Cortex XSOAR 8 SaaS Releases
Major general availability releases for Cortex XSOAR 8 SaaS.
All releases below are general availability releases for Cortex XSOAR 8 SaaS.
8.15
Azure external storage support for incident export: Export Cortex XSOAR incident data, including war room entries and attachments, directly to Azure Blob Storage to maintain cloud compliance. Available to XSOAR 8 SaaS customers at no additional charge.
Continuous Strata logging authentication: Maintain uninterrupted data logging across commercial and FedRAMP Moderate environments. The platform now automatically manages secure background authentication for the Strata Logging Service, ensuring continuous data flows.
8.14
Multi-tenant support for child-tenant name changes: Simplify tenant management by renaming child tenants directly in the Cortex Gateway. You now have the flexibility to ensure tenant names consistently reflect current business requirements, maintaining operational clarity across large-scale SOC deployments.
Organized content management: Easily distinguish between your custom work and content pack items with a dedicated workspace for each. To ensure a cleaner view, we moved all content pack items to the Content Pack Items page, while the Content Items page is now reserved exclusively for your custom creations.
Enhanced audit logs: Gain full visibility and meet compliance requirements with expanded auditing for notification forwarding and content management. You can now track configuration changes for notifications and high-stakes content lifecycle events, such as pushing content to production, directly within the Management Audit log.
8.13
Contextual playbook documentation: We have introduced Info Mode to the playbook editor, allowing you to view detailed task and section descriptions directly within your workflow.
New Rapid Response Playbook: Automate the detection and mitigation of CVE-2025-59287, a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS) caused by insecure deserialization.
Improve playbook unlocking: Ensure your team can edit their automation workflows with automatic or manual playbook unlocking. The system now clears locks immediately when a user logs out or when a session expires.
8.12
Conflict-free playbook: Prevent concurrent playbook editing with this enhancement, ensuring your team can build and modify automation workflows without conflicts.
Unique task logos: Boost clarity, quickly distinguish between integration commands, custom scripts, and system actions with playbook tasks that display unique logos and content pack indicators.
Unit 42 Threat Intelligence content pack: A new Unit 42 content pack provides high-value integrations that leverage Unit 42’s world-class threat intelligence, research, and analysis, replacing several deprecated packs (like AutoFocus and Unit 42 ATOMs Feed). To complete this migration, configure the new Unit 42 Feed and Enrichment integrations, update all related playbooks, and disable the old integrations.
8.11
Advanced search for playbooks and scripts: Easily find and use existing scripts and playbooks by searching for specific text within scripts or by searching the names of scripts, tasks, and third-party integrations within playbooks.
Clear incidents waiting in the ingestion queue: Regain control during incident floods, ensure critical playbooks run smoothly, prevent bottlenecks, and facilitate rapid self-recovery.
Generic Webhook integration enhancements: Easily ingest external data without an API integration and connect with diverse services with support for header-based authentication and a simplified setup experience.
8.10
Automatically export incidents: For customers who need to store incidents beyond their retention period, XSOAR can automatically export incidents to external storage, enabling indefinite retention and continued access to historical incident data.
Support for additional Cortex XSOAR APIs: The expanded API support enables organizations to reset the ROI widget, update existing lists, get a list, upload files, and clone playbooks so they can better fine-tune automated incident workflows and integrations.
8.9
A new look and feel for playbooks: The latest enhancements in user experience improve playbook readability and clarity through an updated look and feel.
Collapsible playbook sections: The updated collapsible playbook sections enable users to stay focused on the relevant playbook details without distractions, allowing for easier navigation through complex playbooks and increased productivity.
Unlimited user license for development tenants: With no license limit for users on development tenants, you can build, test, and refine automations at scale. This drives faster innovation, more reliable workflows, and scalable solutions as your organization grows.
Notifications for deprecated content: New automated user notifications about deprecated playbooks, sub-playbooks, and scripts ensure updated, effective, and accurate security workflows.
8.8
Canvas - Multilayer indicator/incident relationship graph: SOC analysts can now create and share dynamic attack diagrams or static snapshots with incident response, forensics, and threat-hunting teams.
The Guard Rails page: Cortex XSOAR 8 now includes the Guard Rails page, which shows performance-related errors and warnings that can be used as a guide to detect and prevent actions that may cause a decline in performance or instability.
Exclude enrichment of indicators: Indicators can now be marked as Enrichment Excluded in Cortex XSOAR, ensuring they will not be enriched. This gives you better control over your Indicators and the ability to optimize system performance by managing the indicator enrichment process.
Audit logs: Audit log coverage is expanded to capture detailed records of incident edits, including the modified fields. This improvement ensures a comprehensive record of all changes, significantly enhancing the ability to trace the incident's history and evolution.
8.7
Seamlessly migrate all your data, configurations, and settings, including indicators and incidents from Cortex XSOAR 6.13 On-prem to Cortex XSOAR 8 Cloud using a built-in wizard streamlining the migration process.
To effectively investigate an incident and analyze associated indicators, the SOC analyst must have access to up-to-date data and a clear view of the most recent changes made to the relevant indicators, as well as the initial entries of indicator changes.
When generating a report, you can choose the timezone to ensure accurate and localized reporting for users working in multiple geographical locations.
Admin users can manage notification distribution by adding or removing tenant’s stakeholders' email addresses on the Server Settings page without the need to add them first on the tenant. This feature streamlines communication and simplifies administration.
8.6
You can create API keys with multiple roles to improve operational efficiency and allow dynamic RBAC management of API keys.
The Administrator can restrict designated users' access to specific dashboards through role assignment.
Cortex XSOAR has an API endpoint for GET, CREATE, UPDATE, and DELETE for API keys.
You can change the color of the favicon for each tenant, which allows you to identify which tenant is being used in each tab at a glance.
8.2
XSOAR 8 now offers Cortex XSOAR multi-tenant, designed for managed security service providers and enterprises requiring strict data segregation with the flexibility to share and manage critical security practices across tenant accounts.
Role permissions have been updated to separate some administration permissions.
You can now subscribe to content pack updates in Marketplace.
Improved UI for Data Collection and Ask tasks in Playbooks, and a simplified search for playbooks with free text search.
Improvements to the Default Playbook.
Last updated
Was this helpful?