New features available in Cortex XSOAR 6.9, including Threat Intel, case management and Platform improvements.
The following new features are categorized by product component.
Deployment Wizard
When installing or updating content packs, the DEPLOYMENT WIZARD tab guides you step-by-step to adopt your use case (including Phishing and Malware), significantly reducing the setup time. The wizard guides you through:
Setting up a fetching integration
Setting up a playbook
Setting up any required supporting integrations
Enabling the fetching integration instance
Filter by Wizards to search for content packs that support the Deployment Wizard.
Case Management
Feature | Description |
|---|---|
Remove content on session timeout | Added the |
SAML 2.0 Configuration | You can now let administrators manually enter certain user information fields when configuring SAML 2.0, which persist if those fields are not provided by SAML third-party provider, by adding the following server configuration. Select → → → : Key: Value: For more information, see Authenticate Users with SAML 2.0. |
Platform
Feature | Description |
|---|---|
Add warning message regarding viewing comments in incidents | (Multi-Tenant) Added a warning message, when handling bulk incidents. This message informs analysts that any added comments will be presented to all customers and should not include customer specific incident details. For example, if you select 10 incidents that are relevant for one customer, you may not want to share this with other customers. |
Zoom level | When switching between playbooks, the user's zoom level is now preserved (in = more detail, out = larger view). |
Hide Chart Panel | In the Incidents page, the Hide Chart Panel has been renamed to Hide Overview Dashboard. |