New Features

New features are available in Cortex XSOAR 6.12.

• Migration from Cortex XSOAR 6 to Cortex XSOAR 8 is now available for Hosted customers.

  Cortex XSOAR 8 has been designed to deliver improved performance and reliability. It is now highly scalable, based on revamped cloud-native microservice architecture. Palo Alto Networks manages performance and scaling, enabling you to focus on investigation and response.

  To start the migration, Hosted Service users need to upgrade to this version and will be contacted by Customer Service. For more information about the Migration process, see Cortex XSOAR 6 Hosted Migration.
• Cortex XSOAR now supports:

  • RHEL: 8.x, 9.x, including all minor versions
  • Opensearch: 2.6.0, 2.9.0
• You can now edit a list installed from a content pack by detaching it. Detaching a list enables you to edit and save without having to duplicate the list.
• The reputationCalcAsync argument is now available for the addEntries command. This argument enables you to disable or enable synchronous reputation calculation and can be used to avoid script timeout issues.
• The list.<listName>.separator and list.separator server configurations now support tabs as list separators, using \t.
• The following server configurations have been added for Elasticsearch:

  • application.statistics.update.disable: Disables the Return on Investment (ROI) statistics flag. Recommended to change to true if you do not need ROI as it may affect performance.
  • elasticsearch.aggregations.optimize: Enables you to search with Elasticsearch aggregations rather than searching locally in Cortex XSOAR. Default is true (search with aggregations).
  • elasticsearch.allowOwnerAggs: Gets a list of suggested owners with Elasticsearch aggregations rather than locally in Cortex XSOAR. Default is true (gets a list with aggregations).
  • elasticsearch.maxresultwindowforindex.common-incident: Limits the amount of incident results returned. Default is 10,000 documents (or maxresultwindow if defined in demisto.conf). We recommend changing it to 5000, as incidents are big documents and could affect performance.