com/user-docs/?contextKey=IncidentTypeManager&version=latest).
### **Incident Workspace Builder**
The incident workspace builder enables users to design and assign customized workspaces for specific incident types. Through a drag-and-drop interface, users can arrange widgets on a canvas, name the layout, and configure workspace settings.
Example - Building and Applying a Custom Incident Workspace
1. Navigate to the [++**Incident Type Manager**++](https://docs.d3security.com/release-notes/morpheus-releases/17-1.md#incidentTypeManagerModule)module.
2. (Optional) Create a new incident type.
-20250403-213613.png?cb=acae1b88739b7b464627c90d952538b1)
3. Search for and select an incident type of choice.
-20250403-213634.png?cb=3f79cf5f128199f509f1dec487e36663)
4. Click on the  button, or click on an existing workspace.
-20250403-213649.png?cb=90436a288a7da25b5ca89f1d06b8bfbc)
5. Drag and drop the desired widgets onto the canvas, then adjust their size and position as needed.
6. Click the **Settings** tab, then assign the workspace to the appropriate incident types, roles, and groups under the **Assign Workspace** section.
-20250403-213736.png?cb=6178d03efc459c31e5c72c09fae88a8e)
7. Hover over the dropdown, then click on **Incident.**
-20250403-213823.png?cb=cc122cc06bb8424b3237fd3984e11a26)
8. Add a new incident of the same type created or selected in[++**step 2 or step 3**++](https://docs.d3security.com/release-notes/morpheus-releases/17-1.md#step2).
-20250403-213944.png?cb=5495e61e92027fef5a1591946d5a1e7a)
9. Verify that the custom workspace appears as configured in [**step 5**](https://docs.d3security.com/release-notes/morpheus-releases/17-1.md#step5).
-20250403-214014.png?cb=19b55250d088997482899794b8664abe)
**READER NOTE**
Use the  (layout switcher) icon at the top-right corner of the header panel to apply the custom layout.
-20250403-214048.png?cb=ef1f3b872aa893e253979433f7921b47)
-20250403-214102.png?cb=135cd5668761c303357ed0348a59167a)
### **Stage Tracker**
-20250402-214409.png?cb=e02cec8561eea97a7a4879aa51676c5e)
A stage timeline component has been added to the [++**incident header panel**++](https://docs.d3security.com/release-notes/morpheus-releases/17-1.md#incidentHeaderPanel) to dynamically display progress based on the most recently added playbook, irrespective of its status ( -20250402-213624.png?cb=8319e5035bb4c2c804ee4673033f5ade) , -20250402-213606.png?cb=d600e642a93719ae158bca9fa6e9e0c3) , or  ). The timeline displays a maximum of seven stages---the current stage, along with up to six before and six after. Clicking a stage opens a selection menu to view either the playbook task details or the overall playbook execution progress.
Note on Stage Timeline Display in Parallel Execution
Even when stage tasks run in parallel within a playbook, the stage timeline displayed in the [**incident workspace header panel**](https://docs.d3security.com/release-notes/morpheus-releases/17-1.md#incidentHeaderPanel) will remain linear, reflecting progression based on execution timestamps.
example
**Playbook 1**
%201%20(1)-20250402-215613.png?cb=9b99b702030ac5b8fe3520318918d692)
**Playbook 2**
%201%20(3)-20250402-215606.png?cb=7b1ef50cf92dea3e47ad1fe95e8298e2)
Both playbooks above will render the stage timeline component as shown below.
-20250402-222317.png?cb=63066b08a9951e4fc22be1c59dfbc3a5)
### **Escalate and Dismiss Task Nodes**
Two new task types---Escalate and Dismiss---are now available to streamline event-incident correlation workflows. The Escalate task provides direct access to the [++**Create Incident With Conditions**++](https://docs.d3security.com/utility-command-docs/Working-version/create-incident-with-conditions) utility command, while the Dismiss task simplifies event dismissal actions.
### **Insert Task Nodes Between Existing Ones**
Speeding up workflow adjustments, users can now insert new task nodes between existing ones without the need to manually drag and drop a task into place, connect it to the following task node, and remove the original link.
Example - Task Node Insertion
Users can insert a task node between existing ones in the following steps:
1. Select the connecting arrow.
2. Click on the  button.
3. Choose the task type to add.
### **Hide System Artifacts in Event Field Mappings**
From the **Application Settings** page, administrators can tailor system artifact type visibility to align with organizational workflows, ensuring that artifact types not relevant to specific use cases are excluded from new artifact creation.
**WARNING**
Hidden system artifact types cannot be unhidden from the application. Contact D3 Support to request reactivation.
View Details
**Hiding an Artifact Type**
**READER NOTE**
* Only administrators can access Application Settings to configure system artifact type visibility.
* For new clients, composite artifact types such as URL, Email Address, and File are hidden from the front end.
* For existing clients, these types appear with the Legacy tag.
Users can hide artifacts in the following steps:
.png?cb=3271207eb51e4e04688b77d5c8d479f0)
1. Search for the artifact type.
2. Select the artifact type to hide.
3. Click the **Save**button to apply the changes.
**READER NOTE**
If an artifact type is hidden after it was previously used, existing artifacts of that type will remain in the data and are not deleted. However, no new artifacts will be created from that type going forward.
## **Enhancements**
### **General Enhancements**
#### **Redesigned Login Screen and Smooth Page Animations**
.png?cb=eee2ed4c102f77ef8a2bdd38f2e5468f)
The login screen has been updated with a more modern design. Page transitions are now enhanced with animations for a smoother navigation experience.
View Animations
**Login Page**
**Page Switch**
#### **Utility Commands Layout Redesign**
Utility commands are now displayed in a card layout on the right for improved readability, creating a more modern and organized browsing experience.
#### **Event and Incident Playbooks Rebranded**
Event and incident playbooks have been rebranded to align with the product architecture and provide clearer context during user selection.
#### **Custom Triage Renamed to Custom Views**
.png?cb=6848cb0f6ebcd0c9908cc3d648d59381)
[**Custom Triage**](https://docs.d3security.com/user-docs/?contextKey=SettingUpACustomTriage&version=latest) has been renamed to Custom Views to better reflect its purpose in managing personalized views within the Investigation Dashboard page. Functionality remains unchanged.
### **Playbook Enhancements**
#### **Modernized Styling for Playbook Task Nodes**
Playbook task nodes have been redesigned with a sleek, modern color pallet---such as deep navy for the root node, electric violet for command nodes, and rich terracotta for stage nodes.
View Task Configuration Popover and Node Menu
Similarly, the task configuration pop-over and node menu now feature an updated, modernized design.
-20250402-234612.png?cb=f666e91211f59f80d634317670237c44)
*** ** * ** ***
-20250402-234803.png?cb=e1c9feab95c2350a4e3e60eae3e75028)
#### **Customizable Trigger Options for the Playbook Root Node**
Users can now control which trigger options appear in the playbook root node. Previously, all available triggers were shown by default. With the 17.1 release, users can selectively show or hide triggers, reducing visual clutter during playbook configuration.
#### **Plus Button Added for Task Insertion**
.png?cb=1c7fc718a45beb3a43b698337c6471a9)
Users can now add playbook tasks by clicking the plus (**+**) button directly on a task node, providing an alternative to dragging tasks from the task panel.
### **Incident Workspace Enhancements**
#### **Incident Header Panel Revamp**
The incident header panel features a modern layout with improved visual hierarchy. Key details---incident type, severity, disposition, and ownership---are now more prominent. Offering immediate visual context and highlighting urgency, the background color of the header panel dynamically reflects incident severity levels:
* Red (  )
%201.png?cb=8dc7968ecaf3d3f00af7e9659531be66)
* Persimmon (  )
%201-20250401-214902.png?cb=f40079c3dc037e1dbb6605672d6b9dee)
* Amber (  )
%201-20250401-215046.png?cb=e8fdad0d2eda1fc4b66bc195141861a4)
* Grey (  ,  )
%201.png?cb=494d317afcaa833c2eaee673719773ab)
#### **Creating and Managing Dispositions**
.png?cb=15386e1bb599f5b284bcdee2f5d6246f)
Within the newly introduced [**Incident Type Manager**](https://docs.d3security.com/release-notes/morpheus-releases/17-1.md#incidentTypeManagerModule) sub-module, users can create and manage the dispositions available for each incident type. In addition to out-of-the-box options, users can add custom dispositions tailored to their needs and remove any inapplicable to the selected incident type.
Adding or Removing Dispositions
Users can add custom dispositions and remove both system and custom dispositions from an incident type by following these steps.
1. Navigate to the **Configuration** module, then select the **Incident Type Manager**sub-module.
.png?cb=e4a2c48e8d5ce25ad5889090751c8998)
2. Select an existing incident type (i.e., **New Feature Request** ) or add a new one by clicking the **+ New Incident Type**button.
.png?cb=11b0c39ce11d6b18bcd93daa24cd1ad9)
3. Add a custom disposition.
.png?cb=3a93077eb500145b26c11f7354e5627f)
1. Click the **Edit Dispositions**button.
2. Click the **+**button.
3. Enter a name for the disposition.
4. Click the  button to add it.
4. Select the dispositions to add to this incident type, including the newly added custom disposition.
.png?cb=39a25f3a58e3e4334c87d5af17c4f92f)
5. Deselect any dispositions that should be removed, such as system defaults or others not relevant to the incident type, then click the **Done**button to apply the changes.
.png?cb=cd7dc0da6529383dbed95bad7b8c8082)
**RESULT**
All incidents of the New Feature Request type will use the configured set of dispositions.
.png?cb=538d2436493104947b347fa5adad15ea)
#### **File Previewer**
Users can now preview files using the new Preview option within the Files widget. This eliminates the need to download files for a quick look. Supported formats include PDF, DOCX, XLSX, XLS, CSV, MP4, JPG, PNG, and TXT.
#### **Notes Widget Revamped**
.png?cb=68c11fccfb0313aedd7f4bd02b7c0d5e)
The Notes widget UI has been updated with a modern, streamlined layout. Users can now search for notes using the built-in search bar to quickly locate relevant entries.
#### **Export Incident Report Now Supports Section Selection**
.png?cb=8612d3f4e74c0cee443b4a6858f6dc23)
Users can now select which sections to include when exporting an incident report to a PDF file. By default, all sections are selected for export.
#### **Adding Timeline Entries with Rich Text Editor**
Users can now add notes to an incident's timeline using a rich text editor, available for the Notes, Description, and Summary fields in the pop-up window. Notes can be added via the **Add Note** button in the **Timeline** tab or the **Add to Timeline** button in the **Command Centre** tab.
View Details
**Add Note in Timeline Tab**
.png?cb=9b3756bb140fa9e73393a688480667b6)
**Add to Timeline in Command Centre Tab**
 Example - Adding a Table Using HTML
Users can add a table using the rich text editor in the following steps:
1. Click the  button.
.png?cb=f248e99f52852d0209d01023ef800462)
2. Enter the table structure using HTML, then click the **OK**button.
.png?cb=f6e72adf07f3321ee23b0e6d76f2bb12)
Inline CSS may be used to apply styling.
HTML
Company
Contact
Country
Alfreds Futterkiste
Maria Anders
Germany
Centro comercial Moctezuma
Francisco Chang
Mexico
3. Click the **Save**button.
.png?cb=a4762cf75c84426e8ef40970af8a7f47)
**RESULT**
The table will be rendered with the intended styling, formatting, and content.
.png?cb=828c589be2554660235702da2f8a0534)
### **Reporting Dashboard Enhancements**
#### **New Widget Types Supported: Stacked Area and Sankey**
Reporting dashboards now support two new widget types: **Stacked Area** and **Sankey** charts.
Sankey
Sankey charts visualize how data flows from one category to another, with the width of each flow representing volume (e.g., the number of artifacts per artifact type).
Follow these steps to create a Sankey widget that visualizes how different artifact types are distributed across risk levels:
1. Create a new widget.
.png?cb=e37c22459571ab829b654de2001e633f)
1. Navigate to the **Reporting Dashboard**module.
2. Select the **Widgets**sub-module.
3. Click the **+ New**button.
2. Configure the data retrieval scope, then execute the query.
.png?cb=442931892a5c7eca40c46b798ad21d38)
1. Select a data source.
2. Choose a site from which to retrieve data.
3. Select the date range for the retrieval.
4. Click the **Run Query**button.
3. Click the **Next Step: Configure Widget** button, choose the **Sankey** option, then click the **Apply**button.
.png?cb=7f874ff29df188dfbf7c609a92ceda7e)
4. Configure the chart settings to define how the data will be visualized.
.png?cb=504160e10914db66fab0a9add743469d)
1. Select the **Artifact Type** option in the Group By (*xField* ) section.
This sets the origin point of each flow in the chart, grouping the data by artifact type.
2. Select the **Artifact Risk Level** option in the Secondary Group By (*seriesField* ) section.
This defines the destination of each flow, grouping the data by the assigned risk level of each artifact.
3. Select the **COUNT** option in the Aggregation (*yField* ) section.
This determines the thickness of each flow by counting how many artifacts fall into each combination of type and risk level.
**RESULT**
The data is displayed as a Sankey chart that visualizes the flow from artifact type to artifact risk level.
.png?cb=948e92008562a64f8e28c9e7b3e27e83)
Hover over different parts of the chart to view the number of artifacts at each end of the flow or along the connection paths (i.e., the coloured areas).
 Stacked Area
Use Stacked Area charts to track how grouped values change over time. Each area represents a specific group---such as an incident severity level---and shows how its count rises or falls over time.
Follow these steps to create a Stacked Area widget that visualizes how incident counts vary over time by severity level.
1. Create a new widget.
.png?cb=e37c22459571ab829b654de2001e633f)
1. Navigate to the **Reporting Dashboard**module.
2. Select the **Widgets**sub-module.
3. Click the **+ New**button.
2. Configure the data retrieval scope, then execute the query.
.png?cb=47e634410cf11be16f9bdf9f8199108f)
1. Select a data source.
2. Choose a site from which to retrieve data.
3. Select the date range for the retrieval.
4. Click the **Run Query**button.
3. Click the **Next Step: Configure Widget** button, choose the **Stacked Area** option, then click the **Apply**button.
.png?cb=d7d85404279a9724c4f884048afffba3)
4. Configure the chart settings to define how the data will be visualized.
.png?cb=ee1d06041e328f5a06c4e81d0081c175)
1. Select the **Incident Created Utc Time** option in the Group By (*xField* ) section.
This groups the data by the time each incident was created and displays it along the x-axis to show changes over time.
2. Select the **Incident Severity** option in the Secondary Group By (*seriesField* ) section.
This breaks down the data further by severity level, allowing users to compare how different severity levels trend over time.
3. Select the **COUNT** option in the Aggregation (*yField* ) section.
This calculates the total number of incidents for each severity level and time interval, determining the height of each area in the chart.
5. (Optional) In the Widget Options section, set the result limit to 100 and sort the data by **Incident Severity** in ascending order to improve visual clarity.
.png?cb=b1d055707ea2d336d9d74de3b2a974bb)
1. In the Maximum Results field, enter **100**to return up to 100 records.
2. In the Sort Order field, select the **Incident Severity** option from the left dropdown.
3. In the Sort Order field, choose the **Ascending** option from the right dropdown.
**RESULT**
The data now appears as a stacked area chart, illustrating how the number of incidents changes over time, with each area representing a different severity level.
.png?cb=7ed1c0c932d8150c821aa8f5acd72367)
#### **Event Site and Incident Site Fields in Reporting Dashboard**
.png?cb=5f6495d6a1da3b23a239a20f7ea90c39)
To enhance flexibility for reporting dashboards, **Incident Site** and **Event Site** have been added to the list of filterable fields in the Event, Incident, and Artifact data sources for use in widget expression blocks. These additions support scenarios such as events from different sites correlating with one or more incidents, incidents moving between sites, and artifacts linked to multiple incidents and events.
View Example
Users can use the newly added fields in the following steps:
1. Create a new widget.
.png?cb=e37c22459571ab829b654de2001e633f)
1. Navigate to the **Reporting Dashboard**module.
2. Select the **Widgets**sub-module.
3. Click the **+ New**button.
2. Configure the data retrieval scope.
.png?cb=7d2245a41e60d21712417013ceb58564)
1. Select a data source.
2. Choose a site from which to retrieve data.
3. Select the date range for the retrieval.
3. Filter the queried results using the **Event Site** and **Incident Site**fields in an expression block.
.png?cb=40bedff02384bbf10a9ecaee60548c80)
1. Choose how multiple conditions in the block are evaluated: use **AND** to match all conditions, or **OR**to match any.
