Minor Releases
Cortex XSOAR 6.12 minor release, maintenance release.
August 18, 2024
February 29, 2024
December 3, 2023
September 20, 2023
For details on how to download and install the latest version, see Upgrade Your Installation.
Cortex XSOAR 6.12.0 (B1271551)
Cortex XSOAR 6.12.0 (B1271551) is a maintenance release that includes the following new features and bug fixes:
APIs
When running the Core REST API command to delete file entries, an error was generated.
An invalid API master key caused an error to appear in logs and a few hosts to randomly disconnect.
General
After upgrading from Cortex XSOAR 6.10 to 6.12, the Settings page did not load and an error appeared.
The Cortex XSOAR server restarted unexpectedly.
A mandatory markdown field could not be updated or saved if its initial value was empty.
Incidents
Certain authenticated but unauthorized users could access restricted incident data through a specific command.
Users creating an incident were able to access it even though their role was not assigned to it.
When searching for incidents using the Triage SLA field, inaccurate results were returned.
In some cases, preprocess rules were not editable or able to be reordered.
Integrations
When configuring long running integrations, Cortex XSOAR did not fetch 3rd party credentials, and populate them in the configured instance.
When creating an integration instance that fetches credentials, if the integration instance failed while fetching the credentials, the following error was displayed when trying to access the Credentials tab:
"Couldn't transform result content to credentials sets (66)"
Jobs
When running a nightly job in Cortex XSOAR, the job ran twice when daylight saving time began and when daylight savings time ended.
Multi-tenant
Users deleted in the Main account were not deleted correctly in one of the child tenants.
Using propagation labels to remove content from tenants, sometimes did not completely remove the content.
Child investigation roles were not updated correctly.
Playbooks
Files generated when running playbooks in edit mode could not be accessed or downloaded.
When creating a playbook and using a variable such as
${incident.name}in the Message body field of a Conditional Ask task, the variable was not resolved and the variable name was displayed in the incident.
Remote Repositories
When trying to push content from dev to prod and there was a conflict, such as an incident field of a different type, there was no content installation conflict message displayed, and the existing content on prod remained.
Reports
The reference line created in the Widget Builder in the graph section did not appear when generating a report.
When exporting CSV reports from Cortex XSOAR and opening them in Excel, the Hebrew text was not automatically readable.
When generating a report of type Line, the chart was generated in UTC, regardless of the reports.time.zone setting.
Scripts
When running an incident post-processing script to stop a timer, the built-in incident closure process caused the post-processing script to execute twice.
Installation file hash:da89f25ee42fc0c79aec8a5766f53612c85d3067
Cortex XSOAR 6.12.0 (B857430)
Cortex XSOAR 6.12.0 (B857430) is a maintenance release that includes the following new features and bug fixes:
New Features and Improvements
Playbook stability has improved.
The Work Plan stability has improved when using the
!setPlaybookcommand.Improved content installation and session data requests.
Improved optimization for Websockets.
Cortex XSOAR now supports RHEL 9.2 and 9.3.
Cortex XSOAR now supports Elasticsearch 8.11.
Elasticsearch
When using Elasticsearch, the Group By option for charts did not work.
If you attempted to add data larger than the Elasticsearch maximum size for HTTP data, the data was rejected by Elasticsearch, but Cortex XSOAR reported the action as successful.
When using Elasticsearch, you could not search incidents by the
lastOpenfield.
General
In some cases, special characters in markdown text were not rendered correctly.
Incidents
Unique names for incident types were not enforced.
When incident tabs were duplicated, incident fields did not display correctly in the duplicated tab or the original tab.
When incidents were exported to a CSV file, the closing notes did not have line breaks.
In some cases, when a pre-process rule tried to link incidents, the incidents did not link and the playbook was not triggered.
Indicators
When the Do not use by default option was selected for an integration instance, the
!enrichIndicators using=command did not enrich indicators.In a custom indicator layout, a script was used calling the
CreateIndicatorRelationshipcommand, and the script could not save the created relationships.
Migration
When migrating from Cortex XSOAR 6 Hosted to Cortex XSOAR 8, only custom Docker images with the
latesttag were migrated.When migrating from Cortex XSOAR 6 Hosted to Cortex XSOAR 8, user objects were not re-migrated during the cut-off date, causing lost updates to user preferences.
When migrating from Cortex XSOAR 6 Hosted to Cortex XSOAR 8, custom engines connected to both the Cortex XSOAR 6 instance and the Cortex XSOAR 8 tenant, caused the engines to shut down existing Docker containers.
Multi-Tenant
Users could not customize system emails to include a link directly to the system URL.
Users (even those with admin rights) were unable to edit lists.
Playbooks
An investigation playbook cache caused a delay in the update of the investigation playbook, which resulted in the recovery mechanism triggering redundant runs over the same playbook.
Podman
Podman installation would sometimes fail in RHEL systems.
Remote Repository
In some cases, the remote repository push action failed due to the GIT error
skipped previously applied commit.
Content packs were committed with the default DBot user even if a different default user was set using a server configuration.
Scripts
In some cases, scripts timed out at 5 minutes, even if the max script timeout was set to a higher value.
