Minor Releases - Release Notes - 6.6 - Cortex XSOAR - Cortex - Security Operations

Fixed invalid licensing issues for TIM-only customers.

Although some sub-playbook tasks progressed in the server, they did not appear, unless when refreshing the page.

When creating a playbook and then navigating to the Manual Tasks tab from the Task Library window, the tab did not load.

When setting a job start time using the human readable mode option, the job did not start at the correct time.

When viewing an incident, if you viewed the Incident/Case Info tab, switched to a different tab, and then returned to the Incident/Case Info tab, the incident name no longer appeared in the tab header.

In some cases, customers with a TIM only license were not able to run Cortex XSOAR operations.

(Multi-tenant) Improvements have been made to multi-tenant deployments with large numbers of hosts. Cortex XSOAR no longer automatically creates all installers and does not query offline hosts.

When an incident was closed, it displayed a “crown”, but the incident remained open.

When corrupted data was sent to telemetry, in rare occasions, the server froze, which required a manual restart to the service.

When copying tasks between playbooks, and then switching between playbooks, the playbook loader did not update.

When editing a custom playbook, deleting a task, and then selecting the undo button, a screen artifact remained, which caused the playbook to load constantly.

When selecting one of the options from the “three dots” menu in an incident or in the Playground, and then trying to select other options from the same menu or from the Actions menu, the menus became inaccessible.

In some cases, attempts to update the playbook in the cache would fail because the playbook was already up-to-date, causing an unnecessary error to display in the UI.

A concurrency error caused the Cortex XSOAR server to stop and restart.

(Elasticsearch) Migration failed when migrating custom grid fields with empty date values.

(TIM) When upgrading to v6.6, the TIM license was invalidated.

(Hosted Service) In some cases, hosted service deployments crashed due to concurrent read write errors.

(Multi-tenant) Accounts on remote hosts would sometimes enter deactivated mode.

(Multi-tenant) Cortex XSOAR failed when there were timeouts from a large number of hosts.

(Multi-tenant) In some scenarios, the host deleted all of its local users. This triggered all users to be deleted from the host’s accounts as well, along with their related API keys, preventing any access to those accounts.

(Multi-tenant with High Availability) In some cases, an empty high availability group remained in the database, causing panics.

For recurring jobs, the nextRunTime time calculation was not calculated according to the from new job form field.

After upgrade, the server continuously created random folders under /var/lib/demisto/.

A function in the /services/statistics.go file returned NIL and caused a panic log error when it was later referenced in the file.

When running a playbook, if an error occurred, the Stop button was disabled.

When running the playbook debugger on the same playbook in two different tabs, an error occurred.

When running a playbook with the follow checkbox selected, the UI did not follow the playbook execution.

In some cases, playbooks would hang in the middle of their run, due to role change changes being applied to the playbook too soon.

In some cases, playbooks did not auto-run due to an issue in updating the cache.

When editing and running a playbook that contains a Data Collection task which requests an attachment, after the user opens the link and adds an attachment, the attachment was shown twice.

When running JavaScript and Python integrations and files on engines, an error appeared while running specific commands.

Cortex XSOAR crashed due to a concurrent map read and write error.

(Multi-tenant) In a High Availability environment, a websocket issue caused connectivity issues.

(Multi-tenant) In a High Availability environment, after adding a breakpoint to a task in a playbook, when running the playbook and clicking Run Automation Now (in the task with the breakpoint), an error is displayed.

(Multi-tenant) After upgrading, some accounts were marked as not active if the account was not created on the Main Server.

Non-licensed users submitting cases in the self-service portal received a permissions error when logging in.

The ToDo Task widget in the Overview dashboard did not display any assigned ToDo tasks if a role was assigned to the incident.

When upgrading to Cortex XSOAR version 6.6 with a Cortex SOAR license only, jobs tasks failed to complete, due to a playbook issue which caused them not to execute.

In some cases, when attempting to copy a task, the entire playbook was selected instead.

After selecting incidents, if you changed the query to exclude the selected incidents, they remained selected, but were not included in the list of selected incidents. as it has not yet been fixed.

When using bi-directional mirroring, closed incidents were mirrored out.

When run on an engine, the Remote Access integration could not copy artifact files.

(Threat Intel Management) When searching for data in the Sample Analysis page, after the request completed, if there was a 502/505 error code, the following error was returned:

TypeError: Cannot read properties of null (reading 'then')

(Elasticsearch) After using the debugger on a playbook with data from a specific incident or the Playground, the debugger did not work correctly if you tried to debug the same playbook using data from incidents stored in other partitions.

(Multi-tenant) In a High Availability environment, sometimes app server communication issues caused system errors, including failing to execute commands on engines, failing to open work plans in the UI, failing to consistently run automations and commands, etc.