2. Click the**+ Field**button.
3. Select the **Event Site** option from the dropdown.
4. Choose an operator, such as the **in**option to filter for events occurring at one or more selected sites.
5. Select the sites.
4. (Optional) Repeat step 3 to filter the results by the **Incident Site** field.
.png?cb=97088cbebf863b50e8e28c0d2a711e4a)
5. Click the **Run Query**button.
.png?cb=d2c2d255b36bd89a9144994b969d940f)
6. Configure the columns to include the Event Site and Incident Site fields in the displayed data.
.png?cb=521369d2bbca64cbd3dacd2eadc53bf3)
1. Click the **Configure Columns**button in the Query Data section.
2. Click the **+ Add Column** button twice.
3. In one dropdown, select **Event Site**.
4. In the other, select **Incident Site**.
5. Click **Save** to apply the changes.
**RESULT**
The queried data is rendered based on the defined logic and parameters, with the configured columns displayed in the results.
.png?cb=48b3e13ea95cf764ed6b9ad86175020a)
#### **Incident Resolve Time (Day) and (Hour) Added as Aggregation xField Selections**
.png?cb=732fb54110c535efa813a39a06349ef2)
Incident Resolve Time (Day) and Incident Resolve Time (Hour) have been added to the aggregation xField dropdown. These options allow time-based widgets to aggregate data using larger time units.
#### **Filterable Columns Updated to Use Dropdown Inputs**
The following widget column filters were changed from text fields to dropdowns:
* Incident Owner
* Incident Creator
* Incident Closed By
* Incident Reopened By
* Incident Assigned By
* Incident Investigation Team Investigator
* Event Investigator
* Event Assigned By
* Event Disposed Action By
This update improves usability by enabling selection from predefined values.
## **Utility Commands**
### **New Commands**
The following utility commands have been added:
|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| **Generate Latest Dashboard Link by ID** | Generates a direct link to a dashboard using the site and dashboard ID obtained from the Reporting Dashboard module. The link displays all dashboard widgets, excluding table widgets. The dashboard ID must match exactly. |
| **Track Playbook Execution Times** | Calculates and tracks playbook execution times for specified incidents. The command returns start and end times, total duration, execution status, and a unique runtime identifier for each execution. Users can input a single incident number or an array of incident numbers to retrieve execution data in bulk within a single run. |
| **Update Global List MetaData** | Enables users to modify the global list's description and status, and manage the list of sites with which it is shared. |
### **Updated Commands**
The following utility commands have been updated:
|----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| **Export Incident Report** | The Select export sections parameter has been added to allow selection of specific incident report sections for export. |
| **Get Incidents** | * The Sort Field and Sort Order parameters have been added to support sorting of results by any valid field specified in the Static Fields or Dynamic Fields parameter, in ascending or descending order. * The `TotalSize` output field has been added to showcase the total number of incident objects returned in the response. |
| **Get Events** | * The Sort Field and Sort Order parameters have been added to support sorting of results by any valid field specified in the Fields parameter, in ascending or descending order. * The `TotalSize` output field has been added to showcase the total number of event objects returned in the response. |
## **Integrations**
### **New Integrations**
The following integrations have been added:.
|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| **Azure SQL Query** | Azure SQL Database is a fully managed cloud-based relational database service built on Microsoft SQL Server technology hosted on Azure Cloud service. This integration enables organizations to query table content of the given Azure SQL server. |
| **Nucleus Security** | Nucleus Security is a platform designed to enhance vulnerability and exposure management for organizations. It unifies and operationalizes vulnerability data, enabling teams to prioritize and mitigate critical exposures efficiently. |
| **Stamus Clear NDR** | Stamus Clear NDR is a Network Detection and Response (NDR) platform developed by Stamus Networks. It provides advanced threat detection, network visibility, and response capabilities using deep packet inspection (DPI), threat intelligence, and behavioral analysis. |
### **Updated Integrations**
The following integrations have been updated:
|---------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **Cortex XSIAM** | **New Command(s)** * Isolate Endpoints * Search Endpoints |
| **Dell Secureworks Taegis XDR** | **Enhanced Command** * Fetch Event: Added the Investigation Event event source |
| **Halo PSA** | **New Command** * List Categories |
| **Microsoft Teams** | **Connection** * Added the Microsoft 365 Environment connection parameter, allowing users to specify the environment of their Microsoft 365 instance. Available options include: * Commercial \& GCC Environment * GCC High Environment (L4) * DoD Environment (L5) |
| **Office 365** | **Connection** * Added the Microsoft 365 Environment connection parameter, allowing users to specify the environment of their Microsoft 365 instance. Available options include: * Commercial \& GCC Environment * GCC High Environment (L4) * DoD Environment (L5) |
| **Prisma Cloud** | The integration has been updated with revised connection logic, and the current commands have been deprecated and replaced with new ones. |
| **Sophos Central V2** | **New Commands** * Get Case Detections * Get Case Impacted Entities * Get Case Mitre Attack * Update Cases **Enhanced Command** * Fetch Event: Added the Cases event source and Case-related input parameters |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.2
## **New Feature**
### **Master View of Tenant Incidents and Events**
Master tenant users can now manage incidents and events from all connected tenant sites within the investigation dashboard. Tenant instance events are available under **Events \> All Events (\)** , while tenant instance incidents are available under **Incidents \> All Incidents (\)**.
## **Enhancements**
### **Dynamic Python Library Import**
Custom Python command pages now include a **Libraries** tab that allows users to define and manage external library dependencies. Dependencies can be added or edited while the command is in ++***Draft***++mode, with validation for syntax, duplication, and compatibility against Python 3.9 standards. These dependencies are installed at runtime, and users must still include the appropriate import statements in their code to use them.
Feature Availability
The dynamic Python library import feature is available for all custom integration and utility commands.
.png?cb=5e7474953f2fc87c5da4b206ae00fc11)
For built-in integrations, it becomes available when users extend functionality by adding custom commands. Support for this feature within integration commands is steadily expanding, and integrations that currently support it will display a **Libraries**tab.
.png?cb=fc3b42a465207c4e8b434b3e924c1773)
Integrations supporting the dynamic python library feature also include a **For Built-in Commands** sub-tab. This read-only view shows the libraries used by built-in commands, allowing users to leverage them and avoid duplicate import statements when creating custom commands.
.png?cb=fa9e62366cfa757a5a613ce2fb90fca2) Creating a Custom Utility Command Using an External Library
To demonstrate the use of this feature, follow the steps below to create a translator that accepts an input string and translates it into Spanish using the Google Translator library for use within a playbook.
1. Navigate to the **Configuration** module, then select the **Utility Commands**sub-module.
.png?cb=fa08e407e7523033f6dd2abf3d80e9bf)
2. Add a new custom command.
.png?cb=7ab4be9aae1a4ad289c964e3b1862338)
1. Click the .png?cb=bea53e7d4edb6e805b029bae2c6b44cd) button.
2. Enter the display name for the command (i.e., **Translate to Spanish**).
3. Ensure that the **Python**option is selected as the implementation method.
4. Click the **+ Add**button.
3. Paste the code below into the code editor, replacing any existing content.
.png?cb=ed7c06629a94bb06c2b4f237b952f0a4)
Python
from deep_translator import GoogleTranslator # Imports the translation tool used to convert text into another language
import uuid # Imports a tool to generate a unique ID for tracking each translation
def TranslateToSpanish(*args):
"""
Translates user input into Spanish using GoogleTranslator from deep-translator.
args[0]: input text to translate
"""
errors = [] # Will store any errors that occur during the process
returnData = "Successful" # Default result status
context = [] # Optional metadata (unused here)
keyFields = {} # Optional key field storage (unused here)
resultData = {} # Will hold the final output data
raw = {
"Results": [], # Will show the input and translated text
"D3Errors": [] # Placeholder for any system-specific errors
}
trace_id = str(uuid.uuid4()) # Creates a unique ID for tracking this translation request
try:
# Checks if the user provided text and if it is not just empty spaces
if not args or not args[0].strip():
errors.append("An input phrase is required as the first argument.") # Adds an error message
return pb.returnOutputModel({}, "Failed", {}, [], {}, errors) # Returns a failure result
original_text = args[0].strip() # Cleans up the user's input by removing unnecessary spaces
# Translates the input text into Spanish, automatically detecting the source language
translated_text = GoogleTranslator(source='auto', target='es').translate(original_text)
# Prepares the main output data
resultData = {
"trace_id": trace_id, # Unique ID for the request
"original": original_text, # Original text provided by the user
"translated": translated_text # Translated Spanish version
}
# Stores the input/output pair in the results
raw["Results"].append({
"Input": original_text,
"Output": translated_text
})
except Exception as err:
# If something goes wrong, record the error and update the status
errors.extend(err.args)
returnData = "Failed"
# Returns all results, including the translated text, tracking ID, and any errors
return pb.returnOutputModel(
resultData,
returnData,
keyFields,
context,
raw,
errors
)
4. Define the external dependencies used in the code.
.png?cb=024f05acdda50c0e115199c4f2229e7e)
1. Navigate to the **Libraries**tab.
2. Paste the code below into the mini code editor to define any external dependencies used in the command.
Python
deep-translator==1.11.4
The format for each entry is: **\==\** (e.g., **deep-translator==1.11.4**).
3. Click the **Save**button to apply the changes.
5. Add a field that allows users to input the original text to be translated into Spanish.
.png?cb=c2d62285e416c686674abc6d4968825f)
1. Navigate to the **Inputs**tab.
2. Click the **+ New Input Parameter**button.
3. Name the parameter **original_text**.
4. (Optional) Add a display name to improve clarity for users interacting with the command.
5. (Optional) Provide a description to clarify the purpose of the input parameter.
6. (Optional) Add sample data to illustrate expected input.
7. Click the **+ Add**button.
6. Enable the command for use in a playbook.
.png?cb=937c62f926912ba08e0b1df5d7242f89)
1. Navigate to the **Settings**tab.
2. Select the **Command Task**checkbox.
3. Click the **Submit**button.
4. Click the **Submit**button on the pop-up window.
**RESULT**
Users will be able to find and use this custom utility command as a command task in a playbook. If the command executed successfully, users can click the .png?cb=8ff612c9c27455084f991bc5774e5cf1) button to view the translated text.
.png?cb=0a7894490efe2286b6115dd3787c5dff)
The original and translated texts shown on the Result tab.
### **Site-Level Artifact Segregation for Client Sites**
.png?cb=5adcee2c18f54a085ec6f3a6332d4ce0)
The same artifact appearing on different client sites (e.g., TW Client 1 and TW Client 2) is now treated as a distinct entity on each site. While the artifact value is identical, each instance has a unique artifact ID, clearly indicating separation between client sites.
Artifacts are now scoped to individual client sites to enforce strict data isolation. Identical artifacts detected across different client sites are treated as distinct entities, ensuring that artifact data remains confined to the site where it originated. Existing identical artifacts previously ingested across client sites are now also treated as separate entities within their respective sites.
### **Mitre Tactics and Techniques Feature Now Supports New TAXII 2.1**
.png?cb=4bb525789947c75d5a21e4c465906d41)
The Update Mitre Tactics and Techniques feature now uses the latest TAXII 2.1 API, enabling faster retrieval, improved filtering, and more reliable synchronization of MITRE ATT\&CK data.
## **Utility Commands**
### **Updated Commands**
The following utility commands have been updated in this release of D3 SOAR.
|----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| **Update Identical Event** | A new parameter, Skip Event Creation, has been added, allowing updates to identical events without creating or dismissing new ones. When enabled, the system updates the existing event and records the update in the ingestion log and event note, including the event ID and a link to the associated playbook execution for reference. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| **FortiEDR** | FortiEDR is an Endpoint Detection and Response (EDR) solution developed by Fortinet that provides real-time threat prevention, detection, and automated response on endpoints such as desktops, laptops, and servers. |
| **Syslog Sender** | The Syslog Sender integration enables sending event data to a specified remote syslog server using either TCP or UDP, with messages formatted in RFC 5424. It supports both plain text and structured JSON messages, and dynamically calculates priority based on the configured log level and facility. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|---------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **Cisco Adaptive Security Appliance** | **Connection** * Connection logic has been enhanced to better support REST API, HTTP Automation Interface, and SSH connection methods based on Cisco ASA instance configuration. |
| **Cortex XDR** | **New Command(s)** * Cancel Scan Hosts * Create Indicator * Get Action Status * Get XQL Query Results * Retrieve Files * Retrieve PCAP Packet * Scan Hosts * Start XQL Query |
| **Observe Data Ingestion** | **New Command(s)** * Ingest Over HTTP |
| **Prisma Cloud** | **New Command(s)** * Dismiss Alerts (replaced the Dismiss Alerts command) * Remediate Alerts * Test Connection **Deprecated Command(s)** * Dismiss Alerts (replaced by the new Dismiss Alerts command) |
| **SentinelOne** | **Updated Command(s)** * Fetch Event: Added the Threat Time Fieldoptional parameter to filter threat data. |
| **Telegram** | **New Command(s)** * Create Webhook * Fetch Event (for event ingestion via webhook only) * Remove Webhook |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.3.3
## **Utility Commands**
### **Updated Commands**
The following utility commands have been updated in this release of D3 SOAR.
|-----------------------------|---------------------------------------------------|
| **Commands** | **Changes** |
| **Get User by Full Name** | The returned data now includes group information. |
| **Get User with User Name** | The returned data now includes group information. |
## **Integrations**
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **SSH** | **Connection** * Added the Banner Timeout parameter to the connection form to set how long the SSH client can wait for the server's banner. The default value is 15 seconds. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.3.4
## **New Features**
### **Consolidated Tenant Incidents View**
Previously, master tenant users in distributed multitenancy environments could not view incidents from all tenant instances in a single location. The new **Tenants** view addresses this by providing a unified incident list, allowing centralized visibility and more efficient monitoring across all tenant instances.
Enabling the Tenants View
To enable the Tenants view on the investigation dashboard, administrators must select the **View Tenant's Incident** permission scope under the new **Tenant** permission group.
.png?cb=fd0a43b1d87a71568187c9c4cceb1170) Hiding the Incidents Accordion in the Master Instance
Users can also select the **Hide Master's Incident** scope to remove the entire Incidents accordion from the master tenant. This is useful in cases where an analyst is responsible for incidents in only tenant instances, but not those in the master instance.
.png?cb=81527ebbf3b61938a60c238d874f3d19)
**Hide Master's Incident Unchecked**
.png?cb=2af32f9b0a876654030d1f79aaba41d3)
The Incidents accordion is accessible.
.png?cb=54f232b061c2514d09f90e897a60c174)
**Hide Master's Incident Checked**
.png?cb=5d1b50b41601ccbe7514149fd1327d1e)
The Incidents accordion is no longer accessible.
.png?cb=9d4be70da1c91be2fc30654708491668)
### **Custom Incident Status**
Users are no longer limited to the default incident statuses provided out of the box. They can now define custom incident statuses to accommodate specific operational requirements.
.png?cb=a3d7730a106b219af97650a87a40519f)
Adding a Custom Incident Status
Users can add custom incident statuses by navigating to **Configuration** \> **Application Settings** , selecting the **Incident Statuses** setting, and clicking the **+ New Status** button.
.png?cb=4a14bb1d717d1d753dc70248d0df8fdd)
**READER NOTE**
* Users can add up to 10 custom incident statuses.
* Incident status names cannot exceed 20 characters.
* System incident statuses cannot be modified or deleted.
## **Integrations**
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|----------------------|------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **Claroty** | **Enhanced Command(s)** * New commands have been created using the existing integration resource to replace all original commands. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.3.6
## **New Features**
### **Built-In Syslog Forwarding**
.png?cb=0473ba034314ff72a08124eb385d2135)
Syslog forwarding from D3 to third-party SIEM applications has been available through the [**Syslog Sender**](https://docs.d3security.com/integration-docs/integration-docs/syslog-sender) integration. This update adds a built-in option in **Configuration** \> **Application Settings** \> **SIEM Log Synchronization** that automatically sends logs every minute via a job queue, including user login attempts, incident changes, role and permission updates, playbook changes, and Proxy Agent logs.
