> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.12/release-information/minor-releases.md).

# Minor Releases

| Cortex XSOAR Minor Release                                      | Release Date       |
| --------------------------------------------------------------- | ------------------ |
| [Cortex XSOAR 6.12.0 (B1271551)](#cortex-xsoar-6.12.0-b1271551) | August 18, 2024    |
| [Cortex XSOAR 6.12.0 (B857430)](#cortex-xsoar-6.12.0-b857430)   | February 29, 2024  |
| [Cortex XSOAR 6.12.0 (B661643)](#cortex-xsoar-6.12.0-b661643)   | December 3, 2023   |
| [Cortex XSOAR 6.12.0 (B493375)](#cortex-xsoar-6.12.0-b493375)   | September 20, 2023 |

For details on how to download and install the latest version, see [Upgrade Your Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/single-server-deployment/upgrade-the-cortex-xsoar-server).

#### Cortex XSOAR 6.12.0 (B1271551)

Cortex XSOAR 6.12.0 (B1271551) is a maintenance release that includes the following new features and bug fixes:

| Category            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| APIs                | <ul><li>When running the Core REST API command to delete file entries, an error was generated.</li><li>An invalid API master key caused an error to appear in logs and a few hosts to randomly disconnect.</li></ul>                                                                                                                                                                                                                                                         |
| General             | <ul><li>After upgrading from Cortex XSOAR 6.10 to 6.12, the Settings page did not load and an error appeared.</li><li>The Cortex XSOAR server restarted unexpectedly.</li><li>A mandatory markdown field could not be updated or saved if its initial value was empty.</li></ul>                                                                                                                                                                                             |
| Incidents           | <ul><li>Certain authenticated but unauthorized users could access restricted incident data through a specific command.</li><li>Users creating an incident were able to access it even though their role was not assigned to it.</li><li>When searching for incidents using the Triage SLA field, inaccurate results were returned.</li><li>In some cases, preprocess rules were not editable or able to be reordered.</li></ul>                                              |
| Integrations        | <ul><li>When configuring long running integrations, Cortex XSOAR did not fetch 3rd party credentials, and populate them in the configured instance.</li><li><p>When creating an integration instance that fetches credentials, if the integration instance failed while fetching the credentials, the following error was displayed when trying to access the Credentials tab:</p><p><code>"Couldn't transform result content to credentials sets (66)"</code></p></li></ul> |
| Jobs                | When running a nightly job in Cortex XSOAR, the job ran twice when daylight saving time began and when daylight savings time ended.                                                                                                                                                                                                                                                                                                                                          |
| Multi-tenant        | <ul><li>Users deleted in the Main account were not deleted correctly in one of the child tenants.</li><li>Using propagation labels to remove content from tenants, sometimes did not completely remove the content.</li><li>Child investigation roles were not updated correctly.</li></ul>                                                                                                                                                                                  |
| Playbooks           | <ul><li>Files generated when running playbooks in edit mode could not be accessed or downloaded.</li><li>When creating a playbook and using a variable such as <code>${incident.name}</code> in the <strong>Message body</strong> field of a Conditional Ask task, the variable was not resolved and the variable name was displayed in the incident.</li></ul>                                                                                                              |
| Remote Repositories | When trying to push content from dev to prod and there was a conflict, such as an incident field of a different type, there was no content installation conflict message displayed, and the existing content on prod remained.                                                                                                                                                                                                                                               |
| Reports             | <ul><li>The reference line created in the Widget Builder in the graph section did not appear when generating a report.</li><li>When exporting CSV reports from Cortex XSOAR and opening them in Excel, the Hebrew text was not automatically readable.</li><li>When generating a report of type <strong>Line</strong>, the chart was generated in UTC, regardless of the <strong>reports.time.zone</strong> setting.</li></ul>                                               |
| Scripts             | When running an incident post-processing script to stop a timer, the built-in incident closure process caused the post-processing script to execute twice.                                                                                                                                                                                                                                                                                                                   |

**Installation file hash**:`da89f25ee42fc0c79aec8a5766f53612c85d3067`

#### Cortex XSOAR 6.12.0 (B857430)

Cortex XSOAR 6.12.0 (B857430) is a maintenance release that includes the following new features and bug fixes:

**New Features and Improvements**

* Playbook stability has improved.
* The Work Plan stability has improved when using the `!setPlaybook` command.
* Improved content installation and session data requests.
* Improved optimization for Websockets.
* Cortex XSOAR now supports RHEL 9.2 and 9.3.
* Cortex XSOAR now supports Elasticsearch 8.11.

