15.1.39

Incident Overview Enhancement

Timeline

The new timeline feature within the incident workspace allows you to add investigation details and order them chronologically to visualize the lifecycle of the incident. Add details from the command centre or related events and incidents, or create your own custom supplementary notes.

	ADDING ITEMS FROM THE COMMAND CENTRE You can now add investigation details, such as playbook results and changes to the incident, from the command center to the timeline.
	ADDING RELATED EVENTS AND INCIDENTS Related events and incidents, such as the escalated event, can also be added to the timeline to show event and incident relationships within the incident lifecycle.
	CUSTOM TIMELINE NOTES And of course, if there are custom notes or additional details you’d like to add to the timeline, you can do so right on the timeline.

Playbook Notes

Notes added in playbook tasks will appear in the incident overview under notes in its own category, for ease of track keeping and organization.

Incident Form Section

We made enhancements to the UI of the incident form section for filling out nested responses. The new design has better clarity and overall user experience improvements for analysts during their investigation.

Playbook Enhancements

In order to enhance the capabilities of our playbooks, we have enhanced REST API, conditional, and data formatter tasks such that they can stop on error. This can be useful for debugging and further ensuring that your playbooks run smoothly without issue.

Schedules and Data Ingestion

In the schedules and data ingestion modules, you are able to create multiple recurring schedules for different integration commands. We observed that these schedules can quickly add up and make it difficult to locate what you are looking for – therefore we have added the ability to filter and sort through all of your schedules and data ingestions.

Filter by file, schedule and webhook for data ingestion, and filter by integration command, system command, and utility command for schedules.

Investigation Dashboard

Bulk Action Enhancements

More bulk actions have been added to the investigation dashboard so you can perform actions quickly on multiple events and incidents at once.

	REASSIGN EVENTS If you have several events that need to be taken over by a new investigator, you can batch select them and click on the batch action to reassign.
	COPY INCIDENT NO. If you need the incident number of several incidents at once, select all the ones you need and click on the batch action to copy their incident number.

Event Details Concurrent Users

Multiple investigators on the same event details? Now you can see everyone who is working on each of the events at once to help identify and track changes.

Application Settings

Tactics and Techniques Update

D3 SOAR uses the latest tactics and techniques based upon the MITRE ATT&CK framework. We know how important keeping up to date with the latest security frameworks is, therefore we have made it easy for you to keep your TTPs up to date with the latest MITRE updates with the click of a button.

Integrations

We are always adding more to our out-of-the-box integrations, as well as making enhancements to existing ones. Below are some of the latest updates to integrations.

Enhanced

	AUTOMOX	Overall improvement made to the integration, all 22 commands have been updated
	AWS S3	All 13 commands have been updated
	GMAIL	The following commands have been updated: deleteEmails trashEmails untrashEmails downloadAttachment
	RECORDED FUTURE	checkIPReputation command has been updated
	SOLAR CYBER	fetchEvent command has been updated The following commands have updated descriptions: updateEvents getEventDetails