Configuring Syslog Forwarding from Application Settings
.png?cb=ec4f9f21dd90e5a2eda97b492c485636)
1. Click the **+ Add Siem Log Configuration** button.
2. Input the hostname and port.
3. Select the protocol (UDP or TCP).
4. Select the **Enabled**checkbox.
5. Save the settings to enable automated Syslog generation and forwarding.
6. Verify log ingestion in the third-party SIEM by performing test actions in D3 and monitoring real-time feeds.
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
|----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| **Cancel Connected Tasks** | This command can cancel any tasks before it in the same path. For a task to be canceled, it must meet three conditions: 1. The task must be linked and precede the **Cancel Remaining Connected Tasks** command. 2. The task must be in the same playbook instance as the **Cancel Remaining Connected Tasks** command. 3. The task must be on the same execution path as the **Cancel Remaining Connected Tasks** command. This command ensures that any unresolved tasks are automatically canceled, helping to maintain the integrity of the playbook execution and prevent unintended behavior. View Example scenario Use the **Cancel Remaining Connected Tasks** command to terminate an escalation path when vendor support responds to a help request within 24 hours. Consider the following playbook:  The playbook automates vendor support outreach with a fallback escalation path set to execute after a delay of 24 hours. It has two parallel execution paths: * **Path A -- Email Sent to Support**  If the vendor responds within 24 hours, this path proceeds and reaches the **Cancel Remaining Connected Tasks** command first. Therefore, the escalation path (i.e., the bottom two tasks) is canceled since no escalation is necessary. * **Path B -- 24-Hour Timeout and Escalation** .png?cb=3c98a95ccc58f85fb691c3c46bc25031) If the user receives no response or a delayed response from vendor support, this path reaches the **Cancel Remaining Connected Tasks** command first to trigger the escalation task (represented as a stage task node). This sample workflow ensures a single resolution, preventing redundant actions and minimizing operational overhead and expenses associated with escalation. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.3
## **New Features**
### **Dashboard Auto-Refresh on New Events or Incidents**
Previously, users were required to manually refresh the reporting dashboard, or click the -20250529-195945.png?cb=ccfc12ed01a5700ba36d183fb1e2c55f) button on a persistent "Dashboard Update Available" banner, to view new data. The dashboard now supports live auto-refresh, automatically updating widget visualizations when new events or incidents are detected. This behavior can be enabled via the new **Auto-reload on new data** toggle.
### **New Permission Scope: Create New Tag**
-20250529-195347.png?cb=73e30928c0509580ddf9e79354ffed5d)
The ability to create new tags is now restricted to users with the **Create New Tag** permission. Users without this scope can still add tags to incidents from a predefined list.
Adding the Permission
1. Navigate to **Configuration** \> **Organization Management** \> **Roles** \> **\[Select Role\]** \> **Details** \> **Operational Modules** \> **Incident**.
2. Select the **Create New Tag** checkbox to grant the tag-creation permission to the selected [++**role**++](https://docs.d3security.com/user-docs?contextKey=Roles&version=latest).
### **Retry Mechanism for Missing Events During Connectivity Interruptions**
A new **Retry** mechanism enables automated retries during connectivity interruptions. It re-fetches event or incident data in chronological order, up to a user-defined limit, after the main ingestion job resumes normal operation.
Enabling the Retry Mechanism
Users can enable the retry mechanism for a new data ingestion job in the following steps:
1. Select the **Initiate the buffer time of the Data Reacquire for \ minutes after completing the event fetch** checkbox to display the retry mechanism checkbox.
2. Select the **Enable data retry \ times if the ingestion job fails or completes with errors**checkbox to activate automated retries for fetching event or incident data.
3. (Optional) Configure the retry attempt limit (e.g., 5).
*** ** * ** ***
If an ingestion fails, the retry mechanism activates automatically. Users can view the retry results upon success by clicking the  button.
## **Enhancements**
### **Email Reporting Across Multiple Sites**
Previously, within the Reporting Dashboard module's Email Scheduler sub-feature, users had to create individual email schedules for each site, as there were no options to send a dashboard that included data from multiple sites. This enhancement introduces two new options, "All Internal Sites" and "All Client Sites," enabling users to distribute dashboards with data from all internal or client sites without needing to send them individually.
Customizing Sites for "All Client Sites" and "All Internal Sites" Options
The "All Internal Sites" and "All Client Sites" options will include all sites the dashboard owner has access to at the moment the snapshot is generated. To adjust which sites are included in these options, the settings can be configured in the **Organization Management** \>**Users**sub-module.
### **Access Control Applied to User-Based Dropdown Filters**
User-related dropdown filters in the Reporting Dashboard have been enhanced to show only users associated with the selected site. This improvement simplifies the filtering process and makes it easier to find relevant users.
Applying User-Based Dropdown Filters
The improvement on the user-related dropdown filters works as follows:
1. Select a site to view the reporting dashboard.
2. Click the user-related filter (such as the Incident Owner filter) on a relevant widget.
3. Choose one or more users associated with the selected site to filter the displayed data.
List of User-Based Dropdown Filters
The following widget column filters are subject to access control:
* Event Assigned By
* Event Disposed Action By
* Event First Assigned By
* Event Investigator
* Incident Assigned By
* Incident Closed By
* Incident Creator
* Incident Investigation Team
* Incident Owner
* Incident Reopened By
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
|------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| **Get JSON Of Current Event Automation Rules** | Displays Event Automation rules in JSON format. Filters include rule type ("Escalation", "Dismissal", or "All") and the option to filter by active or both active and inactive rules. By default, it retrieves both rule types and only includes active rules. |
## **Integrations**
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **Cisco Identity Services Engine** | **New Commands** * Get Endpoint Details * List Endpoints |
| **Cortex XDR** | **New Commands** * Get Script Results * Get XQL Query Quota * Get XQL Query Results Stream * Run Script **Enhanced Command(s)** * Isolate Hosts: Updated the request body format to reflect the latest API payload changes. * Unisolate Hosts: Updated the request body format to reflect the latest API payload changes. |
| **Freshservice** | **Enhanced Command(s)** * Close Tickets: Added the Bypass Mandatory Fields, Resolution Note, and Additional Mandatory Fields parameters. * Resolve Tickets: Added the Bypass Mandatory Fields, Resolution Note, and Additional Mandatory Fields parameters. * Update Tickets: Added the Bypass Mandatory Fields parameter. |
| **Google Drive** | **Enhanced Command** Upload Files: Users can now upload files from vSOC to a specific folder using the Parent Folder ID parameter. |
| **Microsoft Entra ID Protection (Azure AD Identity Protection)** | **Enhanced Command** Fetch Event: Added the **Risk Users** dropdown option to the Event Type parameter for the newly added Event Source for Risk User event source. |
| **Office 365** | **Enhanced Command** Fetch Events: Revised the display names for the following built-in field mappings (source fields): * $..originalMessageFile\[\*\].attachment\[\*\].md5 * $..originalMessageFile\[\*\].attachment\[\*\].sha1 * $..originalMessageFile\[\*\].attachment\[\*\].sha256 |
| **Stamus Clear NDR** | **New Command** Fetch Incidents |
| **Wiz** | **Enhanced Command** Fetch Event: Updated the command to align with recent API changes. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.4
**Effective Beginning August 2025**
* SAML login authentication configuration requires the following changes on the IdP side:
* The service provider identifier (entity ID) value must end with `/VSOC/D3SOC`
* The field corresponding to **Assertion Consumer Service URL** in D3 vSOC must end with `/VSOC/D3SOC/D3SAML`
* Versions 17.4.0+ include the following temporary limitations:
* All agents stop functioning unless upgraded
* All agent upgrades must be performed [**manually**](https://docs.d3security.com/user-docs/?contextKey=PerformingAManualAgentUpdate&version=latest).
* The following features are temporarily unavailable, scheduled for restoration in an upcoming patch:
* E-alerts
* Multi-tenant cross-origin site iframes on the master site
## **New Features**
### **Access Control for Tenant Management**
Previously, the Administrator role token for the General access type applied broad permissions that included implicit access to the Tenant Management module. The new Tenant Management role token introduces granular access control for tenant-related features. Users on a master vSOC instance with the **Tenant Management**token enabled will see the Tenant Management module unhidden in the Configuration page and will be able to execute all tenant-related commands.
### **Entra ID SAML Authentication and Role Mapping**
The new **Entra ID (Azure AD)** authentication type enables certificate-based SSO, with RBAC enforced in D3 based on user roles configured in Microsoft Entra ID.
How It Works
During authentication, Microsoft Entra ID issues a SAML assertion containing user claims, which D3 receives and processes. Among these claims, a role claim (configured with the `user.assignedroles` [**source attribute**](https://learn.microsoft.com/en-us/entra/external-id/customers/how-to-add-attributes-to-token#to-add-a-built-in-attribute-to-the-token-as-a-claim)) is required. Its name URI must be specified in the **Claim Name** field in D3.
-20250730-221054.png?cb=522879e3f06591a20503f1c24f8c43df)
User [**roles**](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps?utm_source=chatgpt.com#app-roles-ui) obtained via the role claim are matched against preconfigured D3 **Role Attribute Mapping** records to assign the corresponding D3 role at login.
-20250730-230225.png?cb=24ef449dc9f751461dd59a21c1965c8c)
If multiple matches are found, the D3 role from the record with the lowest Priority value is applied. If no match exists, login is denied.
### **New Configuration Key: Restrict d3key and d3jwt in URL Parameters**
Key Set to **False**(default): Allows passing d3key and d3jwt in URL parameters.
Key Set to **True**: Blocks d3key and d3jwt in URL parameters; requires credentials in HTTP headers.
A new configuration key controls whether users can pass **d3key** and **d3jwt**in URL parameters for API requests. When enabled (True), credentials must be included in HTTP headers; attempts to use URL-based authentication return a 403 Forbidden error. By default, the key is set to False to preserve compatibility with existing workflows.
To set this key to True, contact [++**D3 support**++](mailto:support@d3security.com).
### **New Reporting Dashboard Widget: Summary**
A new Summary widget is now available in the Reporting Dashboard. This widget allows users to select and display specific incident, event, or artifact fields, providing a high-level overview tailored to their needs.
View Details
**Creating a New Summary Widget**
1. Click the **+ New** button under **Reporting Dashboard** \> **Widgets**.
2. Select a data source.
The Summary widget is supported for all data sources.
3. Choose a site and date range for the data query, then click the **Run Query**button.
4. Click the **Next Step: Configure Widget** button, then select the **Summary**widget type.
5. Once on the Summary widget configuration page, users can:
1. Add tags to improve the widget's searchability on the Edit Dashboard page
2. Select specific fields and sub-fields to display a high-level overview of relevant data.
**READER NOTE**
Fields and sub-fields vary based on the selected data source. For a complete list, refer to [++**Fields Appendix**++](https://docs.d3security.com/release-notes/morpheus-releases/17-4.md#FieldsAppendix).
**RESULT**
A fully configured Summary widget may look like the following:
**Finding the Newly Configured Summary Widget**
After configuration, the widget appears under the Summary Widgets category on the dashboard creation page.
* If there are tags associated with this widget, users can search for it by selecting the defined tags from the **Tags: All** dropdown.
**READER NOTE**
On the Reporting Dashboard, this widget is displayed as follows:
 Fields Appendix
**Incident Data Source: All Available Fields**
* Key Fields
* Site
* Incident Type
* Status
* Severity
* Owner
* Create Time
* Last Modified Time
* Description
* Conclusion
* Linked Incident
* Incident Type
* Title
* Severity
* Status
* Owner
* Date Created
* Date Closed
* Linked Event
* Event Investigator
* Event Type
* Risk Level
* Status
* Description
* Site
* Data Source
* Ingested Time
* Note
* Incident Form
**Event Data Source: All Available Fields**
* Key Fields
* Risk Level
* Event Source
* Event Status
* Event Type
* Tactic
* Technique
* Event Ingestion Type
* Event Occurred UTC Time
* Event Ingested UTC Time
* Custom Fields
**Artifact Data Source: All Available Fields**
* Key Fields
* Artifact Name
* Artifact Type
* Risk Level
* Tactic
* Technique
* Event Count
* Incident Count
* First Seen
* Last Seen
* Last 10 Reputation
* Last 10 Related Events
* Last 10 Related Incidents
## **Enhancements**
### **General Enhancements**
#### **Controlled Site-Sharing for Users in Tenant vSOC Instances**
Previously, executing the [++**Create Tenant Site**++](https://docs.d3security.com/utility-command-docs/Working-version/create-tenant-site) utility command resulted in all tenant vSOC instance users receiving unintended visibility into all master vSOC sites. Now, a new **Select Sites** interface in **Tenant Management \> Shared Content \> Users / Groups / Roles** enforces site-level access isolation. Within this interface, site selections are isolated per user and do not affect other users in the same or different tenant vSOC instances. Running the utility command now only makes additional sites available for selection in the Select Sites interface--no sharing occurs until the administrator clicks the %201%20(1)-20250730-215314.png?cb=60f84a9d43a7c86ff0b9010094d1ee94) button.
#### **Improved Table Readability in Incident Workspace Widgets**
.png?cb=b255561ee4809721ff22799e08926d8a)
Content within HTML tables in Incident Workspace widgets now wraps by default when collapsed, eliminating the need for horizontal scroll bars. This enhancement improves readability for large or multiline values displayed in table cells.
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
|----------------------------|---------------------------------------------------------|
| **Commands** | **Functionality** |
| **Extract Event Artifact** | Retrieves all artifacts linked to a specified Event ID. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| **Corelight** | Corelight is a cybersecurity company that provides network detection and response (NDR) solutions based on the open-source Zeek (formerly Bro) network monitoring framework. Corelight transforms network traffic into rich logs, extracted files, and security insights, making it easier for SOC analysts, threat hunters, and incident responders to detect and investigate threats. |
| **CyberArk Privileged Access Manager** | CyberArk's Privileged Access Manager (PAM) solution allows organizations to manage, control and monitor activities across all types of privileged identities. |
| **Cyderes** | Cyderes positions itself as an MSSP that combines people, process, and platform---powered by AI and expert operations---to provide proactive cybersecurity, strong identity management, and rapid incident response capabilities. |
| **ExtraHop RevealX 360** | RevealX 360 is a SaaS NDR platform that captures real-time, agentless wire data via lightweight sensors and delivers unified visibility, behavioral analysis, and threat detection across on-premises, hybrid, and multicloud environments. |
| **iBoss** | iBoss is a cloud-based cybersecurity platform that provides secure web gateway services, helping organizations protect users from internet threats by controlling and monitoring web traffic. It supports advanced web filtering, threat protection, and data loss prevention across distributed networks. |
| **Kaseya's DarkWebID** | Kaseya DarkWebID is a dark‑web monitoring and threat intelligence platform designed to help organizations detect if their domains, email addresses, passwords, or other sensitive data have been exposed or compromised online. |
| **Silent Push** | Silent Push is a cybersecurity platform that provides Threat Intelligence (TI) and threat detection and response services. It is designed to proactively identify and analyze malicious infrastructure, phishing campaigns, malware distribution, and suspicious domains. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **AWS Security Hub** | **New Commands** * Batch Update Findings |
| **ChatGPT** | **Connection** * Changed the API Version parameter from required to optional. |
| **CrowdStrike** | **New Commands** * Run Batch Get |
| **Delinea Secret Server (Thycotic Secret Server)** | **Name** * Renamed Thycotic Secret Server to Delinea Secret Server. **New Commands** * Fetch Secret by ID |
| **Manage Engine ServiceDesk Plus** | **Connection** * Refined the connection logic to support connectivity with all data centers. |
| **Office 365** | **Enhanced Commands** * **Search and Move or Copy Email Messages**: Renamed from Search and Move Email Messages to reflect its updated functionality. The command now includes the ability to copy email messages. A new input parameter, Move or Copy, lets users select the desired operation. |
| **Recorded Future-SecurityTrails** | **New Commands** * Apply Tags to Asset * Create Tag * Find Assets * Get Asset Details * Get Exposure Assets * Get Tags * List Asset Exposures * List Exposures * List Projects * Remove Tags From Asset |
| **SentinelOne** | **New Commands** * Get Threat Notes * Update Threat Note |
| **TAXII 2 Threat Feed** | **Connection** * Added the Client Certificate authentication type. **New Commands** * Fetch Event (replaced the old Fetch Event command) **Deprecated Commands** * Fetch Event (replaced by the new Fetch Event command) |
| **Trend Vision One v3.0** | **New Commands** * Collect Files * Disable User Accounts * Enable User Accounts * Force Sign Out * List Custom Scripts * List Response Tasks * Reset Passwords * Scan for Malware * Submit Files to Sandbox * Terminate Processes * Upload Custom Scripts |
### **Deprecated Integrations**
|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Replacement** |
| **CrowdStrike Falcon (Deprecated)** | **CrowdStrike** : The new **Run Batch Get** command consolidates and improves on the functionality of the following CrowdStrike Falcon command: * Run Batch Get |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.4.7
## **Integrations**
### **Updated Integrations**
Changes have been made as a result of the CrowdStrike Detects API end of life. The following are the changes.