| Category          | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Elasticsearch     | <ul><li>When using Elasticsearch, the <strong>Group By</strong> option for charts did not work.</li><li>If you attempted to add data larger than the Elasticsearch maximum size for HTTP data, the data was rejected by Elasticsearch, but Cortex XSOAR reported the action as successful.</li><li><p>When using Elasticsearch, you could not search incidents by the <code>lastOpen</code> field.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If you need to search incidents using the <code>lastOpen</code> field that was created before upgrading to this release, reindex all common-incident indices.</p></div></li></ul> |
| General           | In some cases, special characters in markdown text were not rendered correctly.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Incidents         | <ul><li>Unique names for incident types were not enforced.</li><li>When incident tabs were duplicated, incident fields did not display correctly in the duplicated tab or the original tab.</li><li>When incidents were exported to a CSV file, the closing notes did not have line breaks.</li><li>In some cases, when a pre-process rule tried to link incidents, the incidents did not link and the playbook was not triggered.</li></ul>                                                                                                                                                                                                                                                              |
| Indicators        | <ul><li>When the <strong>Do not use by default</strong> option was selected for an integration instance, the <code>!enrichIndicators using=</code> command did not enrich indicators.</li><li>In a custom indicator layout, a script was used calling the <code>CreateIndicatorRelationship</code> command, and the script could not save the created relationships.</li></ul>                                                                                                                                                                                                                                                                                                                            |
| Migration         | <ul><li>When migrating from Cortex XSOAR 6 Hosted to Cortex XSOAR 8, only custom Docker images with the <code>latest</code> tag were migrated.</li><li>When migrating from Cortex XSOAR 6 Hosted to Cortex XSOAR 8, user objects were not re-migrated during the cut-off date, causing lost updates to user preferences.</li><li>When migrating from Cortex XSOAR 6 Hosted to Cortex XSOAR 8, custom engines connected to both the Cortex XSOAR 6 instance and the Cortex XSOAR 8 tenant, caused the engines to shut down existing Docker containers.</li></ul>                                                                                                                                           |
| Multi-Tenant      | <ul><li>Users could not customize system emails to include a link directly to the system URL.</li><li>Users (even those with admin rights) were unable to edit lists.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Playbooks         | An investigation playbook cache caused a delay in the update of the investigation playbook, which resulted in the recovery mechanism triggering redundant runs over the same playbook.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Podman            | Podman installation would sometimes fail in RHEL systems.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Remote Repository | <ul><li><p>In some cases, the remote repository push action failed due to the GIT error</p><p><strong>skipped previously applied commit</strong>.</p></li><li>Content packs were committed with the default DBot user even if a different default user was set using a server configuration.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                    |
| Scripts           | In some cases, scripts timed out at 5 minutes, even if the max script timeout was set to a higher value.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| War Room          | The scrolling UP arrow button in the War Room did not function as intended. It did not scroll the page to the top and refreshed it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

**Installation file hash**:`0a036126f1a3de2ad34e628722f797029653213557ac52b388fa56e47b969028`

#### Cortex XSOAR 6.12.0 (B661643)

Cortex XSOAR 6.12.0 (B661643) is a maintenance release that includes the following new features and bug fixes:

**New Features and Improvements**

* Improved validations for saving filters to prevent issues relating to filter and search queries.
* When adding an automation argument, spaces are now allowed in list options.

