17.1
New Features
Task Node Action Bar
An action bar has been added to playbook task nodes, appearing on hover to provide quick access to key task management controls, and to display the task node ID for identification and reference. Users can activate or deactivate a task node using the toggle. Deactivating a node blocks its execution as well as that of all subsequent task nodes. The
(delete) button permanently removes the task node from the playbook.
Incident Type Manager Sub-Module
The new Incident Type Manager sub-module serves as the centralized interface for managing all incident types, with the Incident Form Editor now integrated within it. General configuration for each incident type is now available through a new interface under the General tab. Each incident type also includes an independently managed workspace library, enabling the creation of custom incident workspace dashboards composed of selected widgets.
Incident Workspace Builder
The incident workspace builder enables users to design and assign customized workspaces for specific incident types. Through a drag-and-drop interface, users can arrange widgets on a canvas, name the layout, and configure workspace settings.
Stage Tracker
-20250402-214409.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
A stage timeline component has been added to the incident header panel to dynamically display progress based on the most recently added playbook, irrespective of its status ( ,
, or
). The timeline displays a maximum of seven stages—the current stage, along with up to six before and six after. Clicking a stage opens a selection menu to view either the playbook task details or the overall playbook execution progress.
Escalate and Dismiss Task Nodes
Two new task types—Escalate and Dismiss—are now available to streamline event-incident correlation workflows. The Escalate task provides direct access to the Create Incident With Conditions utility command, while the Dismiss task simplifies event dismissal actions.
Insert Task Nodes Between Existing Ones
Speeding up workflow adjustments, users can now insert new task nodes between existing ones without the need to manually drag and drop a task into place, connect it to the following task node, and remove the original link.
Hide System Artifacts in Event Field Mappings
From the Application Settings page, administrators can tailor system artifact type visibility to align with organizational workflows, ensuring that artifact types not relevant to specific use cases are excluded from new artifact creation.

WARNING
Hidden system artifact types cannot be unhidden from the application. Contact D3 Support to request reactivation.
Enhancements
General Enhancements
Redesigned Login Screen and Smooth Page Animations
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
The login screen has been updated with a more modern design. Page transitions are now enhanced with animations for a smoother navigation experience.
Utility Commands Layout Redesign

Utility commands are now displayed in a card layout on the right for improved readability, creating a more modern and organized browsing experience.
Custom Triage Renamed to Custom Views
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
Custom Triage has been renamed to Custom Views as part of a rebranding effort, with the functionality remaining the same while offering a clearer representation of its purpose in managing personalized views on the Investigation Dashboard.
Playbook Enhancements
Event and Incident Playbooks Rebranded

Event and incident playbooks have been rebranded to align with the product architecture and provide clearer context during user selection.
Modernized Styling for Playbook Task Nodes
Playbook task nodes have been redesigned with a sleek, modern color pallet—such as deep navy for the root node, electric violet for command nodes, and rich terracotta for stage nodes.
Customizable Trigger Options for the Playbook Root Node
Users can now control which trigger options appear in the playbook root node. Previously, all available triggers were shown by default. With the 17.1 release, users can selectively show or hide triggers, reducing visual clutter during playbook configuration.
Plus Button Added for Task Insertion
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
Users can now add playbook tasks by clicking the plus (+) button directly on a task node, providing an alternative to dragging tasks from the task panel.
Incident Workspace Enhancements
Incident Header Panel Revamp
The incident header panel features a modern layout with improved visual hierarchy. Key details—incident type, severity, disposition, and ownership—are now more prominent. Offering immediate visual context and highlighting urgency, the background color of the header panel dynamically reflects incident severity levels:
Red (
)
Persimmon (
)
Amber (
)
Grey (
,
)
Creating and Managing Dispositions
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
Within the newly introduced Incident Type Manager sub-module, users can create and manage the dispositions available for each incident type. In addition to out-of-the-box options, users can add custom dispositions tailored to their needs and remove any inapplicable to the selected incident type.
File Previewer
Users can now preview files using the new Preview option within the Files widget. This eliminates the need to download files for a quick look. Supported formats include PDF, DOCX, XLSX, XLS, CSV, MP4, JPG, PNG, and TXT.
Notes Widget Revamped
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
The Notes widget UI has been updated with a modern, streamlined layout. Users can now search for notes using the built-in search bar to quickly locate relevant entries.
Export Incident Report Now Supports Section Selection
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
Users can now select which sections to include when exporting an incident report to a PDF file. By default, all sections are selected for export.
Adding Timeline Entries with Rich Text Editor