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **CrowdStrike** | **New Command(s)** * Fetch Incident **Enhanced Command(s)** * **Fetch Event**: Updated API endpoints to align with the latest CrowdStrike API changes. * **Test Connection**: Updated API endpoints to align with the latest CrowdStrike API changes. **Deprecated Command(s)** * Update Detections (use the Update Alerts command instead) * Get Detections for Incidents |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.5
## **New Features**
### **Point-to-Point vSOC Instance Synchronization**
An Instance Management module has been introduced as an alternative to the Tenant Management module. The key distinction is that the Instance Management module operates within a point-to-point system architecture. Unlike the master-tenant model, no instance serves a central or controlling role---all instances can directly exchange data with one another.
How to Sync Resources Across vSOC Instances
In the vSOC instances that receive content:
1. Generate an instance key.
1. Navigate to the **Configuration**module.
2. Click on on **Application Settings**menu option.
3. Click on the**Instance Registration** selection.
4. Click on the **Generate a New Key**button.
-20251008-205411.png?cb=3097cd97f2ded9fd7616b865022ed69f)
2. Add the new key.
-20251008-194101.png?cb=f78335c64c96199d9a7bb3e3e4e4b4b8)
1. Click on the **Generate New Key** button.
2. Securely store the key.
3. Click on the **Add**button.
*** ** * ** ***
In the vSOC instance that shares content:
3. Navigate to **Configuration \> Instance Management \> Instances** , then click the **+ Add Instance** button.
-20251008-200732.png?cb=b2ce4c46d018ab567f9f8ad0b16ea054)
-20251008-200814.png?cb=c071bad4033ac5cfc48b2975bc01a273)
-20251008-200843.png?cb=32d00d1af24651b8314a9ace227091ea)
4. Enter the URL and [**key**](https://docs.d3security.com/release-notes/morpheus-releases/17-5.md#SyncInstanceStep2) of the receiving vSOC instance, then click on the **Register and Initiate** button.
-20251008-201434.png?cb=25dffbdb5d07aeba026a8ae993ba970a)
5. Verify that the connection status is displayed as %201-20251008-202104.png?cb=ffb8c165f906544ae736b676004df1be) , then click on the **Shared Content** tab.
-20251008-201736.png?cb=ddfc930f0391d41748e227ba62f12973)
6. Select the instance, choose the content to share, then click on the **Share**button.
-20251008-204703.png?cb=67e7d02c17d931a9448cfcf5a3bf94e8)
**READER NOTE**
The new point-to-point model does not currently support [**synchronization of artifact type**](https://docs.d3security.com/release-notes/morpheus-releases/17-5.md#SyncingAnArtifact) configurations.
**READER NOTE**
* This new model and the master-tenant model are mutually exclusive.
* Contact [**D3 Support**](https://d3security.com/company/contact/) or the designated product manager to enable the point-to-point vSOC infrastructure.
### **Quick Actions in the Incident Workspace**
Quick actions in the Incident Overview panel enable users to run integration or utility commands with custom parameters directly from the workspace header. Administrators can configure these actions for ad hoc execution, enhancing efficiency and usability without navigating through the full Execute Command interface.
Refer to [**Using Quick Actions**](https://docs.d3security.com/user-docs/?contextKey=UsingQuickActions&version=latest) for detailed documentation on Quick Actions.
### **Exporting Reporting Dashboards as PDF**
The export-to-PDF feature enables users to export reporting dashboards in PDF format. Users can customize the export by defining the overall report name, uploading a logo, selecting dashboards to exclude (by default, all dashboards are included), and configuring chart sizes, names, and descriptions. Chart sizes, names, and descriptions can be customized per chart.
How to Export a Reporting Dashboard
Users can find the option to download a reporting dashboard as a PDF in the following steps:
1. Navigate to the **Reporting Dashboard**module, then click on the dashboard to export.
2. Click on the  icon, then select the **Export (.pdf)** option.
3. Configure the basic details.
1. Name the report.
2. Upload a logo.
3. Add a note describing the purpose of the report.
4. Select the **Include Data Table chart as CSV file in export** checkbox to download an additional CSV file containing the underlying data of [**unhidden Data Table widgets**](https://docs.d3security.com/release-notes/morpheus-releases/17-5.md#Step4b).
The file contains only a limited subset of the data.
4. Customize the charts (widgets) in the report, then export it.
-20251003-233115.png?cb=d314336545c40eea6d041298b1c1fd35)
1. Reposition a chart using the  grab handle.
2. Click on the  icon to include or exclude a widget from the PDF.
3. Click the  icon to:
* Rename the chart
* Modify the chart description
* Resize the chart
4. Click on the **Export**button to download the PDF report and any accompanying CSV files.
## **Enhancements**
### **General Enhancements**
#### **Expanded Configuration Audit Logging Coverage**
Configuration audit logging, viewable via the [**Get D3 Log**](https://docs.d3security.com/utility-command-docs/Working-version/get-d3-log) utility command, has been expanded to capture a wider range of user activities.
View Additional Logged Items
##### **Agent Management \***
* Agent creation
* Agent deletion
* Agent data modification
* Agent status change (Connected/Disconnected)
##### **Application Settings \***
* Ad Hoc Task Configuration modification
* Login Authentication modification
* Artifact Type Visibility modification
* Dashboard Columns modification
* Logo Customization modification
* Incident Statuses modification
* Email Domain Whitelist modification
* Temporary Login Lock modification
* Enforce Password Policy modification
* ROI Configuration modification
* SIEM Syslog Configuration modification
* SLA List modification
* Web Config modification
* Date/Time Format modification
* SMTP Server and Email modification
* Sorting Options modification
* Update Mitre Tactics and Techniques modification
* Playbook Input Method modification
* E-Alert modification
##### **Artifacts \***
* Artifact type creation
* Artifact type deletion
* Artifact type modification
* Fields for Extracting Artifacts creation
* Fields for Extracting Artifacts modification
* Fields for Extracting Artifacts deletion
* Fields for Additional Information creation
* Fields for Additional Information deletion
* Artifact relationship creation
* Artifact relationship deletion
##### **Commands \***
* Python library saves
##### **Global Lists \***
* Global list creation
* Global list deletion
* Global list data modification
##### **Incident Type Manager \***
* Incident form creation
* Section modifications within the incident form builder
##### **Integrations \***
* Connection creation
* Connection modification
##### **Playbooks \***
* Preprocessing playbook deletion
* Investigation playbook deletion
#### **Cross-Instance Data Synchronization for Artifacts and Incident Types**
Artifact types, artifact relationships and incident types can now be synchronized across vSOC instances. Incident type synchronization is supported across both the [**Instance Management**](https://docs.d3security.com/release-notes/morpheus-releases/17-5.md#P2PInstanceSynchronization) and Tenant modules, while artifact type and relationship synchronization is available only through the latter one.
Artifact Synchronization
**READER NOTE**
Artifact type synchronization is currently supported only under the master-tenant synchronization approach. The [**point-to-point approach**](https://docs.d3security.com/release-notes/morpheus-releases/17-5.md#P2PInstanceSynchronization) does not support this capability.
1. Navigate to the **Configuration** \> **Tenant Management** \> **Shared Content** \> **Artifacts**.
-20251010-191333.png?cb=535cf8d486c772dbaf8d831e9be241d8)
-20251010-212135.png?cb=48793625b5134ee4f1b0924c3e5c2dfc)
2. Share the desired artifact types and relationships.
* Sharing artifact types:
*This does not share artifact relationships. See the next bullet point.*
* Sharing artifact relationships:
-20251011-001028.png?cb=9b3fc99ab8152cdf4da987212fe540c9)
*The selected relationships are shared together with all associated artifact types' data. If configured with a* [***Source Condition***](https://docs.d3security.com/user-docs/?contextKey=ArtifactRelationships&version=latest#SourceConditions)*, the associated integration is also shared.*
3. Share EFM [**artifact settings**](https://docs.d3security.com/user-docs/?contextKey=ArtifactInstantiations&version=latest#id-(dummy)ArtifactInstantiations-ArtifactSettings) (after successfully synchronizing artifact types).
**READER NOTE \***
Ensure that -20251010-225201.png?cb=6282667ec05d7c9c3fe99b227bacbb10) appears under the **Shared to Tenants**column for the shared artifact types before attempting to synchronize EFM artifact settings.
Incident Type Synchronization
1. Navigate to the **Configuration** \> **Tenant Management** \> **Shared Content** \> **Incident Types**.
-20251010-191333.png?cb=535cf8d486c772dbaf8d831e9be241d8)
2. Select the desired incident types to share or update, then click on the **Share**button.
#### **System Widgets Date Range Alignment**
-20251015-211501.png?cb=3fe441095c7bc22e1eac6bd5b279419c)
Enhancing user control, operational transparency, and insight generation, system widgets within the Reporting Dashboard now dynamically align data with the user-selected date range.
View Affected System Widgets
The following system widgets are affected:
* Event Playbook Error Rate By Playbook Name
* Failed Connection Count by Integration Name
* Incident Playbook Error Rate By Playbook Name
* Investigator Performance Summary
* Max Task Execution Time by Playbook Name
* Pending Task Count By Investigator
* Playbook Error Rate By Creator
* Playbook Error Rate By Incident Type
* Task Execution Count Per Minute by Playbook Name
* Total Command Execution
* Total Task Execution Hours by Playbook Name
**READER NOTE**
If no date range is selected, the widget defaults to data from the last 7 or 30 days.
### **Tenants View Enhancements**
#### **Auto-Refreshing of the Master Instance Tenants Dashboard**
Tenant vSOC Instance
Master vSOC Instance
Previously, although the backend processed tenant changes immediately, users had to refresh the master instance's Tenants dashboard to the view updates. Data updates in tenant instances now, without manual refresh, reflect in the master instance with near real-time visibility.
#### **Default Site for the Master Instance Tenants Dashboard**
-20251016-003637.png?cb=bf1ec25b0f05adbac1e30da79c2ed421)
The default site displayed within the **Investigation Dashboard** \> **Tenants** view has been updated. The dashboard now defaults to **All client sites**.
#### **Additional Incident Attributes in the Tenants Dashboard**
The **Investigation Dashboard** \> **Tenants**view now includes three additional incident attribute fields:
* Incident Type
* (Incident) Owner
* Disposition
## **Utility Commands**
### **Updated Commands**
The following utility commands have been updated in this release of D3 SOAR.
|--------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| Add to Global List | These commands no longer return Context Data. The Return Data remains unchanged. |
| Update Global List | These commands no longer return Context Data. The Return Data remains unchanged. |
| Get User by Full Name | The structure of the returned data has been modified to include the additional "groups" array. View Return Data JavaScript { "error": "", "returnData": [ { "userID": *****, "userName": "demoUserName", "firstName": "demoFirstName", "lastName": "demoLastName", "fullName": "demoFullName", "timezone": "Pacific Standard Time", "timezoneId": *****, "roleDescription": "System Administrator", "email": "*****@*****.com", "phone": "**********", "role": "admin", "groups": [ "Administrative Group", "Administrators", "Analysts", "Managers", "Security Operations" ] } ] } |
| Look Up Artifact Details | The **Include Reputation Information** parameter has been added. * When set to True, the command returns artifact reputation results. By default, the parameter is set to False. * The command allows users to retrieve artifact reputation information that has been added or updated using the **Add or Update Artifact Reputation** or a check reputation command (e.g., VirusTotal v3's **Check IP Reputation**). **READER NOTE** If the **Include Reputation Information** parameter is set to True, the command also returns the artifact reputation expiry date. To enable this functionality, contact D3 support to set the **EnableArtifactReputationUpdateByIntegrationCommand** key to True. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| **Absolute** | Absolute is a cybersecurity platform that provides persistent endpoint security and visibility, allowing organizations to track, manage, and protect devices---even if they're off-network or compromised. |
| **Axonius V2** | The Axonius Platform serves as the system of record for all digital infrastructure, enabling IT and security teams to gain a complete understanding of assets, their relationships, and business context. The D3--Axonius integration enhances this capability by allowing seamless discovery of devices, users, and other critical assets. |
| **Colortokens Xshield** | ColorTokens Xshield is a Zero Trust microsegmentation platform that provides asset visibility, dynamic policy enforcement, and real-time quarantine. It helps organizations isolate threats, reduce lateral movement, and strengthen security across cloud and on-prem environments. |
| **Infoblox NIOS** | The Infoblox NIOS automates the error-prone and time-consuming manual tasks associated with deploying and managing DNS, DHCP, and IP address management (IPAM) required for continuous network availability and business uptime. |
| **Netskope V2** | Netskope solutions, including Netskope Intelligent Security Service Edge (SSE) are built on the Netskope Security Cloud, providing unrivaled visibility and real-time data and threat protection when accessing cloud services, websites, and private apps from anywhere, on any device. This integration leverages Netskope REST API v2. |
| **Trustwave Fusion** | Trustwave Fusion is a cloud-native cybersecurity platform that centralizes threat detection, incident response, and compliance management. It provides a unified interface where customers can manage tickets, track investigation status, exchange comments, and securely handle attachments. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| **Active Directory V2** | **New Command(s)** * Get AD User By SID |
| **Atlassian Jira Software** | **New Command(s)** * List Users Assignable to Issue **Enhanced Command(s)** * **Assign Issue to User** : Updated the **Assignee** parameter to accept account IDs in addition to names. The display name has also been changed to **Assignee ID or Account Name**. * **Create Issue** and **Edit Issue**: Updated the same parameter as Assign Issue to User. |
| **Connectwise PSA** | **New Command(s)** * Merge Tickets |
| **Cortex XDR** | **New Command(s)** * Add IOCs * Delete IOCs * Get IOCs * Update IOCs |
| **Elastic Security** | **New Command(s)** * Get Case by ID * Get Case Settings * Update Case |
| **Google Chronicle** | **New Command(s)** * List Curated Rules **Enhanced Command(s)** * **Fetch Event**: Added the Curated Rule Detections event type. |
| **iboss** | **New Command(s)** * Lookup URL |
| **Microsoft Teams Bot Framework** | **Connection** * Added a new Bot App Type parameter to support single-tenant Azure bots following Microsoft's deprecation of multi-tenant bot creation. |
| **Slack** | **New Command(s)** * Send Interactivity |
| **Wiz** | **New Command(s)** * **Add Issue Comments**: Replaces the old command with the same name: **Enhanced Command(s)** * **Update Issues**: Added a Resolved option to the Status parameter, along with new Resolve Reason and Resolution Note parameters. **Deprecated Command(s)** * **Add Issue Comments** : Renamed **Add Issue Comments (Deprecated)** and replaced by the new **Add Issue Comments** command. |
| **Zscaler** | **New Command(s)** * Remove URLs from Category |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.6
## **Enhancements**
### **Custom Utility Command Categories**
Users can now add, delete, and modify custom categories for utility commands. In edit mode, custom utility commands can be assigned to custom categories by specifying category names in the Command Category section.
### **Event Dismissal Notes**
Users can now select a reason code and enter a dismissal note when dismissing an event. These fields are available both as input parameters in the Dismiss playbook task and in the Dismiss Event popover for manual dismissals. Custom reason-code options can be configured in the **Configuration** \> **Application Settings** \> **Dismiss Event Reason Code** panel.
### **New Look for Global List**
The Global List page has been redesigned with a dedicated left navigation panel for browsing and searching specific global lists, along with tabbed Data, Permission, and Audit Log views. Global list data is now displayed as individual, collapsible JSON records to improve readability. Also supported are within-list JSON value searches, one-click exports for the filtered records or the entire list, and management actions (clone and delete).
### **Custom View Access Permissions**
The Edit View UI has been updated to better manage shared access after a custom view is created. Custom view owners can now remove viewers and promote users with viewer access to owner access. This change replaces the previous custom notification message UI with a default notification message.
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
|------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Get Incident Notes | Retrieves the notes for a specified incident. The command requires an incident number as input and returns a structured response containing the incident number, note ID, author, last-modified time (in UTC), and note content. |
| Edit Incident Notes | Updates an existing incident note. The command requires the note ID (returned by the [Get Incident Notes](https://docs.d3security.com/release-notes/morpheus-releases/17-6.md#GetIncidentNotes) command) and a new note content value, which will override the existing content for that incident note. |
| Stop/Remove Active Playbooks | Allows privileged users to stop and remove active incident playbooks. |
### **Updated Commands**
The following utility commands have been updated in this release of D3 SOAR.