| Category            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Indicators          | <ul><li>When exporting the indicators table to a CSV file, data in the Unit 42 Intel Data Added column was not exported.</li><li>The SSDeep indicator value was incorrectly shown as SHA256 when viewing the File type indicator in the Indicator Quick View window.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Elasticsearch       | <ul><li>In some cases, when using Elasticsearch, saving or updating linked incidents returned <code>Item not found</code> or <code>version conflict</code> errors.</li><li>Inconsistent results were returned when using Elasticsearch.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Incidents           | <ul><li>An empty white space remained in the layout where the section header would normally appear when a section header in an incident layout was hidden.</li><li>If you imported an incident type that contained indicator extraction rules, which referenced an indicator type and was not in the system, you could not edit the imported incident type.</li><li>In some cases, the search and refresh buttons for an incident layout section overlapped.</li><li>Occasionally when an incident was created, the Work Plan could not be accessed.</li></ul>                                                                                                                                                                     |
| CLI                 | <ul><li>In some cases, the CLI box overlapped and hid other UI elements.</li><li>Certain characters were removed when running the <code>ParseCSV</code> command in the War Room.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Dashboards          | <ul><li>The error message <strong>"Failed rendering widget", script: "showGraphValues"</strong> was displayed in the Incidents Health and Integrations Health dashboards.</li><li><p>The automatic refresh of the Dashboards or Incidents page led to a crash when specific conditions were met:</p><ul><li>There were many idle users on the Dashboards or the Incident Case Info page.</li><li>All of those idle users had a low refresh interval (e.g., <10 minutes).</li><li>All of those idle users had <strong>All Times</strong> searches configured in their Dashboards or Incident Cases Info page.</li></ul></li></ul>                                                                                                   |
| General             | <ul><li>Text did not wrap and the entry could not be deleted because the delete icon was hidden by the long text when adding a substantial amount of text to the <strong>Filter</strong> field in the <strong>Filters & Transformers</strong> pane.</li><li>In an environment with multiple app servers, <strong>SLA/Timer</strong> fields were not synched correctly.</li><li>When performing a relative time search, for a period of more than 10 months, which included the previous year, the returned results were not complete.</li></ul>                                                                                                                                                                                    |
| High Availability   | In a high availability environment, users were not able to log in with SAML while a server was restarting.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Live Backup         | When incident fields were replicated on the backup server, the index mapping was not updated, leading to indexing issues if the backup server became the active server.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Remote Repositories | In production environments, you could not delete custom lists.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Reports             | <ul><li>An error appeared when a report was generated from an incident as a Word file.</li><li>The report did not run as scheduled when scheduling a CSV report from the Report Editor page. You needed to schedule the report from the Summary page.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Playbooks           | <ul><li>If you reopened a task in a completed playbook, the following tasks in the playbook did not change their status to New unless you refreshed the page or switched between tabs.</li><li>For two different commands with the same name but with different arguments, if a playbook task used the command, occasionally arguments from both commands appeared.</li><li>When a playbook task created new entries in the War Room, the War Room page always displayed from the start of the War Room.</li><li>The <strong>Continue on error path(s)</strong> condition was not followed when a playbook task included built-in polling via the <code>scheduled\_command</code> class, and the task returned an error.</li></ul> |
| War Room            | <ul><li>If a filter was applied and then removed, not all of the entries were loaded, when there were many entries in the War Room (more than 200).</li><li>Filtering in the War Room and then switching between the <strong>War Room</strong> and <strong>Work Plan</strong> tabs sometimes caused a rendering error.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                   |

**Installation file hash**:`b689504b82d228c0898c4b577e8e0b429ea75cd292fb91135c0176102a398d9f`

#### Cortex XSOAR 6.12.0 (B493375)

Cortex XSOAR 6.12.0 (B493375) is a maintenance release that includes the following bug fixes:

| Category            | Description                                                                                                                                                                                                              |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Elasticsearch       | An error appeared when searching for a document that contained a date that ended in a zero in the command line. If an error appears, you can now set the `es.pad.date.format.nano.zeros` server configuration to `true`. |
| GIT                 | A customer was unable to push changes to GIT due to a missing libcurl-gnutls.so.4 file.                                                                                                                                  |
| Integrations        | When the Generic Export Indicators Service integration exported certain system indicator fields (such as sourceBrands), it sometimes omitted indicators in the EDL output (for Bolt/Bleve databases only).               |
| Marketplace         | Content pack upgrades failed to download because the system got stuck reading custom tools.                                                                                                                              |
| Playbooks           | When working with multiple layers of nested sub-playbooks, inputs were sometimes taken from the wrong sub-playbook.                                                                                                      |
| Playbooks           | In a playbook debugging session, referencing a file's entry ID from a different investigation resulted in an invalid file error.                                                                                         |
| Playbooks           | In some cases, when running a playbook that creates a new scheduled task and then refreshes a schedule reminder queue, the playbook hangs because the new schedule entry is not yet indexed in the database.             |
| Playbooks           | Playbook tasks showed red task color even when configured to continue on errors.                                                                                                                                         |
| Jobs                | Job run updates were not configurable in the **Notifications** tab, and job notification emails were not sent.                                                                                                           |
| Remote Repositories | In some cases, after selecting a branch or switching to a new branch in the **Content Repository** settings page, Cortex XSOAR could not connect to the remote repository.                                               |
| Work Plan           | In some cases, due to a sync error, data was not saved correctly, so the Work Plan did not display the correct task status although the War Room did.                                                                    |
| Work Plan           | When running very large playbooks that returned a substantial number of related entries, timeout issues occurred and the Work Plan did not load.                                                                         |

**Installation file hash**: **`53d554cee754836b1bb7117c27830a7fa4ffd05314212de8319ea4f8e9d38120`**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.12/release-information/minor-releases.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.