War Room
The scrolling UP arrow button in the War Room did not function as intended. It did not scroll the page to the top and refreshed it.
Installation file hash:0a036126f1a3de2ad34e628722f797029653213557ac52b388fa56e47b969028
Cortex XSOAR 6.12.0 (B661643)
Cortex XSOAR 6.12.0 (B661643) is a maintenance release that includes the following new features and bug fixes:
New Features and Improvements
Improved validations for saving filters to prevent issues relating to filter and search queries.
When adding an automation argument, spaces are now allowed in list options.
Indicators
When exporting the indicators table to a CSV file, data in the Unit 42 Intel Data Added column was not exported.
The SSDeep indicator value was incorrectly shown as SHA256 when viewing the File type indicator in the Indicator Quick View window.
Elasticsearch
In some cases, when using Elasticsearch, saving or updating linked incidents returned
Item not foundorversion conflicterrors.Inconsistent results were returned when using Elasticsearch.
Incidents
An empty white space remained in the layout where the section header would normally appear when a section header in an incident layout was hidden.
If you imported an incident type that contained indicator extraction rules, which referenced an indicator type and was not in the system, you could not edit the imported incident type.
In some cases, the search and refresh buttons for an incident layout section overlapped.
Occasionally when an incident was created, the Work Plan could not be accessed.
CLI
In some cases, the CLI box overlapped and hid other UI elements.
Certain characters were removed when running the
ParseCSVcommand in the War Room.
Dashboards
The error message "Failed rendering widget", script: "showGraphValues" was displayed in the Incidents Health and Integrations Health dashboards.
The automatic refresh of the Dashboards or Incidents page led to a crash when specific conditions were met:
There were many idle users on the Dashboards or the Incident Case Info page.
All of those idle users had a low refresh interval (e.g., <10 minutes).
All of those idle users had All Times searches configured in their Dashboards or Incident Cases Info page.
General
Text did not wrap and the entry could not be deleted because the delete icon was hidden by the long text when adding a substantial amount of text to the Filter field in the Filters & Transformers pane.
In an environment with multiple app servers, SLA/Timer fields were not synched correctly.
When performing a relative time search, for a period of more than 10 months, which included the previous year, the returned results were not complete.
High Availability
In a high availability environment, users were not able to log in with SAML while a server was restarting.
Live Backup
When incident fields were replicated on the backup server, the index mapping was not updated, leading to indexing issues if the backup server became the active server.
Remote Repositories
In production environments, you could not delete custom lists.
Reports
An error appeared when a report was generated from an incident as a Word file.
The report did not run as scheduled when scheduling a CSV report from the Report Editor page. You needed to schedule the report from the Summary page.
Playbooks
If you reopened a task in a completed playbook, the following tasks in the playbook did not change their status to New unless you refreshed the page or switched between tabs.
For two different commands with the same name but with different arguments, if a playbook task used the command, occasionally arguments from both commands appeared.
When a playbook task created new entries in the War Room, the War Room page always displayed from the start of the War Room.
The Continue on error path(s) condition was not followed when a playbook task included built-in polling via the
scheduled_commandclass, and the task returned an error.
War Room
If a filter was applied and then removed, not all of the entries were loaded, when there were many entries in the War Room (more than 200).
Filtering in the War Room and then switching between the War Room and Work Plan tabs sometimes caused a rendering error.
Installation file hash:b689504b82d228c0898c4b577e8e0b429ea75cd292fb91135c0176102a398d9f
Cortex XSOAR 6.12.0 (B493375)
Cortex XSOAR 6.12.0 (B493375) is a maintenance release that includes the following bug fixes:
Elasticsearch
An error appeared when searching for a document that contained a date that ended in a zero in the command line. If an error appears, you can now set the es.pad.date.format.nano.zeros server configuration to true.
GIT
A customer was unable to push changes to GIT due to a missing libcurl-gnutls.so.4 file.
Integrations
When the Generic Export Indicators Service integration exported certain system indicator fields (such as sourceBrands), it sometimes omitted indicators in the EDL output (for Bolt/Bleve databases only).
Marketplace
Content pack upgrades failed to download because the system got stuck reading custom tools.
Playbooks
When working with multiple layers of nested sub-playbooks, inputs were sometimes taken from the wrong sub-playbook.
Playbooks
In a playbook debugging session, referencing a file's entry ID from a different investigation resulted in an invalid file error.
Playbooks
In some cases, when running a playbook that creates a new scheduled task and then refreshes a schedule reminder queue, the playbook hangs because the new schedule entry is not yet indexed in the database.
Playbooks
Playbook tasks showed red task color even when configured to continue on errors.
Jobs
Job run updates were not configurable in the Notifications tab, and job notification emails were not sent.
Remote Repositories
In some cases, after selecting a branch or switching to a new branch in the Content Repository settings page, Cortex XSOAR could not connect to the remote repository.
Work Plan
In some cases, due to a sync error, data was not saved correctly, so the Work Plan did not display the correct task status although the War Room did.
Work Plan
When running very large playbooks that returned a substantial number of related entries, timeout issues occurred and the Work Plan did not load.
Installation file hash: 53d554cee754836b1bb7117c27830a7fa4ffd05314212de8319ea4f8e9d38120
Last updated
Was this helpful?