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| Get Incidents | The Get Incidents utility command now supports filtering incidents by MITRE tactic and technique values. The Filter parameter accepts Tactic or Technique as field values. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Armis | Armis is a cybersecurity company that provides complete visibility and protection for all connected assets --- including IT, OT, IoT, and cloud devices. Its AI-powered platform identifies and monitors every device on a network, detects risks, and helps organizations secure their digital environments in real time. |
| Azure OpenAI | Azure OpenAI Service is a Microsoft-managed service that provides access to OpenAI's advanced language models through the Azure cloud platform. It enables developers and businesses to integrate powerful natural language processing (NLP) and machine learning (ML) capabilities into their applications, leveraging models such as GPT-4, GPT-3.5, Codex, and DALL·E. |
| Hunters SIEM | Hunters SIEM is a cloud-native, next-generation Security Information and Event Management platform designed to automate the entire TDIR (Threat Detection, Investigation, and Response) process. |
| MalwareBazaar | MalwareBazaar is a community-driven platform operated by abuse.ch for sharing and analyzing malware samples. It collects and distributes malware files submitted by researchers and security teams worldwide to support threat intelligence and malware research. Each sample is enriched with metadata such as hashes, tags, file type, and detection information, making it a valuable resource for identifying, classifying, and tracking malware campaigns. |
| Nozomi Vantage | Nozomi Vantage is a cloud-based platform that delivers real-time visibility, monitoring, and threat detection for OT, ICS, IoT, and IT environments. It centralizes security and network data from distributed sites, helping organizations detect anomalies, investigate incidents, and strengthen resilience across critical infrastructure. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| Anomali ThreatStream | **New Command(s)** * Approve Observables By Import Job * Create Threat Model * Get Import Job Status * Get Intelligence Enrichments * Get Observables From Import Job * Get Threat Bulletin Observables * List Import Jobs * List Threat Bulletins * Search Query * Search Threat Model * Update Threat Model |
| Atlassian Jira Service Management | **Connection** * Added support for connection via service accounts. |
| Atlassian Jira Software | **Connection** * Added support for connection via service accounts. |
| AWS S3 | **New Command(s)** * Update Bucket Object |
| ConnectWise PSA | **New Command(s)** * Add Ticket Attachments * Delete Ticket Attachments * List Ticket Attachments |
| CrowdStrike | **Enhanced Command(s)** * Added the Return UI Hidden Alerts parameter to query alerts hidden in the CrowdStrike Falcon UI for the **Fetch Event** , **Fetch Incident** , and **Search Alerts** commands. |
| Darktrace | **New Command(s)** * List AI Analyst Incident Events **Enhanced Command(s)** * **Fetch Event** :Added support for retrieving AI Analyst Incident Events and extended the Search Condition parameter to accept JSON object input. |
| Dell Secureworks Taegis XDR | **New Command(s)** * Query Events via Taegis SDK **Enhanced Command(s)** * **Fetch Event** :Added the Data Provider field to the default field mapping. |
| Elasticsearch | **Enhanced Command(s)** * **Fetch Event** :Added the Event Query Time Type parameter to let users select how event time ranges are evaluated and additional field mappings. |
| FortiGate | **New Command(s)** * Create Threat Feed * Get Threat Feed Entry List * List Threat Feeds * Refresh Threat Feeds * Update Threat Feed |
| Microsoft Defender for Endpoint | **New Command(s)** * Test Connection |
| Microsoft Defender XDR | The integration name was changed from Microsoft 365 Defender to Microsoft Defender XDR. |
| Office 365 | **Enhanced Command(s)** * Added delegated-permission support to enable access to shared mailboxes for the **Fetch Event** , **Fetch Related Events** , and **List Mail Folders** commands. |
| Silent Push | **Connection** * Added support for providing a Threat Check Access Key. This enables verification of whether an IP address or hostname appears in Silent Push Indicators of Future Attack. **New Command(s)** * Threat Check **Enhanced Command(s)** * Added the Threat Check input parameter to all existing commands to enable optional IOFA verification using the configured Threat Check Access Key. |
| Trellix McAfee ESM | **Connection** * Added support for specifying a login mode (AES or Base64) on the connection form. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 17.6.18
## **New Features**
### **Service Level Agreement (SLA) Module**
An SLA module has been introduced to enable users to define, enforce, and monitor incident response service-level commitments. Users can now configure SLA timers, fine-tune time goals, and set up automatic pre-breach and post-breach playbook workflows.
SLA Rule Configuration Overview
1. Configure the SLA timer start condition.
*In this example, the SLA timer for the Demo SLA rule starts when an incident is created. The rule, however, applies only if the conditions defined in*[**step 4**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step4)*are also met.*
2. Configure the SLA timer end condition.
*In this example, the SLA timer for the Demo SLA rule ends when the incident is assigned to a D3 user.*
3. Create an SLA profile.
*An SLA profile limits where an SLA rule can apply by restricting it to incidents from specific sites.*
4. Configure time target for the SLA and optional rule-matching conditions.
*Both the conditions defined here and the* [**SLA timer start condition**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step1)*must be fulfilled for the SLA rule to apply to an incident.*
5. Define SLA trigger points.
*The thresholds configured in this step trigger the automation workflows built in* [**step 6**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step6)*.*
6. Build automated SLA playbook workflows.
*Add task nodes to the relevant SLA playbook trigger branches to automatically execute custom logic when the trigger points configured in* [**step 5**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step5)*occur.*
-20260305-234736.png?cb=20752b3dcbf0186c565c0d9d3eb2faff)
Within the Runtime Log tab, users can view runtime details of incidents that matched a live SLA rule. These include SLA status, playbook runtimes, actual start and end times, planned end time, and elapsed time against the defined SLA goal.
### **Incident Dashboard SLA Rule Columns**
The Application Settings \> Dashboard Columns module now supports the SLA Rule custom column type for the incident dashboard, allowing administrators to display SLA-related metrics. Once configured, these [**custom columns**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#DisplayingTheCustomColumns) can be displayed in the corresponding sites within the **Investigation Dashboard** \> **Incidents** module.
Displaying the Custom Columns
SLA Rule custom columns can be displayed (or hidden) in the same way as other columns.
1. Navigate to the **Investigation Dashboard** \> **Incidents** \>**All Incidents** module.
2. Select the relevant site, then click on the**...** icon.
3. Select the desired custom column.
4. Verify that the column is displayed.
### **OAuth 2 Webhook Authentication**
OAuth 2.0 webhook authentication is now supported for more secure execution of D3 commands from external systems. Registering an OAuth application restricts command access to selected sites, users, groups, roles, integrations, and utility commands. The registration process generates a client ID and a one-time client secret, which can be used to obtain a bearer access token with expiration.
View Step-by-Step Guide
1. Navigate to **Configuration** \> **Application Settings** \> **OAuth Application Registration** module, then click on the **+ New Registration** button.
2. Enter an application name, then click on the **Next**button.
-20260311-014849.png?cb=399d23c4fd50113f010d96535891c8f3)
3. Configure site and principal access.
-20260311-014922.png?cb=3195bede37537d69331651f667af145f)
1. Select the sites in which the OAuth application is authorized to execute commands.
2. Select the users, groups, or roles as which the OAuth application is authorized to execute commands.
3. Click on the **Next**button.
4. Configure OAuth access for integrations and utility commands.
-20260311-014937.png?cb=58f66a063a1ef2e39d5e590c357b5dd1)
1. Select the integrations in which the OAuth application is authorized to execute commands.
2. Select the utility commands the OAuth application is authorized to execute.
3. Click on the **Next**button.
5. Review the OAuth application configuration, then click on the **Complete**button.
-20260311-014955.png?cb=bf6a7ad170cf7c86e4e9fbcb5f8858eb)
6. Configure token expiration settings and generate OAuth credentials.
-20260311-015012.png?cb=b3a94c3d5329da65b469c360a7095a26)
1. Enter the Access Token TTL in minutes.
2. Enter the Client Secret TTL in days.
3. Click on the **Get Credentials** button.
7. Securely store the OAuth credentials.
-20260311-015023.png?cb=9d58607b963f24f2658e52a5ce437534)
1. Copy the **Authorization URL** for use in [**step 8b**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step8b).
2. Expand the **Sample Request Body** section.
3. Copy the template object for use in [**step 8e**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step8b).
4. Copy the **Client ID** for use in [**step 8e**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step8e).
5. Copy the **Client Secret** for use in [**step 8e**](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step8e).
6. Tick the confirmation checkbox.
7. Click on the **Done** button.
8. Send a request to generate an OAuth access token.
-20260311-015043.png?cb=37b913205c428ab0e039d966ed42bb67)
1. Select the **POST**method.
2. Enter the **Authorization URL** obtained from [++**step 7a**++](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step7a).
3. Click on the **Body**tab.
4. Select the **JSON**format.
5. Enter the client ID and client secret copied in [++**step 7d**++](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step7d) and [++**step 7e**++](https://docs.d3security.com/release-notes/morpheus-releases/17-6-18.md#Step7e).
6. Click on the **Send**button.
9. Retrieve the OAuth access token.
-20260311-015115.png?cb=35ff08267e8419ff1d6f9ce9b68099db)
1. Copy the **access_token value** returned in the response body.
2. Click on the **Auth** tab.
10. Configure the request authorization using the OAuth access token.
-20260311-015129.png?cb=009e56626962e46283c9abfb445bfabb)
1. Select **Bearer Token** from the Auth Type dropdown.
2. Paste the **access_token value** from [++**step 9a**++](/release-notes/morpheus-releases/17-6-18.md#Step9a) into the Token field.
11. Navigate to the desired command, then retrieve the command request details.
-20260311-015148.png?cb=3b20438c9b37412e29e30fb82b421595)
1. Click on **Set up Instructions** under the **Webhook Authentication** \>**OAuth 2.0** section.
2. Copy the **request URL** for use in [++**step 12a**++](/release-notes/morpheus-releases/17-6-18.md#Step12a).
3. Copy the **request payload** for use in [++**step 12b**++](/release-notes/morpheus-releases/17-6-18.md#Step12b).
12. Execute the command using the OAuth access token.
-20260311-015242.png?cb=0ef4f530e9deec1f8ca62b8944c6bb88)
1. Paste the **request URL** from [++**step 11b**++](/release-notes/morpheus-releases/17-6-18.md#Step11b).
2. Paste the **request payload** from [++**step 11c**++](/release-notes/morpheus-releases/17-6-18.md#Step11c), then modify the values as required.
3. Click on the **Send**button to execute the command and receive the output data.
## **Enhancements**
### **D3 Forms Module**
The Forms configuration under **Advanced Settings** \> **E-Alert** is now also available through a dedicated module called D3 Forms. This means that for a corresponding form within the [**form portal**](https://docs.d3security.com/user-docs/?contextKey=D3Forms&version=latest#id-(dummy)D3Forms-_gr6ameadtqs7NavigatingtotheFormPortal), users will see the sections and form fields configured from the D3 Forms module. All other E-Alert settings remain configured under Advanced Settings \> E-Alert.
Rendering the D3 Forms Module
The D3 Forms module requires a specific role-based permission to render.
1. Navigate to the **Configuration** \> **Organization Management** \> **Roles** page.
2. Select the relevant role.
3. Tick the **D3 Forms** checkbox under the Configuration Modules section, then click **Save**.
**REMINDER**
After an E-Alert form submission, information from all non-attachment form fields appears in the **Description** widget of the associated incident workspace.
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Cyberhaven | Cyberhaven is a data loss prevention platform that monitors and protects sensitive data by tracking its movement across endpoints, applications, and cloud services. |
| Microsoft Defender XDR | Microsoft rebranded Microsoft 365 Defender as Microsoft Defender XDR to reflect its extended detection and response capabilities. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| Atlassian Confluence Cloud | **New Command:** * Get Content By ID: Retrieves Confluence pages, blog posts, comments, and attachment content by IDs. |
| Logpoint Director | **New Command:** * Update Incidents: Updates incidents in the LogPoint Director platform by applying actions such as close, comment, reassign, reopen, or resolve. **Enhanced Command:** * Fetch Incident: Retrieves incidents from the LogPoint Director platform based on specified criteria. |
| Microsoft Defender XDR | **New Command:** * Advanced Hunting V2: Uses advanced-hunting queries to examine up to 30 days of Microsoft Defender XDR event data across multiple Defender products to identify unusual activity, detect potential threats, and support response actions. Advanced Hunting V2 queries advanced hunting tables across more Microsoft Defender XDR products than the original Advanced Hunting command. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 18.0
## **New Features**
### **Morpheus Adaptive Tasking** 
A collapsible AI-driven investigation interface, [**Morpheus Adaptive Tasking**](https://docs.d3security.com/user-docs/?contextKey=MorpheusAdaptiveTasking&version=latest), is now available in the incident workspace. Users can create standard operating procedures (SOPs) to guide Morpheus-led investigations, generate step-by-step investigation plans, summarize incidents, execute quick actions, and track task progress. All actions require user confirmation, with stricter safeguards for high-impact operations.
### **AI Task Node** 
A new type of playbook task node, AI Task, has been introduced. Each execution path leading to the AI Task node contributes to evaluation and output. Supported use cases include data summarization, remediation guidance, and drafting communications for stakeholders. Users can configure a connection to use supported [**external models**](https://docs.litellm.ai/docs/providers), or leverage D3's built-in AI without additional configuration. Input data from upstream execution lineages will not be used for model training.
### **Attack Path Discovery Node** 
An Attack Path Discovery (APD) investigation playbook task has been introduced to aggregate and analyze data across [**supported integrations**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#SupportedIntegrations). The task dynamically determines runtime logic to construct attack-path timelines, summaries, key findings, remediation guidance, and graph data. Retrieved data are used by supporting utility commands to populate Morpheus AI widgets.
Example - Configuration and Return Data
objective Configure the APD task node in preparation for widget display.
1. Select a [**supported integration**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#SupportedIntegrations) or the (Auto Detect) option to limit execution to one [**integration**](#) or to determine the appropriate [**integrations**](#) to use, respectively.
2. Input the object, or [**Jinja expression**](https://docs.d3security.com/user-docs/?contextKey=JsonObject&version=latest#id-(dummy)JSONObject-jsonpath(json_path_string)) that evaluates to an object, containing initial alert data.
Sample data Source
{{PlaybookData | jsonpath('$.DataSource.incident.Events[*].EventData')}}
3. Input the connection names of all connected and supported integrations.
4. Run the playbook and observe the return data.
APD Return Data Structure
JSON
{
"Status": "",
"Data": {
"InvestigationSummary": {
"Overview": {
...
},
"KeyFindings": [
...
]
},
"AttackPathSummary": {
"Overview": {
...
},
"EntryVector": {
...
},
"WhyItMatters": ""
},
"RemediationSuggestion": {
...
},
"AttackPathTimeline": [
...
],
"InvestigationGraph": {
"Nodes": [
...
],
"Edges": [
...
]
}
}
}
5. Set up [**supporting utility commands**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#SupportingUtilityCommands) to populate incident workspace Morpheus AI widgets using the APD return data.
Supported Integrations
At release time, the following integrations, data sources and ingestion methods are supported:
* **Abnormal Security (Email)**
* Data Source: Alert
* Ingestion Method: Fetch Incident
* **Active Directory V2 (IAM)**
* Data Source: User Information
* Ingestion Method: N/A
* **Azure AD Identity Protection (IAM)**
* Data Source: Alert
* Ingestion Method: Fetch Event
* **CheckPoint Firewall (Network)**
* Data Source: Events
* Ingestion Method: Fetch Event
* **Cortex XDR**
* Data Sources: Endpoint, IAM, Vulnerability, Network
* Ingestion Method: Fetch Event
* **CrowdStrike (XDR)**
* Data Sources: Endpoint, IAM, Network, Vulnerability, DLP, Cloud, Email
* Ingestion Method: Fetch Event
* **Dell Secureworks Taegis XDR**
* Data Sources: Endpoint, IAM, Network, Cloud, DLP
* Ingestion Method: Fetch Event
* **IBM QRadar (SIEM)**
* Data Sources:
* Endpoint: Windows Event Log, Linux Event Log
* Network: Firewall Event
* IAM: Authentication Event
* Ingestion Method: Fetch Incident
* **LogPoint Director**
* Data Sources:
* Endpoint: Cortex XDR
* Network: Palo Alto Firewall, Cortex XDR
* Ingestion Method: Fetch Incident
* **LogRhythm Rest**
* Data Source:
* Endpoint: Sysmon Event
* Ingestion Method: Fetch Event
* **Microsoft Defender for Endpoint**
* Data Source: Alert
* Ingestion Method: Fetch Event
* **Microsoft Defender XDR**
* Data Sources: Endpoint, Email, IAM, Cloud, DLP
* Ingestion Methods: Fetch Event, Fetch Incident
* **Microsoft Sentinel (SIEM)**
* Data Sources:
* Endpoint: Microsoft Defender for Endpoint
* Email: Microsoft Defender for Office 365
* IAM: Microsoft Defender for Identity, Microsoft Entra ID Protection
* Cloud: Microsoft Defender for Cloud
* XDR: Microsoft Defender XDR (Endpoint, IAM, Cloud, Email)
* Ingestion Methods: Fetch Event, Fetch Incident
* **Office 365 (Email)**
* Data Source: Alert (Email Message)
* Ingestion Method: Fetch Event
* **Proofpoint Cloud Threat Response (Email)**
* Data Sources: Alert
* Ingestion Method: Fetch Event
* **Rapid7 InsightIDR V2 (SIEM)**
* Data Sources:
* Endpoint: Sysmon event
* IAM: Entra ID, OneLogin, Salesforce authentication event
* Email: Office 365
* Ingestion Methods: Fetch Event, Fetch Incident
* **TAXII 2 Threat Feed (Threat Intelligence)**
* Data Source: Alert (Threat Feed)
* Ingestion Method: Fetch Event
* **Wiz (Cloud)**
* Data Source: Alert
* Ingestion Method: Fetch Event
**ACCESS TO ATTACK PATH DISCOVERY**
The Attack Path Discovery task node, its utility commands, and the Morpheus AI widgets are excluded in standard deployments. Contact [**D3 Support**](mailto:support@d3security.com) for activation and licensing details.
