September 2024

This section describes the new features and updates of the Cortex XSOAR Cloud 8.8 release.

Release highlights

The Cortex XSOAR 8.8 release includes the following highlights:

Feature

Description

Canvas -Multilayer indicator/incident relationship graph

SOC analysts can now create and share dynamic attack diagrams or static snapshots with incident response, forensics, and threat-hunting teams. This enables them to visualize and link key security incidents and IOCs, for faster and more streamlined investigation. For more information, see Investigate an incident using the Canvas.

Feature enhancements

The Cortex XSOAR 8.8 release includes the following enhancements:

General

Feature

Description

The Guard Rails page

Cortex XSOAR 8 now includes the Guard Rails page, which shows performance-related errors and warnings that can be used as a guide to detect and prevent actions that may cause a decline in performance or instability. Referring to the page ensures a reliable way to maintain a secure and stable environment. For more information, see View service limit errors and warnings on the Guard Rails page.

Settings page - search field

A new search field on the Settings page provides a fast and easy search of your configuration options.

Audit logs

Audit log coverage is expanded to capture detailed records of incident edits, including the modified fields. This improvement ensures a comprehensive record of all changes, significantly enhancing the ability to trace the incident's history and evolution.

Indicators

Feature

Description

Exclude enrichment of indicators

Indicators can now be marked as Enrichment Excluded in Cortex XSOAR, ensuring they will not be enriched. This gives you better control over your Indicators and the ability to optimize system performance by managing the indicator enrichment process.

For each indicator of type: IP, Domain, Email, URL, and File you can select whether to enable or disable enrichment calls. This allows you to conserve system resources when dealing with known indicators. Specific feeds ("Allow list" feeds) can be set as an enrichment excluded feed through its instance parameters, which excludes all of the indicators ingested by it, from being enriched.

For more information, see Exclude indicators from enrichment.

Engines

Feature

Description

Supported Red Hat Enterprise Linux versions

Cortex XSOAR now supports Red Hat Enterprise Linux 8.10 and 9.4.