Base

Details
Content
Dependencies
Version History

The base pack for Cortex XSOAR.

Automations

Name	Description
SaneDocReports	Parse Sane-json-reports and export them as docx files (used internally).
CommonServer	Common code that will be merged into each server script when it runs.
DBotSuggestClassifierMapping	Deprecated. No available replacement. Suggests a classifier mapping based on an advanced name matching algorithm.
DrawRelatedIncidentsCanvas	Draw incidents and indicators on the canvas to map and visualize their connections.
GetMLModelEvaluation	Finds a threshold for ML model, and performs an evaluation based on it.
DBotPreProcessTextData	Pre-process text data for the machine learning text classifier.
SanePdfReports	Parse Sane-json-reports and export them as pdf files (used internally).
DeleteIndicatorRelationships	This automation allows to delete a relationship between indicator objects based on the relationship id.
DBotBuildPhishingClassifier	Create a phishing classifier using machine learning technique, based on email content.
DBotTrainClustering	This script helps organizes and groups incidents based on their similarities using clustering algorithms. Clustering is a technique used to group data points (in this case, incidents) that are similar to each other into clusters. Used to automatically categorize a large number of incidents into meaningful groups.
GetIndicatorsByQuery	Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.
SearchIndicatorRelationships	This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
CommonServerPython	Common code that will be merged into each server script when it runs.
DBotMLFetchData	Deprecated. No available replacement. Collect telemetry data from the environment.
DBotTrainTextClassifierV2	Train a machine learning text classifier.
WordTokenizerNLP	Deprecated. Use DBotPreProcessTextData instead.
DBotFindSimilarIncidentsByIndicators	Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
StixParser	Parse STIX files to Cortex XSOAR indicators by clicking the Upload STIX File button.
DBotPredictPhishingWords	Predict text label using a pre-trained machine learning phishing model, and get the most important words used in the classification decision.
HighlightWords	Highlight words inside a given text.
ValidateContent	Runs validation and linting using the Demisto SDK on content items, such as integrations, automations and content packs. This automation script is used as part of the content validation that runs as part of the contribution flow.
DBotShowClusteringModelInfo	Show clustering model information - model summary and incidents in specific cluster.
DBotFindSimilarIncidents	Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity. Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
CheckDockerImageAvailable	Check if a docker image is available for performing docker pull. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with 'ok' if all is good otherwise will return an error.
FindSimilarIncidentsByText	Deprecated. Use DBotFindSimilarIncidents instead. Find similar incidents by text comparison - the algorithm based on TF-IDF method. To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CommonServerPowerShell	Common code that will be merged into each PowerShell script/integration when it runs.
CreateIndicatorRelationship	This automation creates a relationship between indicator objects.
GetIncidentsByQuery	Gets a list of incident objects and the associated incident outputs that match the specified query and filters. The results are returned in a structured data file. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Dashboards