Users can now add notes to an incident’s timeline using a rich text editor, available for the Notes, Description, and Summary fields in the pop-up window. Notes can be added via the Add Note button in the Timeline tab or the Add to Timeline button in the Command Centre tab.
Reporting Dashboard Enhancements
New Widget Types Supported: Stacked Area and Sankey

Reporting dashboards now support two new widget types: Stacked Area and Sankey charts.
Event Site and Incident Site Fields in Reporting Dashboard
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
To enhance flexibility for reporting dashboards, Incident Site and Event Site have been added to the list of filterable fields in the Event, Incident, and Artifact data sources for use in widget expression blocks. These additions support scenarios such as events from different sites correlating with one or more incidents, incidents moving between sites, and artifacts linked to multiple incidents and events.
Incident Resolve Time (Day) and (Hour) Added as Aggregation xField Selections
.png?inst-v=cbb3b410-3cd4-4c9f-b887-933ca096c769)
Incident Resolve Time (Day) and Incident Resolve Time (Hour) have been added to the aggregation xField dropdown. These options allow time-based widgets to aggregate data using larger time units.
Filterable Columns Updated to Use Dropdown Inputs

The following widget column filters were changed from text fields to dropdowns:
Incident Owner
Incident Creator
Incident Closed By
Incident Reopened By
Incident Assigned By
Incident Investigation Team Investigator
Event Investigator
Event Assigned By
Event Disposed Action By
This update improves usability by enabling selection from predefined values.
Utility Commands
New Commands
The following utility commands have been added:
Commands | Functionality |
Generate Latest Dashboard Link by ID | Generates a direct link to a dashboard using the site and dashboard ID obtained from the Reporting Dashboard module. The link displays all dashboard widgets, excluding table widgets. The dashboard ID must match exactly. |
Track Playbook Execution Times | Calculates and tracks playbook execution times for specified incidents. The command returns start and end times, total duration, execution status, and a unique runtime identifier for each execution. Users can input a single incident number or an array of incident numbers to retrieve execution data in bulk within a single run. |
Update Global List MetaData | Enables users to modify the global list’s description and status, and manage the list of sites with which it is shared. |
Updated Commands
The following utility commands have been updated:
Commands | Changes |
Export Incident Report | The Select export sections parameter has been added to allow selection of specific incident report sections for export. |
Get Incidents | The Sort Field and Sort Order parameters have been added to support sorting of results by any valid field specified in the Static Fields or Dynamic Fields parameter, in ascending or descending order. |
Get Events | The Sort Field and Sort Order parameters have been added to support sorting of results by any valid field specified in the Fields parameter, in ascending or descending order. |
Integrations
New Integrations
The following integrations have been added:.
Integration Name | Description |
Azure SQL Query | Azure SQL Database is a fully managed cloud-based relational database service built on Microsoft SQL Server technology hosted on Azure Cloud service. This integration enables organizations to query table content of the given Azure SQL server. |
Clear NDR (Stamus Networks) | Stamus Clear NDR is a Network Detection and Response (NDR) platform developed by Stamus Networks. It provides advanced threat detection, network visibility, and response capabilities using deep packet inspection (DPI), threat intelligence, and behavioral analysis. |
Nucleus Security | Nucleus Security is a platform designed to enhance vulnerability and exposure management for organizations. It unifies and operationalizes vulnerability data, enabling teams to prioritize and mitigate critical exposures efficiently. |
Updated Integrations
The following integrations have been updated:
Integration Name | Changes |
Cortex XSIAM | New Command(s)
|
Dell Secureworks Taegis XDR | Enhanced Command
|
Halo PSA | New Command
|
Microsoft Teams | Connection
|
Office 365 | Connection
|
Prisma Cloud | The integration has been updated with revised connection logic, and the current commands have been deprecated and replaced with new ones. |
Sophos Central V2 | New Commands
Enhanced Command
|