Breadcrumbs

18.4

New Features

Adaptive Playbooks

Frame 1 (1).png

Adaptive playbooks are response workflows accessible through the incident workspace, now available in both the classic view and new UI. Morpheus builds and manages them from the chat interface, first generating a plan for analyst approval. After approval, Morpheus builds the playbook on the read-only canvas, where analysts can navigate with a mini map, view agent activity under Runtime Data, and refine drafts via chat. Versioning is available from the top-right dropdown. Versions can be exported as JSON for reference and imported as new drafts. The vertical ellipses within the dropdown provide options to rename or export versions.

NOTE

Access requires the Feature.AdaptivePlaybook.Enabled site setting, which is disabled by default. Contact D3 Support for assistance.

Adaptive Playbook Slash Commands

  • /CreatePlaybook: Generates a new adaptive playbook from a directive

  • /Playbook: Manages saved adaptive playbooks

  • /RunPlaybook: Runs a saved adaptive playbook against this incident

Adaptive Playbook Block Types

  • Morpheus Agent

  • Router

  • Parallel

  • D3 Send Email

  • Approval

SOP Skill Generation from Incident Data Through AI

Frame 8.png

SOPs can now be autonomously generated from incidents by AI. Morpheus reviews how an incident was handled, including the investigation, analyst decisions, and actions taken, then converts the workflow into a reusable SOP skill that analysts or Morpheus can run on similar incidents. Analysts can edit the generated SOP in place, scope it as Personal or Shared, and assign it to specific incident types and sites. Incident types and sites are prefilled from the current incident to reduce manual setup.

NOTE

Only administrators can create SOPs with the Shared scope.

Multi-Level Custom Utility Command Categories

Frame 5 (1).png

Users can now, in both the new UI and classic view, organize utility commands using multi-level custom category folders. Folders provide nesting only and cannot contain commands or be selected. They can be created, nested, or renamed to organize commands by team or purpose, and deleted when no longer needed. Deleting a folder removes its contents after confirmation, and moves affected commands to "Uncategorized," as each command must belong to at least one category. Existing categories remain unchanged as root-level entries.

Enhancements

AI-Generated Investigation and Preprocessing Playbooks

Frame 4 (2).png

The Generate with AI button is extended from Investigation Playbooks to Preprocessing Playbooks, in both the classic and new UIs, with module-specific suggested prompts available under the Describe it myself tab. With site and trigger data selected, Morpheus can generate a preprocessing playbook draft, labeled Generated by Morpheus. Reopening Generate with AI displays the generation status, whether in progress or complete, without restarting the process.

NOTE

Access requires the Feature.APDeterministicPath.Enable site setting, which is disabled by default. Contact D3 Support for assistance.

Investigation Playbook Chat Command

Investigation Playbook Chat Command.png

The incident chat in the new UI now supports the /RunInvestigationPlaybook command, which runs an investigation playbook against the current incident. The command performs the navigation that an analyst would otherwise complete on the workspace's Playbooks page, or by using the Add Playbook to Incidents utility command, allowing the analyst to start a playbook without leaving the incident chat.

Suggested Tag List Management

Suggested Tag List Management (requires Delete Tag privilege).png

Within the incident workspace header, tag selection menu items can now be deleted, in both the new and classic UIs. Users with the new Delete Tag role permission can delete tags after confirmation. Deleting a tag does not remove it from incidents where it is already applied, and recreating a deleted tag with the same name makes it available for selection again. Tags can be created from the tag selection menu without assigning them to the current incident.

Granting the Delete Tag Privilege

  1. Navigate to Global Settings > Organization Management > Roles module.

  2. Select the role to be granted the privilege.

  3. Check the Delete Tag checkbox under the Incident section of the Details tab.

  4. Click on the Save button.

  5. Log out and log back in for the privilege to take effect.

Global List Bulk Editing

Global List Bulk Editing.png

The Global List > Data tab in the new UI now supports editing the entire list at once. The new Text view displays all list entries in a single JSON editor, allowing users to add, update, or delete multiple entries in one pass. From the Tree view, users can also bulk edit the entire list by uploading a JSON file using the new "Sync entire list to file" radio option in the Batch Upload Data popover.