Name	Description
System Health

Automations

Name	Description
SanePdfReports	Parse Sane-json-reports and export them as pdf files (used internally).
DBotBuildPhishingClassifier	Create a phishing classifier using machine learning technique, based on email content.
HighlightWords	Highlight words inside a given text.
CommonServer	Common code that will be merged into each server script when it runs.
CreateIndicatorRelationship	This automation creates a relationship between indicator objects.
ValidateContent	Runs validation and linting using the Demisto SDK on content items, such as integrations, automations and content packs. This automation script is used as part of the content validation that runs as part of the contribution flow.
DBotSuggestClassifierMapping	Deprecated. No available replacement. Suggests a classifier mapping based on an advanced name matching algorithm.
DBotMLFetchData	Deprecated. No available replacement. Collect telemetry data from the environment.
FindSimilarIncidentsByText	Deprecated. Use DBotFindSimilarIncidents instead. Find similar incidents by text comparison - the algorithm based on TF-IDF method. To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
FindSimilarAlertsByText	Deprecated. Use DBotFindSimilarAlerts instead. Find similar alerts by text comparison - the algorithm based on TF-IDF method. To read more about this method: https://en.wikipedia.org/wiki/Tf%E2%80%93idf This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
CheckDockerImageAvailable	Check if a docker image is available for performing docker pull. Script simulates the docker pull flow but doesn't actually pull the image. Returns an entry with 'ok' if all is good otherwise will return an error.
DBotFindSimilarIncidentsByIndicators	Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
DBotFindSimilarAlertsByIndicators	Finds similar alerts based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.
WordTokenizerNLP	Deprecated. Use DBotPreProcessTextData instead.
CommonServerPython	Common code that will be merged into each server script when it runs.
DBotPreProcessTextData	Pre-process text data for the machine learning text classifier.
StixParser	Parse STIX files to Cortex indicators by clicking the Upload STIX File button.
GetIndicatorsByQuery	Gets a list of indicator objects and the associated indicator outputs that match the specified query and filters. The results are returned in a structured data file.
CommonServerPowerShell	Common code that will be merged into each PowerShell script/integration when it runs.
SaneDocReports	Parse Sane-json-reports and export them as docx files (used internally).
GetIncidentsByQuery	Gets a list of incident objects and the associated incident outputs that match the specified query and filters. The results are returned in a structured data file. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
GetAlertsByQuery	Gets a list of alert objects and the associated alert outputs that match the specified query and filters. The results are returned in a structured data file. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
DBotTrainClustering	This script helps organizes and groups incidents based on their similarities using clustering algorithms. Clustering is a technique used to group data points (in this case, incidents) that are similar to each other into clusters. Used to automatically categorize a large number of incidents into meaningful groups.
SearchIndicatorRelationships	This automation outputs the indicator relationships to context according to the provided query, using the entities, entityTypes, and relationships arguments. All arguments will use the AND operator. For example, using the following arguments entities=8.8.8.8 entities_types=Domain will provide only relationships that the 8.8.8.8 indicator has with indicators of type domain.
GetMLModelEvaluation	Finds a threshold for ML model, and performs an evaluation based on it.
DBotFindSimilarIncidents	Finds past similar incidents based on incident fields' similarity. Includes an option to also display indicators similarity. Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
DBotFindSimilarAlerts	Finds past similar alerts based on alert fields' similarity. Includes an option to also display indicators similarity. Note: For the similarity calculation, at least one field must be provided in one of the "similarTextField", "similarCategoricalField", or "similarJsonField" arguments.
DeleteIndicatorRelationships	This automation allows to delete a relationship between indicator objects based on the relationship id.

1.42.17 - 11856720 (August 12, 2026)

Documentation and metadata improvements.

Related pull requests:
- 45357
- 45369

Download

1.42.16 - 11803561 (August 10, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45412

Download

1.42.15 - 11600876 (August 3, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45334

Download

1.42.14 - 11444670 (July 29, 2026)

Scripts

DBotFindSimilarIncidents

Fixed an issue where the generated similar incident hyperlinks used the legacy hash-based format (#/Details/ID), which redirected to the dashboard on Cortex XSOAR 8.x. Links now use the correct format for each version.

Related pull requests:
- 45259

Download

1.42.13 - 11340468 (July 26, 2026)

Scripts

GetMLModelEvaluation

Updated the Docker image to: demisto/ml:1.0.0.9793547.

DBotPredictPhishingWords

Updated the Docker image to: demisto/ml:1.0.0.9793547.

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 44722

Download

1.42.12 - 11291149 (July 24, 2026)

Base

Documentation and metadata improvements.

Scripts

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 45213

Download

1.42.10 - 11275253 (July 23, 2026)

Scripts

DrawRelatedIncidentsCanvas

Updated the Docker image to: demisto/sklearn:1.0.0.10866354.

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.10866354.

DBotFindSimilarIncidentsByIndicators

Updated the Docker image to: demisto/sklearn:1.0.0.10866354.

FindSimilarIncidentsByText

Updated the Docker image to: demisto/sklearn:1.0.0.10866354.

Related pull requests:
- 45112

Download

1.42.9 - 11158821 (July 19, 2026)

Scripts

CheckDockerImageAvailable

Updated the Docker image to: demisto/python3:3.12.13.10404775.

Related pull requests:
- 45062

Download

1.42.8 - 11088954 (July 16, 2026)

Scripts

CommonServerPython

Fixed an issue where integrations would fail to connect on some environments due to a retry configuration error.

