June 2024

This section describes the new features and updates of the Cortex XSOAR Cloud 8.7 release.

Release highlights

The Cortex XSOAR 8.7 release includes the following highlights:

Feature	Description
XSOAR 6 On-prem To SaaS Migration	Seamlessly migrate all your data, configurations, and settings including indicators and incidents from Cortex XSOAR 6.13 On-prem to Cortex XSOAR 8 Cloud using a built-in wizard that streamlines the migration process.
Indicator timeline preservation	In order to effectively investigate an incident and analyze associated indicators, it is crucial for the SOC analyst to have access to up-to-date data and a clear view of the most recent changes made to the relevant indicators, as well as the initial entries of indicator changes. This capability guarantees access to recent indicator activity data, empowering timely threat detection and facilitating swift response actions. For more information, see Configure the indicator timeline.
Reports in the Timezone of Choice	Cortex XSOAR now supports teams working in different locations, enabling the user to select the timezone of the report. For more information, see Configure the timezone for a report.
Manage notification distribution	Admin users can manage notification distribution by adding or removing tenant’s stakeholders' email addresses on the Server Settings page, without the need to add them first on the tenant. This feature streamlines communication and simplifies administration. For more information, see Configure server settings.

Feature enhancements

Platform

Cortex XSOAR 8.7 supports the following operating systems for engine installation:

Feature	Description
Supported Oracle Linux versions	Cortex XSOAR now supports Oracle Linux 8.9 and 9.3 for engine installation. For more information, see Engine requirements.

Changed features

Cortex XSOAR 8.7 includes the following changes to existing functionality:

Feature	Description
OpenSSL 1.1.0 and earlier	OpenSSL versions 1.1.0 and earlier that are past end-of-life are no longer supported. For more information, see Syslog Server Management.
CentOS 7.x	CentOS 7.x reached End of Life (EOL) on June 30, 2024, and is no longer a supported operating system (for engine installation). For more information, see Engine requirements.

Marketplace content changes

This section describes the changes in content (integrations, playbooks, and indicators) from April 2024 to June 2024.

Content	Description	Change type
Cortex XDR Malicious Pod Response Playbook	This new playbook helps you quickly and effectively respond to malicious activity in pods. It includes a master playbook and a sub-playbook for agent and agentless environments. The playbook automates the creation of a Lambda function, handles container registry and image verification, and integrates threat intelligence and image scanning to provide comprehensive security measures. For more information, see Cortex XDR - Malicious Pod Response.	New
Zoom Mail integration	The new Zoom Mail integration allows for email creation and deletion, user management, and streamlining message handling with attachment extraction. For more information, see Zoom Mail.	New
Rapid7 InsightVM integration	The integration now supports creating, updating, deleting, and retrieving tags and their associations with assets and groups. It also includes commands for managing site targets and groups. For more information, see Rapid7 InsightVM Cloud.	Update
GitHub Feed	A new feed was added, which fetches indicators from GitHub repositories. For more information, see Github Feed.	New
AWS EKS integration	The new AWS EKS integration enables the management and operation of Amazon Elastic Kubernetes Service (EKS) clusters. For more information, see AWS-EKS.	New
Yara Rule indicator	Added a new indicator type, which is part of the Yara content pack. For more information, see the Yara content pack.	New
Generic Webhook integration	This integration has been enhanced to support the creation of multiple incidents in a single request. For more information, see Generic Webhook.	Updated