### **Morpheus AI Incident Workspace Widgets** 
Three new Morpheus AI incident workspace widgets are introduced to display the data returned by the [**Attack Path Discovery**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#AttackPathDiscoveryNode) task. These widgets, populated via [**supporting utility commands**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#SupportingUtilityCommands), present attack-path intelligence that improve situational awareness, lower effort requirements across analytical dimensions, and accelerate workflows.
Example - Displaying the Attack Path Discovery Results
Objective Add the Morpheus AI widgets in the [**Incident Type Manager**](https://docs.d3security.com/user-docs/?contextKey=IncidentTypeManager&version=latest)to customize the incident workspace view, and configure the supporting utility commands that populate them.
**Morpheus AI Widgets and Utility Commands**
| **Widget** | **Description** |
|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Morpheus AI Attack Timeline | Presents a chronological sequence of significant events that contribute to the attack path.  |
| Morpheus AI Summary | Provides summary-level attack-path insights, key findings, remediation guidance, and more.  |
| Morpheus AI Graph | Displays nodes representing activities and entities, along with derivation edges, to show how various pieces of evidence connect to form the attack path.  |
### **Form Branding**
Users can now customize [**D3 Forms**](https://docs.d3security.com/user-docs/?contextKey=D3Forms&version=latest) (E-alert form portal) to align with organizational branding. Administrators can update the header text, page title, page content, logo, and background image directly from the**D3 Forms** \> **Form Branding** popover to tailor the reporting experience. Access requires enabling the Form Branding role permission under **Configuration Modules** \> **D3 Forms**.
View Original D3 Form
## **Enhancements**
### **E-Alert Access**
Previously, the E-alert form portal access required users to be logged into the D3 platform. This authentication requirement can now be optionally removed. To remove the authentication requirement, contact D3 and request disabling the **Ealert.RequireLogin** configuration key.
### **Event Field Mapping UI Revamp**
The Event Field Mapping UI has been redesigned to deliver a more modern and streamlined configuration experience. Event Source has been renamed to Field Mapping Sets, and Main Event JSON Path field has been renamed to Event Root Path. Users can now edit the Event Root Path through an interactive popover with sample ingested data and a dynamically rendered preview of parsed data.
### **Additional Date/Time Format Options**
Two new date/time formats, YYYY-MM-DD (ISO 8601) and DD.MM.YYYY (European format), have been added to the Date/Time Format configuration, providing greater flexibility for regional and organizational requirements.
### **Incident Title Field for the Summary Widget**
The Summary widget within the Reporting Dashboard module now supports adding Incident Title as a configurable field. This enables clearer identification of incidents within custom dashboards.
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 Autonomous SOC.
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Link Related Incidents | Updates the **Linked Incidents** widget by linking an artifact to all related incidents identified through investigation merge relationships. Retrieves related investigations from the current investigation and links the artifact to each resolved incident. Unresolved incidents will be skipped and counted in the SkippedIncidents output. |
| Generate AI Summary  | Generates a summary of the runtime incident processed by an investigation playbook. It is recommended to execute this command after aggregating results from upstream lineages, to capture the full investigation context. Incoming execution lineages are analyzed to generate a structured JSON output containing investigation context, key findings, attack-path analysis, and remediation guidance. |
| Set Morpheus AI Attack Path Summary  | Updates an incident's [**Morpheus AI Summary**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#MorpheusAISummary) widget (Summary section) with structured attack-path information. |
| Set Morpheus AI Investigation Summary And Key Findings  | Updates an incident's [**Morpheus AI Summary**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#MorpheusAISummary) widget (Summary section) with a title, summary, threat-confidence score, key findings, and threat intel verdict. |
| Set Morpheus AI Remediation Suggestion  | Updates an incident's [**Morpheus AI Summary**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#MorpheusAISummary) widget (Remediation Suggestion section) with a title and a description of response actions. |
| Set Morpheus AI Attack Path Timeline  | Updates an incident's [**Morpheus AI Attack Path Timeline**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#MorpheusAIAttackTimeline) widget. |
| Set Morpheus AI Graph  | Updates an incident's [**Morpheus AI Graph**](https://docs.d3security.com/release-notes/morpheus-releases/18-0.md#MorpheusAIGraph) widget. |
| Set Morpheus AI Incident Widgets  | Reduces playbook clutter by consolidating the above five utility commands into a single node, to update the following Morpheus AI widgets: * Morpheus AI Summary * Morpheus AI Attack Path Timeline * Morpheus AI Graph |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 ASOC.
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Armis Centrix | Armis Centrix is the cyber exposure management platform, powered by the Armis AI-driven Asset Intelligence Engine, which sees, secures, protects and manages billions of assets around the world in real time. Armis Centrixâ„¢ seamlessly connects with existing data sources to see, secure, protect, and manage all physical and virtual assets -- from the ground to the cloud -- ensuring the entire attack surface is both defended and managed in real time. |
| BitSight | BitSight is a security ratings platform that continuously measures an organization's external cyber risk using outside-in data such as vulnerabilities, exposed credentials, and threat activity. It provides objective security ratings and insights to help organizations assess risk and monitor their own and third-party security posture. |
| Gurucul | The Gurucul Next-Gen SIEM is a modern platform for Security Information and Event Management (SIEM). It enables organizations to detect, investigate, and respond to cyber threats with greater efficiency than older, traditional SIEM tools. This platform is a component of Gurucul's expansive REVEAL security analytics offering. REVEAL utilizes advanced analytics, a cloud-native architecture, and open integrations to provide security teams with comprehensive visibility across intricate environments. |
| OPNsense | OPNsense is an open-source, FreeBSD-based firewall and routing platform that provides stateful packet filtering, VPN, intrusion detection, traffic shaping, high availability, and two-factor authentication capabilities for securing network infrastructure. |
| Sipgate | Sipgate is a cloud-based communication platform that provides VoIP telephony, virtual phone numbers, and click-to-dial capabilities through a REST API. It enables organizations to manage voice communications, initiate outbound phone calls, and integrate telephony services into automated workflows. |
| Team Dynamix ITSM | TeamDynamix provides a cloud-based IT Service Management (ITSM) platform that integrates service delivery with project portfolio management on a single, no-code architecture. It is designed specifically to reduce administrative overhead and accelerate resolution times through heavy use of AI and automation. |
| Trellix IVX Server | Trellix Intelligent Virtual Execution (IVX) Server is an on-premises malware analysis and sandboxing appliance that analyzes suspicious files and URLs using static and dynamic analysis in virtual environments, then produces detailed threat reports for investigation and response. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 ASOC.
|---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| Microsoft Sentinel | **New Command** * Get Incident Activity Logs |
| Cisco Umbrella Cloud Security | **New Commands** * List Sites * List Internal Networks * List Roaming Computers |
| ConnectWise PSA | **New Commands** * Get Companies * Create Company * Update Company * Delete Companies * List Ticket Notes * Update Ticket Note * Delete Ticket Note * List Time Entries * List Company Statuses |
| D3 Attack Path Discovery Integration | **New Commands** * Fetch Event * Generate Attack Path for Incident |
| Github | The second version of GitHub. **New Commands** * List GitHub MCP Tools * Call GitHub MCP Tool |
| Atlassian Jira Software | **New Commands** * List Atlassian Rovo MCP Tools * Call Atlassian Rovo MCP Tool |
| Kaduu.io | **New Commands** * Download Leak Files * List Leak Files * Search Leaked Accounts * Search Emails * List Leaks * Search Leaks |
| LogPoint Director | **New Command** * Update Incidents |
| Microsoft Defender XDR | **New Commands** * Create Custom Detection Rule * List Custom Detection Rules |
| Pulsedive | **New Command** * Enrich Indicators |
| ServiceNow V2 | **New Command** * Import Record to Staging Table |
| SOC Radar Incident V3 | **New Command** * Get Detailed Threat Content |
| SOCRadar Advanced Threat Intelligence | SOCRadar rebranded SOCRadar Threat Analysis to SOCRadar Advanced Threat Intelligence. **New Command** * Get Indicator Details |
---
version: "Morpheus Release Notes"
language: "en"
---
# 18.1
## **New UI Highlights**
The new UI introduces a clearer, faster way to navigate D3 Morpheus. Core investigation and configuration workflows are now organized around a modern Workspace sidebar, streamlined Configuration areas, and centralized Global Settings.
.gif)
D3's updated navigation helps users orient faster through a consistent left-side model, reduces clicks to common SOC workflows, and more clearly separates investigation, configuration, and administrative work.
What changed:
* Workspace now gives quick access to My Dashboards, Events, Incidents, Pending Tasks, Artifacts, Playbook Errors, Tenants, Preprocessing Playbook Viewer, and MITRE ATT\&CK Monitor.
* Configuration is now grouped into Automation, Connectivity, and Management, making key setup areas easier to find.
* Global Settings now centralizes tenant, user, group, role, site, application setting, session, and license management.
**LEGACY NAVIGATION**
Looking for an old menu path? See [**Legacy-to-New Navigation Map**](https://docs.d3security.com/user-docs/?contextKey=LegacyToNewNavigationMap).
## **New Features**
### **VSOC Notifications**
Notifications is a new in-app alerting system that surfaces incident updates, such as ownership assignments and @mentions in incident notes, through a notification bell near the top right corner. Each analyst receives only notifications addressed to them in near real time. The notification bell displays an unread-count badge, with counts shown as 99+ at maximum.
### **AI Triage Columns**
The incident list now supports AI triage columns, allowing analysts to identify which incidents were handled by automation and how the system classified each one. The Investigated by AI, AI Confidence Score, and AI Classification columns appear alongside the existing incident columns. Column visibility follows the dashboard column configuration in Application Settings.
### **Session Timeout Settings**
Session timeout settings control when inactive users are signed out. Administrators can configure the inactivity timeout, the warning duration before sign-out, and the login cookie expiry time. These platform-wide settings apply to all sites, and do not support site-specific overrides. Changes take effect for active sessions without requiring a service restart. The warning duration must be shorter than the inactivity timeout.
### **Preprocessing Viewer Link**
.png?cb=c3d3385cd74abe8f24c85291ea081057)
Open in Preprocessing Viewer is a contextual deep link in the upper-right corner of the Data Ingestion module. Both the new UI and legacy UI include this link. It opens the Preprocessing Playbook Viewer in a new tab with the corresponding batchId applied as a search filter, helping users quickly find playbook runs for a selected data source.
### **Playbook Auto Run Defaults**
.png?cb=0936c63c80fc0680e38a9603ded5e98b)
The Application Settings \> Web Config panel now supports the following settings for enabling Auto Run by default on newly created tasks.
* **Playbook_EnableDefaultAutoRunForCodeless**
Enables Auto Run by default for newly created [++**nested playbooks**++](https://docs.d3security.com/user-docs/?contextKey=NestedPlaybooks&version=latest) tasks.
* **Playbook_EnableDefaultAutoRunForInvestigation**
Enables Auto Run by default for newly created tasks in [++**investigation playbooks**++](https://docs.d3security.com/user-docs/?contextKey=InvestigationDashboard&version=latest).
These settings apply only during task creation and do not affect existing tasks.
## **Enhancements**
### **Redesigned Web Interface**
-20260612-223007.png?cb=3a5fd700609264ba4c49517c26b3fbf9)
Left Navigation Sidebar
The new UI is organized around three top-level areas: Workspace, Configuration, and Global Settings. Getting around is faster and more predictable. Nothing was taken away.
Incident Dashboard
See [**Incident Dashboard Enhancements**](https://docs.d3security.com/release-notes/morpheus-releases/18-1.md#IncidentDashboardEnhancements).
Configuration Home Page
The configuration home page has been updated with a revamped hero banner and a new in-app video panel for quick introductions and setup-connection guidance. Videos can be expanded to full screen by double-clicking the player.
### **Ingestion Error Handling and Data Reacquire**
Error-handling settings are now grouped under the **Ingestion Failure Process** heading.
* **No Retry (Default)**continues scheduled runs without retrying failures.
* **Forward Progress**continues scheduled runs while retrying failures in the background.
* **Strict Recovery**continues only after retrying failures and catching up missed schedule windows.
* **Email Notification** alerts after consecutive main ingestion failures.
**Data Reacquire** now handles late-arriving events as a separate setting.
### **SLA Multi-Value Finish Conditions**
.png?cb=c61f5592de3ecdc257f33dd3264e9312)
SLA finish counting conditions now support multiple values. Administrators can configure text-based finish conditions as removable tags, including values that contain commas. Pressing Enter adds each value as a tag. Start counting behavior remains unchanged.
### **Child Playbook Error Propagation**
Child playbook error propagation is now available for utility command nested playbook tasks. When a child playbook contains failed tasks, users can mark the parent command task as Error and view the child task failure summary in the parent task details.
### **Incident Workspace View Enhancement**
.png?cb=583535a945c8c2346a98a36a85e89d3b)
The legacy incident summary header now improves readability on narrower browser windows. Incident titles expand to use the available width. Created and Last Modified timestamps now show exact date and time values instead of relative values.
### **Incident Dashboard Enhancements**
#### **Views: System and Custom Views**
The view selector turns the incident list into a set of saved, switchable perspectives. System Views provide common perspectives, including incidents assigned to the analyst, incidents created by the analyst, and unassigned incidents. Custom Views store user-defined filters and groupings. A built-in search box helps analysts quickly find the right view, even across long view lists.
View Selector Details
The list is now driven by a **view selector** at the top-left. Click it to open a searchable menu split into two groups:
**System Views** (built in):
* All Incidents
* Incidents Owned by Me
* Incidents Created by Me
* Incidents Owned by Others
* Unassigned Incidents
* All Incidents (AMER Tenant)
Tenant-scoped system views may appear depending on the environment.
**Custom Views**
Created and saved views, including shared views, appear below. Each view is marked with a person icon.
To create a view, open the **â‹®** menu and choose **Create Custom View**.
#### **Incident Quick View Panel**
The quick view panel helps analysts triage incidents directly from the list without losing context. Analysts can review key incident fields, update the disposition, add tags, and write inline notes from the panel. Dedicated tabs show related Tasks, Linked Incidents, and Linked Artifacts, while previous and next controls support one-incident-at-a-time review.
#### **Advanced Search**
.png?cb=fc173a5d3441ef446c66b138df2f17d8)
Advanced search filters incident lists by commonly used criteria, including date range, incident type, status, severity, owner, MITRE tactic, and MITRE technique. Analysts can combine filters to narrow results and clear all criteria in one action.
#### **Active Filters Popover**
.png?cb=31252d6a7ee6bc688ed47e38e2e5e49a)
The active filters popover makes applied column filters easier to review. When filters are applied, a number indicator shows how many of them are active. Opening the popover displays each filter as a separate pill. Users can edit or remove individual filters, or clear all filters and column sorting at once.
#### **Reordering of Table Columns**
Table columns, accessed via the Columns submenu within the vertical ellipsis ( **â‹®** ) menu, can now be reordered. Users can drag columns into the preferred order, in addition to showing or hiding columns.
### **Multi-Tenant Management**
Multi-tenant management is now available in the Global Settings interface. Administrators can manage tenants, shared content, and cross-tenant dashboards from one location. Single-tenant deployments are not affected.
### **Organization Management Revamp**
The Organization Management module has been redesigned with a consistent table layout across its Users, Groups, Roles, and Sites pages. All existing user, group, role, and site management actions remain available.