Related pull requests:
- 45035

Download

1.42.7 - 10962791 (July 12, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 45007

Download

1.42.6 - 10935523 (July 12, 2026)

Scripts

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.10404775.

DBotTrainTextClassifierV2

Updated the Docker image to: demisto/ml:1.0.0.9793547.

DrawRelatedIncidentsCanvas

Updated the Docker image to: demisto/sklearn:1.0.0.10120494.

DeleteIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.10404775.

CreateIndicatorRelationship

Updated the Docker image to: demisto/python3:3.12.13.10404775.

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.10120494.

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10404775.

DBotBuildPhishingClassifier

Updated the Docker image to: demisto/python3:3.12.13.10404775.

DBotShowClusteringModelInfo

Updated the Docker image to: demisto/python3:3.12.13.10404775.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.13.10404775.

Related pull requests:
- 45017

Download

1.42.5 - 10906419 (July 10, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44915

Download

1.42.4 - 10828903 (July 7, 2026)

Scripts

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.10737051.

Related pull requests:
- 44965
- 44973

Download

1.42.3 - 10750492 (July 5, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44960

Download

1.42.2 - 10744796 (July 5, 2026)

Scripts

CommonServerPython

Added standardized error classification and taxonomy (CortexError hierarchy and CortexErrorCode) for machine-readable error codes.

Related pull requests:
- 44472
- 44469
- 44470
- 44372
- 44306
- 44461
- 44428
- 44475
- 43340
- 44387
- 44362
- 44484
- 44480
- 44432
- 44315
- 44451
- 44420
- 44464
- 44492
- 44488
- 44485
- 44490
- 44498
- 44479
- 44458
- 44364
- 44345
- 44132
- 44474
- 44481
- 44518
- 44510
- 44130
- 44515
- 44503
- 44483
- 44522
- 44386

Download

1.42.1 - 10610743 (June 30, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44448

Download

1.42.0 - 10480202 (June 25, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44377

Download

1.41.99 - 10456373 (June 25, 2026)

Scripts

DBotFindSimilarIncidents

Fixed an issue where the script failed with a TypeError when processing historical alerts that contained numeric field values (such as port lists) in the commandline field.

Related pull requests:
- 44836

Download

1.41.98 - 10442616 (June 24, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44831

Download

1.41.97 - 10424072 (June 24, 2026)

Scripts

CommonServerPython

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).

CommonServerPowerShell

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).
Updated the Docker image to: demisto/powershell:7.5.0.9017890.

CommonServer

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).

Related pull requests:
- 44788

Download

1.41.96 - 10395148 (June 23, 2026)

Dashboards

System Health

Documentation and metadata improvements.

Related pull requests:
- 44797

Download

1.41.95 - 10352549 (June 21, 2026)

Scripts

CommonServerPython

Internal code improvements.

Related pull requests:
- 44771

Download

1.41.94 - 10281058 (June 18, 2026)

Scripts

StixParser

Updated the Docker image to: demisto/taxii:1.0.0.10133006.

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.9988134.

DBotPreProcessTextData

Updated the Docker image to: demisto/ml:1.0.0.9793547.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.13.10116658.

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.10116658.

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 44716

Download

1.41.93 - 10264963 (June 17, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44704

Download

1.41.92 - 10126628 (June 14, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44514

Download

1.41.91 - 9852988 (June 4, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 44386

Download

1.41.90 - 9839730 (June 3, 2026)

Scripts

CommonServerPython

Added the resolve_should_push_events utility function for graceful handling of the should_push_events flag on non-XSIAM platforms.

Related pull requests:
- 44483

Download

1.41.89 - 9761505 (June 2, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44492

Download

1.41.88 - 9705440 (June 1, 2026)

Base

Documentation and metadata improvements.

Scripts

CommonServerPython

Documentation and metadata improvements.

DBotTrainClustering

Documentation and metadata improvements.
Updated the Docker image to: demisto/mlclustering:1.0.0.9062583.

