17.3.4

New Features

Consolidated Tenant Incidents View

Previously, master tenant users in distributed multitenancy environments could not view incidents from all tenant instances in a single location. The new Tenants view addresses this by providing a unified incident list, allowing centralized visibility and more efficient monitoring across all tenant instances.

Enabling the Tenants View

To enable the Tenants view on the investigation dashboard, administrators must select the View Tenant’s Incident permission scope under the new Tenant permission group.

Hiding the Incidents Accordion in the Master Instance

Users can also select the Hide Master’s Incident scope to remove the entire Incidents accordion from the master tenant. This is useful in cases where an analyst is responsible for incidents in only tenant instances, but not those in the master instance.

Hide Master’s Incident Unchecked

The Incidents accordion is accessible.

Hide Master’s Incident Checked

The Incidents accordion is no longer accessible.

Custom Incident Status

Users are no longer limited to the default incident statuses provided out of the box. They can now define custom incident statuses to accommodate specific operational requirements.

Adding a Custom Incident Status

Users can add custom incident statuses by navigating to Configuration > Application Settings, selecting the Incident Statuses setting, and clicking the + New Status button.

READER NOTE

Users can add up to 10 custom incident statuses.
Incident status names cannot exceed 20 characters.
System incident statuses cannot be modified or deleted.

Integrations

Updated Integrations

The following integrations have been updated in this release of D3 SOAR.

Integration Name

Changes

Claroty

Enhanced Command(s)

New commands have been created using the existing integration resource to replace all original commands.