### **Standalone User Sessions Module**
User session and audit logs (previously found in the Advanced Settings page) are now accessible within a standalone module under Global Settings. Administrators can review access levels, login status, failed logins, and suspended accounts, and can also unlock suspended users.
### **Standalone License Information Module**
The license information page is now available as a standalone module under Global Settings. It shows license details and current seat usage in a two-panel layout. Licenses expiring within 90 days are flagged, and expired licenses show the number of days since expiry. The read-only license tier is now labeled Limited Access in the interface.
### **Incident Widget Expansion**
.png?cb=550dfca29b8f6ddf9aac941c684aff80)
Users can now double-click an incident workspace widget header to expand the widget and review its content in a larger workspace area. These widgets are also arranged two per row to align with the overview layout.
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 Autonomous SOC.
| **Commands** | **Functionality** |
|---------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Get Reports in PDF or PNG | The Get Reports utility command exports a dashboard report as a PDF or PNG file. Users provide the dashboard ID and choose the export format. The command then finds the matching dashboard, renders the report, and returns the file in the selected format. |
### **Updated Commands**
The following utility commands were updated in this release.
| **Commands** | **Functionality** |
|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Get Incidents | The command now supports SLA data in two ways. **SLA as an Output Field** Adding SLA to the static fields returns an SLA array for each incident. Each SLA entry includes the following fields: * RuleName * Status * IsBreached * ActualDurationMinutes * GoalUsagePercentage * ActualStartTimeUtc * ActualEndTimeUtc. Incidents without SLA data return an empty array. **SLA Sub-Field Filtering** Incidents can now be filtered by SLA.\* sub-fields, such as the following examples: * SLA.Status * SLA.IsBreached * SLA.RuleName * SLA.GoalUsagePercentage The command supports the standard filter operators: * = * != * \< * \<= * \> * \>= * LIKE * IS EMPTY * IS NOT EMPTY When multiple SLA conditions appear in the same AND group, a single SLA entry must satisfy all conditions. Matching selects the incident and does not trim the returned SLA array. |
## **Integration Commands**
### **New Integrations**
| **Integration** | **Description** |
|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP SecurityBridge | SAP SecurityBridge is an SAP-native security platform that provides real-time threat detection, security monitoring, and compliance management for SAP systems. It captures security-relevant events across SAP landscapes using configurable listeners and transmits them via an OData REST interface for centralized security operations and incident response. |
| NordStellar Platform Data | NordStellar is a threat intelligence platform that provides dark web monitoring, data breach detection, malware infection tracking, domain permutation analysis, and attack surface vulnerability management. It enables organizations to detect leaked credentials, monitor dark web forums and marketplaces, and identify external-facing vulnerabilities. |
| NordStellar Enterprise Data | NordStellar Enterprise Data connects D3 ASOC to NordStellar's breach intelligence platform. Use it to check whether email addresses or domains have been exposed in data breaches, retrieve credential lists and malware infection logs in bulk, and search dark web forum posts by keyword. |
| Tines | Tines is a no-code security automation and case management platform for SOC teams. This integration ingests Tines cases into D3 as events, updates cases from playbooks, and queries Tines teams, stories, records, and record types. |
| Claroty xDome | Claroty xDome is an industrial cybersecurity platform that provides comprehensive visibility, threat detection, and vulnerability management for OT, IoT, and IIoT environments. It continuously monitors network assets, detects anomalies and threats, and delivers risk-based vulnerability prioritization across industrial and healthcare networks. |
| AWS Inspector | AWS Inspector is an automated vulnerability management service that continuously scans AWS workloads including EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and unintended network exposure. |
### **Updated Commands**
| **Integration** | **New Commands** |
|-------------------------------------------|-----------------------------------------------------------------------------------------------------|
| Qualys | * Fetch Event |
| Microsoft Defender XDR | * Fetch Vulnerabilities |
| Palo Alto Networks FireWall V10 | * Fetch Event |
| Anomali ThreatStream | * Fetch Event |
| SentinelOne Singularity Operations Center | * Event Search * List Users * Get Alert Notes * Add Alert Notes * Update Alerts * Get Alert Details |
---
version: "Morpheus Release Notes"
language: "en"
---
# 18.2
## **New Features**
### **Incident Status Workflow**
.png)
Incident status workflows are now configurable under Application Settings \> Incident Statuses. Administrators can define allowed next statuses for each incident status, ensuring analysts select only valid transitions during incident handling. The configuration is disabled by default and applies globally when enabled. An incident status cannot be deleted while it is used in the configured status workflow, either as a current status with allowed next statuses, or as an allowed next status for another current status.
Example -- Configuring the Incident Status Workflow Anchor
1. Navigate to the **Application Settings** module, then select the **Incident Statuses** setting.
2. .png)
Add a new "Demo Status" status.
1. .png?cb=5e39c339bba68f913177dd09fc7ab877)
Click on the **+ New Status** button.
2. Enter "Demo Status" in the text input field.
3. Select a preferred status indicator color.
4. Click on the **Save**button.
3. Add a workflow for both Open and Demo Status.
1. .png?cb=adb4970ee40dab3bc1ff4e81d6876247)
Click on the **Status Workflow** tab.
2. Click on the **Restrict transitions** toggle.
3. Click on the **+ Add status** button for the **Open**system status to add Closed, In Progress, On Hold and Demo Status as the allowed next statuses.
4. Click on the **+ Add status** button for the **Demo Status**custom status to add Closed as the allowed next status.
5. Click on the **Save** button.
4. Open an incident workspace for an incident in the Open status.
5. Click on the **Status** dropdown menu, verify that the statuses set in [**step 3c**](https://docs.d3security.com/release-notes/morpheus-releases/18-2.md#kix.sqqgx8livxy7) are available in addition to current status, then click on the **Demo Status** option.
6. .png?cb=9ee9db7787259f0e2470723f310002d8)
Click on the **Status** dropdown menu, then verify that only the Closed status set in [**step 3d**](https://docs.d3security.com/release-notes/morpheus-releases/18-2.md#kix.o0bv2bfoud8q)appears in addition to the current status.
.png?cb=a08394071ca9b9141a3bda5338f9f793)
### **Site Inheritance**
.png?cb=19b5b10264e37dccd6ea61f63787b6fc)
The User Groups module in the new UI now supports site inheritance, allowing administrators to assign sites to a group so that every member inherits them automatically. Inherited sites appear grayed out in a member's Sites field in the Users module and cannot be removed there. Removing a user from the group removes that inherited access, while removing a site from the group removes it for all members. Sites assigned directly to a user remain unaffected and can still be removed individually.
### **Adaptive Tasking Module**
.png?cb=712ee1b472700be0a6c277f493e7a5ff)
An Adaptive Tasking module is now available in the new UI, under the **Configuration** \> **Automation**section. It offers a dedicated page for centralized management of organizational rules and SOPs. Administrators can create, edit, delete, enable, disable, search, and sort them from one location without opening an incident and issuing in-chat slash commands.
**READER NOTE**
Access requires the Adaptive Tasking feature flag, Administrator permission, and the AllowAIChat site setting. Reach out to [**D3 Support**](mailto:support@d3security.com) for assistance.
### **Incidents Queue Briefing**
An AI-generated briefing is now available at the top of the Incidents page in the new UI. Analysts can review inline KPIs or expand the briefing to view charts, metric breakdowns, and a ranked incident-priority list, reducing the need for manual severity counts, SLA reviews, and priority-list scanning. The briefing covers a fixed seven-day window.
### **Global List Data Source for Reporting Widgets**
.png)
For both the new UI and classic view, Global List, alongside Artifact, Event and Incident, is now available as an additional data source in the **Reporting Dashboard** \> **Widgets**module. Users can visualize Global List contents with any reporting-widget type.
### **SOP Skill Generation from Incident Data Through AI**
.png)
SOPs can now be autonomously generated from incidents by AI. Morpheus reviews how an incident was handled, including the investigation, analyst decisions, and actions taken, then converts the workflow into a reusable SOP skill that analysts or Morpheus can run on similar incidents. Analysts can edit the generated SOP in place, scope it as Personal or Shared, and assign it to specific incident types and sites. Incident types and sites are prefilled from the current incident to reduce manual setup.
**READER NOTE**
Only administrators can create SOPs with the Shared scope.
### **Morpheus Adaptive Tasking Permission Control**
.png)
Under **Configuration** \> [**Adaptive Tasking**](https://docs.d3security.com/release-notes/morpheus-releases/18-2.md#AdaptiveTaskingModule) \> **Permissions**, administrators can set organization-wide defaults for the Read and Write action classes. Morpheus can run Always Allow commands but not Blocked commands, with optional site-specific overrides. Each setting applies to all integration and utility commands assigned to that action class. The Tool Classification section lists commands by integration, and shows how many commands fall under each action class.
### **Site-Level Morpheus AI Chat Access**
.png?cb=8436f331c9e37cc100a9a417b2483839)
Administrators can now enable or disable Morpheus AI chat for individual sites in the new UI. Disabling the feature hides the chat panel across all incidents in that site without affecting other sites. By default, Morpheus AI chat is disabled for new sites. Existing sites retain their current access after the upgrade.
Configuring Site-Level Morpheus AI Chat Access
1. Navigate to the **Global Settings** \> **Organization Management** \> **Sites**module.
2. Select a site to open its configuration drawer.
3. Tick or untick the **Allow Morpheus AI Chat**checkbox.
4. Click on the **Save**button.
### **AI Chart Widget**
.png)
The AI Chart widget is now available in the **Reporting Dashboard** \> **Widgets**module in both the new UI and classic view. Users can describe the required analysis in natural language, and AI will analyze the queried data and generate a chart with supporting details, reducing manual chart configuration. A Regenerate button is available for refreshing the chart with the latest data.
**READER NOTE**
Access requires the Feature.ReportingAI.Enabled key. Contact [**D3 Support**](mailto:support@d3security.com) for assistance.
## **Enhancements**
### **New Look for Exported Incident PDF**
.png)
D3 users can now export polished, branded incident reports as multi-page PDFs from the new UI and classic view. Users can select which [**sections**](https://docs.d3security.com/release-notes/morpheus-releases/18-2.md#ViewAvailableIncidentReportSections) the export includes. Exports use live incident data, site-specific branding, and Morpheus AI-aligned verdict and confidence values.
View Available Incident Report Sections
.png?cb=bd70775fc4e2348ae2fe5afe2d4504ca)
### **Event Details View**
.png)
The event details popover is now available in the new UI from an event's quick-view panel. Users can open it by clicking the View Full Details button. The popover consolidates key event context across dedicated tabs, including event fields and MITRE ATT\&CK tactics and techniques in Overview, relationship mapping in Artifact Behavior, related events and incidents in Event/Incident Correlation, raw event data in Event Log, and automated verdict details in APD Disposition. Users can resize the popover by dragging its lower-right corner to the desired dimensions.
### **AI Query Generation for Reporting Widgets**
.png)
The AI Build Query button is now available when creating or editing queries in the **Reporting Dashboard** \> **Widgets**module across the new UI and classic view. Users can describe the required data in natural language, and AI will generate the corresponding query, reducing the need to configure filter conditions manually.
**READER NOTE**
Access requires the **Feature.ReportingAI.Enabled** key and deployment of the D3 AI microservices and supporting services. Contact [**D3 Support**](mailto:support@d3security.com)for assistance.
### **Incidents View Bar and More Views**
.png?cb=6213a2ea3b86c5958df24be64102ec17)
The Incidents page in the new UI now includes a four-pill view bar above the incident table for Assigned to me, Unassigned, New \<24h, and All. System and custom views have been moved to the More views dropdown, located to the right of the view bar. Unassigned incidents created within the last 24 hours are marked with an amber left-side indicator, reducing the need to scan the date column.
### **Incident Workspace Events Page**
.png)
The incident workspace Events page is now available in the new UI, eliminating the need to use the classic view to review an incident's events. Analysts can review correlated events for the selected incident, examine MITRE ATT\&CK tactic and technique coverage in the Event Matrix, and visualize geo-located artifacts in the Map View. The Events page replaces the embedded event tab previously shown in the incident workspace.
### **UI Modernization**
#### **Data Ingestion Configuration Module**
.png)
The Data Ingestion module has been updated with a native Morpheus UI. An AI-assisted chat experience has also been added to guide ingestion configuration through natural language.
#### **Schedules Configuration Module**
.png)
The Schedules module has been updated to align with the modern D3 interface, and support automatic schedule-list refresh.
#### **Connection Configuration**
.png)
The integration connection configuration experience has been redesigned in both the Integrations and Connections modules. Users can now create connections through a guided flow that starts with a searchable integration picker, followed by general settings and account credentials.
View All Connection Configuration UI Changes
* Guided configuration flow replaced the single, scrollable form.
* Searchable integration picker was added as the first step.
* Separate General Settings and Account Credentials steps were introduced.
* Integration selection was locked after the integration was chosen.
* General Settings grouping was added for the connection name, description, activation status, site selection, site cloning, agent selection, tenant-site sharing, and permissions.
* Site-cloning dropdown was added beneath the Site field, replacing the Select Sites to Clone button.
* Tenant Sites setting with supporting explanatory text replaced the Tenant toggle.
* Proxy-agent dropdown replaced the Agent Name text field.
* An About Agents information panel was added.
* Access summary with an adjacent Configure action replaced the standalone Configure Permissions button.
* The Account Credentials step was added for credential fields.
* Separate Manual Input and Password Vault credential methods were introduced.
* Enable recurring connection testing setting replaced Connection Health Check.
* Dedicated connection-verification section was added.
* Inline connection-test status was added within the credentials step.
* Continue and Submit buttons replaced Save.
* Back navigation was added between configuration steps.
#### **Global List Module**
The Global List module has been updated to align with the modern D3 interface. Batch JSON uploads and improved loading behavior have also been implemented.
### **Webhook Credentials Mapping**
Third-party systems that support only username-and-password authentication can now connect to D3 webhooks by using existing D3 API keys or JWTs.
Connection Configuration
To configure the connection, retrieve the API key or JWT from the command's Webhook Authentication settings, enter d3key or d3jwt as the username, and enter the corresponding request header value as the password.
### **Bulk Incident Field Editing**
.png?cb=ba164851facf4ca4f56bd817c7d6ebc9)
View Drawer
.png?cb=57c04c55e558b57e2d4d90ae83b2fd7a)
Bulk incident-field editing is now available on the Incidents dashboard in the new UI. Analysts can select multiple incidents and update up to 11 fields at once via the **Edit Fields** drawer. The drawer displays only fields the user has permission to edit. After clicking the Review changes button, a partial-result message appears when one or more incidents cannot be updated and provides the reason for each failure.
## **Utility Commands**
### **Updated Commands**
The following utility commands were updated in this release.
|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| Create Site | The Create Site utility command in the classic view now supports syncing configuration to a newly created site. Administrators, or users with the Access Privileged Commands permission, can publish all live master incident playbooks and share all active master global lists while creating the site, removing the need to add each playbook and list by hand afterward. User syncing has been removed; new-site access is managed through roles. |
| Generate AI Summary | Generate AI Summary now reliably processes large, complex incidents by auto-condensing high-volume event and command data before analysis. Incidents that previously exceeded processing limits can now return complete summaries. |
## Integrations
### **New Integrations**
The following integrations were added in this release.
|---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Microsoft Defender for Identity | Microsoft Defender for Identity (MDI) is a cloud-based identity threat detection and response service that monitors on-premises Active Directory and hybrid identities for compromise and lateral movement. It surfaces a unified view of identities across Active Directory, Entra ID, and Okta, and supports response actions on on-premises Active Directory accounts. |
| FortiMail Workspace Security | FortiMail Workspace Security, formerly Perception Point, is an email security service that detects and remediates malicious email, file, and URL threats across workspace collaboration channels. It scans content with multiple detection engines, exposes scan verdicts for ingestion, manages allow and block lists, and supports response actions such as changing a scan verdict and submitting files and URLs for analysis. |
| Cribl Search | Cribl Search is a vendor-hosted observability search platform that runs Kusto-style (KQL-based) queries across data ingested into Cribl Cloud - Cribl Lake datasets, Cribl Edge fleets, Amazon S3 sources, and other configured providers. It returns NDJSON event results suitable for downstream automation and analytics. |
### **Updated Integrations**
The following integrations were updated in this release.
|-------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| Microsoft Purview eDiscovery V2 | **New Commands** * List Case Operations * List Case Searches * Get Operation Status * Initiate Purge Emails **Deprecated Command** * PurgeEmails |
| Cynet 360 AutoXDR | **New Commands** * Fetch Event * Get Host Details * Unisolate Hosts * Isolate Hosts * Quarantine Files * Update Alert Status * Get Network Sockets In Date Range * Get File Info * Get Remediation Status * Block Network Traffic * Run Command on Host |
| Splunk V2 | This update enables searches and saved searches within a specified Splunk app rather than only the default Search app. It adds the **App Context** option to supported search commands and introduces the **List Saved Searches** command for discovering available saved searches. **New Command** * List Saved Searches **Enhanced Commands** * Search * Start Search * Get Search Status * Get Search Result |
| Azure Sentinel | Connection can support different Microsoft cloud environments: Commercial, GCC, GCC High, DoD |
| Microsoft Defender for Endpoint | Connection can support different Microsoft cloud environments: Commercial, GCC, GCC High, DoD |
| Microsoft 365 Defender (Email \& collaboration) | Updated the ExchangeOnlineManagement PowerShell module to version 3.9.2. **Deprecated Command** * PreviewComplianceSearchResult |
| Perception Point | Deprecated the integration. Use the FortiMail Workspace Security integration instead. |
---
version: "Morpheus Release Notes"
language: "en"
---
# 18.3
## **Enhancements**
### **MITRE ATT\&CK Monitor**
The MITRE ATT\&CK Monitor is now a native page in the new UI. Detection search criteria use an editable field-operator-value condition builder, allowing saved conditions to be reopened and edited. Additional enhancements include the ability to move around the matrix by dragging it in any direction, export technique details to Excel, and insert tactic columns using the  button.