Global List Audit Log Details

Global List Audit Log Details.png

In the new UI, selecting a record in Global List > Audit Log now opens a Log Detail popover showing values that were added, removed, or unchanged, providing additional context alongside the existing user and timestamp information. Users can review changes made to the Global List in the Formatted tab, or view the corresponding old and new value data in the Raw JSON tab. The Audit Log displays the 50 most recent modifications to the corresponding global list.

Linked Incident Search Filters

Frame 6 (2).png

The Add Linked Incidents popover, opened from the + button on an incident workspace's Linked Incidents widget, now supports filtering, in both the new and classic UIs. Users can combine eight filters with search text to find related incidents without knowing an exact incident number or keyword. Existing search functionality remains unchanged.

Available Linked Incident Filters

  • Severity

  • Status

  • Type

  • Owner

  • Tags

  • Tactic

  • Technique

  • Created (date range)

Bulk Editing of Type-Specific Incident Fields

Frame 7 (1).png

Bulk editing of type-specific incident fields is now available in the new UI under the Incidents dashboard's Edit Fields drawer. Analysts can update supported dynamic fields configured in Incident Type Manager > Incident Type > Incident Form Builder, eliminating the need to collect incident numbers and run a utility command.

Command Details in the Select Command Popover

Command Details in the Select Command Dialog (1).png

The Select Command popover in the new UI now includes a detail panel to the right of the command list, matching the classic view. It can be opened from the ellipsis button in a playbook command task configuration panel or from the Execute a Command popover, accessed through the ⌘ icon in an incident details side panel on the Incidents dashboard. Selecting a command displays its description, associated integration, and sample input and output data, helping analysts confirm that the command meets their intended use.

Command Search Connection Filter

Command Search Connection Filter (1).png

Integration command search now includes an Only connected integrations toggle in both the new and classic UIs, helping analysts focus on commands they can run. System commands remain visible at all times. Filtering considers configured connections, so connection health must be checked separately. Result counts show displayed integrations, and a footer message indicates how many integrations were hidden.

Multi-Tenant Reporting

Frame 2 (1).png

In the Reporting Dashboard > Widgets module of both the classic view and new UI, reporting has been enhanced to allow master instances to display widgets across selected tenant sites, in addition to master-level data. A Multi-Tenant button, at the top right corner, opens a popover for selecting participating sites. When a participant is unavailable, the Query Data tab names the missing tenants.

Multi-Tenant Participant Options

Multi-Tenant Mode: The switch that turns fan-out on

Master: Include the master site's own data

Tenant Sites: A checkbox for each registered tenant, the option to include each of their data

NOTE

Access requires a master instance and the Feature.Reporting.MultiTenant.Enabled site setting, which is disabled by default. Contact D3 Support for assistance.

Utility Commands

New Commands

The following utility commands have been added to this release.

Commands

Functionality

Create Or Update Connection By Clone

The new optional Include Connection Health Check input copies the source connection's health-check settings to the clone. By default, the value is False. When enabled, the cloned health check is also scheduled. Integrations without a Test Connection command are reported as not applicable and are not cloned.

Client Site Access Control

Allows administrators or users with the Access Privileged Commands permission to block or restore all user access to a client site without affecting integrations or ingestion. Blocked sites are marked "(Blocked)" in the Dashboard site switcher. Unlocking restores previous memberships. An optional Duration (minutes) input schedules automatic unlocking.

Get APD Result by Incident Number

Retrieves the attack path discovery (APD) result for an incident, including the AI summary and key findings, attack timeline, remediation timeline, AI audit trail, investigation graph, narrative, artifact list, incident notes, and per-event APD reports.

The Included Sections input controls which sections will be returned. By default, all sections will be returned except QueryLogFull.

Updated Commands

The following utility commands were updated in this release.

Commands

Changes

Get Integration Fetch Health

Adds support for reviewing historical integration health over a specified time range and set of sites. Results include per-job outcomes, ingested-event counts, and the top 50 categorized errors. Existing behavior remains unchanged when no time range is provided. For accurate ingested-event counts, use specific site IDs.