View Tactic Insertion Button
### **Download Control for the APD Narrative Widget**
The  button in the Morpheus APD Narrative widget, in the new UI, has moved from the widget body to the header, immediately left of the expand icon. The button appears only when downloadable investigation content is available and includes a tooltip on hover. This change leaves more space in the widget body for the narrative. Download behavior remains unchanged.
### **Morpheus APD Narrative Report Section**
An additional Morpheus APD Narrative section is now available in the exported [**incident report**](https://docs.d3security.com/release-notes/morpheus-releases/18-2#New-Look-for-Exported-Incident-PDF), selectable in the Export Incident Report dialog in both the new UI and the classic view. This removes the need for analysts to copy the narrative manually from the incident workspace. The section appears only for APD-generated incidents that include an investigation narrative.
### **Events Summary Field Display**
.png?cb=fc8c0e0b112b186a6ccc0d39eb877982)
The Events Summary widget now displays all event fields by default in both the new UI and classic view. Show less now appears by default, replacing Show all as the initial button. After the field list is collapsed, Show all becomes available to restore the full list. Text that exceeds a single line now wraps to up to three lines, allowing more content to remain visible before Show More is required. Event cards with many fields now use internal scrolling to maintain a compact layout.
### **New Tab Access for Incidents**
Clicking an incident number in the Incidents dashboard now opens the incident in a new browser tab in both the new UI and classic view. In the new UI, View Full Details in the incident side panel also opens the incident in a new tab. Analysts can investigate multiple incidents in parallel while keeping the Incidents dashboard open, reducing the need to repeatedly navigate back to the dashboard.
---
version: "Morpheus Release Notes"
language: "en"
---
# January 2026
## **Enhancements**
Users can now add, delete, and modify custom categories for utility commands. In edit mode, custom utility commands can be assigned to custom categories by specifying category names in the Command Category section.
### **Event Dismissal Notes**
Users can now select a reason code and enter a dismissal note when dismissing an event. These fields are available both as input parameters in the Dismiss playbook task and in the Dismiss Event popover for manual dismissals. Custom reason-code options can be configured in the **Configuration** \> **Application Settings** \> **Dismiss Event Reason Code** panel.
### **New Look for Global List**
The Global List page has been redesigned with a dedicated left navigation panel for browsing and searching specific global lists, along with tabbed Data, Permission, and Audit Log views. Global list data is now displayed as individual, collapsible JSON records to improve readability. Also supported are within-list JSON value searches, one-click exports for the filtered records or the entire list, and management actions (clone and delete).
### **Custom View Access Permissions**
The Edit View UI has been updated to better manage shared access after a custom view is created. Custom view owners can now remove viewers and promote users with viewer access to owner access. This change replaces the previous custom notification message UI with a default notification message.
## **Utility Commands**
### **New Commands**
The following utility commands have been added to this release of D3 SOAR.
|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Functionality** |
| Get Incident Notes | Retrieves the notes for a specified incident. The command requires an incident number as input and returns a structured response containing the incident number, note ID, author, last-modified time (in UTC), and note content. |
| Edit Incident Notes | Updates an existing incident note. The command requires the note ID (returned by the [Get Incident Notes](https://docs.d3security.com/release-notes/morpheus-releases/january-2026.md#GetIncidentNotes) command) and a new note content value, which will override the existing content for that incident note. |
| Stop/Remove Active Playbooks | Allows privileged users to stop and remove active incident playbooks. |
### **Updated Commands**
The following utility commands have been updated in this release of D3 SOAR.
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Commands** | **Changes** |
| Get Incidents | The Get Incidents utility command now supports filtering incidents by MITRE tactic and technique values. The Filter parameter accepts Tactic or Technique as field values. |
## **Integrations**
### **New Integrations**
The following integrations have been added to this release of D3 SOAR.
|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Description** |
| Armis | Armis is a cybersecurity company that provides complete visibility and protection for all connected assets --- including IT, OT, IoT, and cloud devices. Its AI-powered platform identifies and monitors every device on a network, detects risks, and helps organizations secure their digital environments in real time. |
| Azure OpenAI | Azure OpenAI Service is a Microsoft-managed service that provides access to OpenAI's advanced language models through the Azure cloud platform. It enables developers and businesses to integrate powerful natural language processing (NLP) and machine learning (ML) capabilities into their applications, leveraging models such as GPT-4, GPT-3.5, Codex, and DALL·E. |
| Hunters SIEM | Hunters SIEM is a cloud-native, next-generation Security Information and Event Management platform designed to automate the entire TDIR (Threat Detection, Investigation, and Response) process. |
| MalwareBazaar | MalwareBazaar is a community-driven platform operated by abuse.ch for sharing and analyzing malware samples. It collects and distributes malware files submitted by researchers and security teams worldwide to support threat intelligence and malware research. Each sample is enriched with metadata such as hashes, tags, file type, and detection information, making it a valuable resource for identifying, classifying, and tracking malware campaigns. |
| Nozomi Vantage | Nozomi Vantage is a cloud-based platform that delivers real-time visibility, monitoring, and threat detection for OT, ICS, IoT, and IT environments. It centralizes security and network data from distributed sites, helping organizations detect anomalies, investigate incidents, and strengthen resilience across critical infrastructure. |
### **Updated Integrations**
The following integrations have been updated in this release of D3 SOAR.
|-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Integration Name** | **Changes** |
| Anomali ThreatStream | **New Command(s)** * Approve Observables By Import Job * Create Threat Model * Get Import Job Status * Get Intelligence Enrichments * Get Observables From Import Job * Get Threat Bulletin Observables * List Import Jobs * List Threat Bulletins * Search Query * Search Threat Model * Update Threat Model |
| Atlassian Jira Service Management | **Connection** * Added support for connection via service accounts. |
| Atlassian Jira Software | **Connection** * Added support for connection via service accounts. |
| AWS S3 | **New Command(s)** * Update Bucket Object |
| ConnectWise PSA | **New Command(s)** * Add Ticket Attachments * Delete Ticket Attachments * List Ticket Attachments |
| CrowdStrike | **Enhanced Command(s)** * Added the Return UI Hidden Alerts parameter to query alerts hidden in the CrowdStrike Falcon UI for the **Fetch Event** , **Fetch Incident** , and **Search Alerts** commands. |
| Darktrace | **New Command(s)** * List AI Analyst Incident Events **Enhanced Command(s)** * **Fetch Event** :Added support for retrieving AI Analyst Incident Events and extended the Search Condition parameter to accept JSON object input. |
| Dell Secureworks Taegis XDR | **New Command(s)** * Query Events via Taegis SDK **Enhanced Command(s)** * **Fetch Event** :Added the Data Provider field to the default field mapping. |
| Elasticsearch | **Enhanced Command(s)** * **Fetch Event** :Added the Event Query Time Type parameter to let users select how event time ranges are evaluated and additional field mappings. |
| FortiGate | **New Command(s)** * Create Threat Feed * Get Threat Feed Entry List * List Threat Feeds * Refresh Threat Feeds * Update Threat Feed |
| Microsoft Defender for Endpoint | **New Command(s)** * Test Connection |
| Microsoft Defender XDR | The integration name was changed from Microsoft 365 Defender to Microsoft Defender XDR. |
| Office 365 | **Enhanced Command(s)** * Added delegated-permission support to enable access to shared mailboxes for the **Fetch Event** , **Fetch Related Events** , and **List Mail Folders** commands. |
| Silent Push | **Connection** * Added support for providing a Threat Check Access Key. This enables verification of whether an IP address or hostname appears in Silent Push Indicators of Future Attack. **New Command(s)** * Threat Check **Enhanced Command(s)** * Added the Threat Check input parameter to all existing commands to enable optional IOFA verification using the configured Threat Check Access Key. |
| Trellix McAfee ESM | **Connection** * Added support for specifying a login mode (AES or Base64) on the connection form. |
---
version: "Morpheus Release Notes"
language: "en"
---
# September 2025
---
version: "Morpheus Utility Commands"
language: "en"
---
# Add Fields in Trigger Output Data
Last updated: Aug 13, 2024
This command adds new fields to the event data in an event playbook. It updates the "row" and "col" fields in "UserMappedFields" and "Fields" within the Trigger Output Data.
**READER NOTE**
This command is only applicable within an event Playbook within the "On Event Ingestion" trigger. The trigger output data feature is exclusive to the Event Playbook. Data is stored every time the Event Playbook is ran using the event raw data.
|----------------------|---------------------|
| **Implementation** | System |
| **Command Category** | System Utility |
| **Tags** | Trigger Output Data |
## **Inputs**
| **Parameter Name** | **Required/Optional** | **Description** | **Sample Data** |
|--------------------|-----------------------|------------------------------------------------------|----------------------------------------------------------|
| Source Type | Required | The data source from which data is being extracted. | Trigger Output Data |
| JSON Object | Required | Key and Values to be added into Trigger Output Data. | { "sample Key":"sampleValue", "Event Type": "testType" } |
## **Output**
Return Data
The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.
Sample Data
JSON
{
"Fields": [
{
"FieldValue": "sampleValue",
"FieldName": "sample_Key",
"FieldDisplayName": "sample Key",
"FieldDistinctValue": null
},
{
"FieldValue": "testType",
"FieldName": "EventType",
"FieldDisplayName": "Event Type",
"FieldDistinctValue": "testType"
}
],
"UserMappedFields": {
"row": [
{
"fieldName": "sample_Key",
"value": "sampleValue",
"displayName": "sample Key"
},
{
"fieldName": "EventType",
"value": "testType",
"displayName": "Event Type"
}
],
"col": {
"sample_Key": "sampleValue",
"EventType": "testType"
}
}
}
---
version: "Morpheus Utility Commands"
language: "en"
---
# Add Incident Tags
Last updated: aug 06, 2024
Add tags to the current incident to categorize and describe it better.
|----------------------|----------------|
| **Implementation** | System |
| **Command Category** | System Utility |
| **Tags** | incident |
## **Inputs**
| **Parameter Name** | **Required/Optional** | **Description** | **Sample Data** |
|--------------------|-----------------------|--------------------------------------------------------------------------------------|----------------------|
| Incident Number | Required | The incident number to add incident tags. | 20230714-3 |
| Mode | Required | The mode of add incident tags. | Append |
| Tags | Required | The incident tags will be added as an array. Examples: a, b, c or \["a", "b", "c"\]. | [ "test4", "test5" ] |
## **Output**
Return Data
The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.
Sample Data
JSON
{
"Status": "Successful",
"Data": {
"incidentNumber": "20230714-3",
"Tags": [
"test4",
"test5",
"test6",
"test7"
],
"modifiedDate": "7/14/2023 5:03:05 PM",
"result": "Successful",
"modifiedBy": "Jackie Gao"
}
}
## **Remote Command API**
The **D3 command API** allows you to send requests to D3 SOAR to execute this utility command via REST API.
### **Request**
POST
https://{base_url}/{api_namespace}/api/Command/AddIncidentTags
### **Headers**
Please refer to the page [Webhook Configuration Guide - Authentication Method: API Keys](https://d3securitydev.atlassian.net/wiki/spaces/d3docs/pages/33914891/Webhook+Configuration+Guide#Authentication-Method%3A-API-Keys) for more details.
### **Request Body**
JSON
{
"Username": "",
"Site": "",
"CommandParams": {
"Incident Number": "",
"Mode": "",
"Tags": ""
}
}
#### **Body Parameters**
| **Parameter Name** | **Type** | **Required/Optional** | **Description** |
|--------------------|--------------|-----------------------|--------------------------------------------------------------------------------------|
| Username | `string` | Required | The username of your D3 SOAR account. |
| Site | `string` | Required | The D3 SOAR site to run the remote command. |
| Incident Number | `Text` | Required | The incident number to add incident tags. |
| Mode | `Text` | Optional | The mode of add incident tags. |
| Tags | `Text Array` | Optional | The incident tags will be added as an array. Examples: a, b, c or \["a", "b", "c"\]. |
#### **Sample Request**
Sample Data
JSON
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Incident Number": "20230714-3",
"Mode": "Append",
"Tags": [
"test4",
"test5"
]
}
}
### **Response**
#### **Response Fields**
| **Field Name** | **Type** | **Description** |
|----------------|---------------|--------------------------------------------------|
| error | `string` | The error message if the API request has failed. |
| returnData | `JSON Object` | The return data from the API request. |
#### **Sample Response**
JSON
{
"error": "",
"returnData": "{
"Status": "Successful",
"Data": {
"incidentNumber": "20230714-3",
"Tags": [
"test4",
"test5",
"test6",
"test7"
],
"modifiedDate": "7/14/2023 5:03:05 PM",
"result": "Successful",
"modifiedBy": "Jackie Gao"
}
}"
}
---
version: "Morpheus Utility Commands"
language: "en"
---
# Add Incident Timeline Entry
Last updated: Sept 18, 2024
Adds a new [timeline](https://docs.d3security.com/user-docs/16.8/incident-workspace#id-(16.8)IncidentWorkspace-TimelineTab) entry to an incident, enhancing its chronological record with key information.
**READER NOTE**
This utility command is for vSOC versions 16.8 and above. Clients on earlier versions may not have access to this command. Contact D3 to obtain access.
|----------------------|-------------------|
| **Implementation** | Python |
| **Command Category** | System Utility |
| **Tags** | Incident Timeline |
## **Inputs**
| **Parameter Name** | **Required/Optional** | **Description** | **Sample Data** |
|---------------------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|
| Incident Number | Required | The incident number corresponding to an incident to which the timeline entry will be added. | 20240223-1 |
| Time | Optional | The specific date and time when the event associated with the timeline entry occurred, adjusted to the incident's time zone. | 2024-05-15 14:32:00 |
| Note | Optional | Additional remarks or important information related to the timeline entry that may provide context or insights. | Initial detection through network monitoring tools. |
| Event Type | Optional | The category or classification of the event within the incident, indicating the nature of the activity. | Unauthorized Access |
| Tactic \& Technique | Optional | The strategic approach and specific methods used in the incident, aligned with recognized frameworks for categorizing cyber threats. | Collection / Data from Local System |
| Risk | Optional | The severity or potential impact of the event, typically classified into categories such as ZeroRisk, Low, Medium, High, or N/A | High |
| Description | Optional | A detailed account or explanation of the event, providing in-depth information about what occurred. | An unknown actor accessed the system through a vulnerable web application, exploiting a SQL injection flaw to gain unauthorized access. |
| Summary | Optional | A concise overview of the event, highlighting key points and essential details without going into extensive detail. | SQL injection attack detected, leading to unauthorized access and data exposure. |
## **Output**
Return Data
The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.
Sample Data
JSON
{
"Status": "Successful",
"Data": {
"TimelineID": 39
}
}
## **Remote Command API**
The **D3 command API** allows you to send requests to D3 SOAR to execute this utility command via REST API.
### **Request**
POST
https://{base_url}/{api_namespace}/api/Command/AddIncidentTimelineEntry
### **Headers**
Please refer to the page [Webhook Configuration Guide - Authentication Method: API Keys](https://docs.d3security.com/user-docs/16.8/webhook-configuration-guide) for more details.
### **Request Body**
JSON
{
"Username": ,
"Site": ,
"CommandParams": {
"Incident Number": ,
"Time":