Related pull requests:
- 44428

Download

1.41.86 - 9383878 (May 26, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44332

Download

1.41.85 - 9153993 (May 19, 2026)

Scripts

CheckDockerImageAvailable

Updated the Docker image to: demisto/python3:3.12.13.9059085.

Related pull requests:
- 44156

Download

1.41.84 - 9008008 (May 14, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44301

Download

1.41.83 - 8994397 (May 13, 2026)

Scripts

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.13.8428455.

DBotBuildPhishingClassifier

Updated the Docker image to: demisto/python3:3.12.13.8428455.

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.13.8428455.

DeleteIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.8428455.

CreateIndicatorRelationship

Updated the Docker image to: demisto/python3:3.12.13.8428455.

DBotShowClusteringModelInfo

Updated the Docker image to: demisto/python3:3.12.13.8428455.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.13.8428455.

Related pull requests:
- 44128

Download

1.41.82 - 8937460 (May 12, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44253

Download

1.41.81 - 8865647 (May 10, 2026)

Scripts

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.8425368.

DBotFindSimilarIncidentsByIndicators

Updated the Docker image to: demisto/sklearn:1.0.0.8425368.

Related pull requests:
- 44109

Download

1.41.80 - 8801294 (May 6, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44205

Download

1.41.78 - 8687052 (May 3, 2026)

Scripts

CommonServerPython

Updated the documentation and metadata.
Maintenance and stability improvements.

Related pull requests:
- 44158

Download

1.41.77 - 8624674 (April 30, 2026)

Scripts

CommonServerPython

Updated the documentation and metadata.
Maintenance and stability improvements.

StixParser

Updated the documentation and metadata.
Maintenance and stability improvements.
Updated the Docker image to: demisto/taxii:1.0.0.8240011.

Related pull requests:
- 43930

Download

1.41.76 - 8564799 (April 29, 2026)

Scripts

ValidateContent

Updated the ValidateContent script to ignore BA106 validation.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.8457987.

Related pull requests:
- 43951

Download

1.41.75 - 8436624 (April 24, 2026)

Scripts

CommonServerPython

Updated the CommonServerPython script to support unified connectors (UCP).

CommonServer

Updated the CommonServer script to support unified connectors (UCP).

Related pull requests:
- 43930
- 43626

Download

1.41.74 - 8382811 (April 20, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

1.41.73 - 8368185 (April 20, 2026)

Scripts

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.8356897.

Related pull requests:
- 43945

Download

1.41.72 - 8315166 (April 16, 2026)

Scripts

CommonServerPython

Fixed an issue in the create_updated_last_run_object function where the fetch limit was incorrectly reset after encountering only duplicate incidents. Causing the system to miss future incidents when lookback was enabled.

Related pull requests:
- 43746

Download

1.41.71 - 8195766 (April 12, 2026)

Scripts

CommonServerPython

Fixed an issue in the tableToMarkdown function where passing a single-key dictionary with an empty list value and no explicit headers caused an IndexError: list index out of range.

Related pull requests:
- 43751

Download

1.41.70 - 7889240 (March 25, 2026)

Scripts

CommonServerPython

Updated the is_xsiam() function to support unified platform module codes (x1, x3, x5).

Related pull requests:
- 43591
- 43045
- 43242
- 42931
- 43447
- 43460
- 43536
- 43395
- 43429
- 42713
- 43384
- 43391
- 43477
- 43527
- 43445
- 43500
- 43495
- 42723
- 43412
- 43038
- 43498
- 43548
- 43544
- 43369
- 43542
- 43491
- 43492
- 43336
- 43481
- 43505
- 43577
- 43497
- 43530
- 43575
- 43373
- 43397
- 43573
- 43453

Download

1.41.69 - 7867350 (March 24, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 43408

Download

1.41.68 - 7576188 (March 11, 2026)

Scripts

CommonServerPython

Improve compatibility with new style of integrations established in Hello World V2.

Related pull requests:
- 42692

Download

1.41.67 - 7533454 (March 9, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43414

Download

1.41.66 - 7489104 (March 8, 2026)

Scripts

ValidateContent

Fixed an issue with the handling of proxy configuration.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.6671630.

Related pull requests:
- 43256

Download

1.41.65 - 7389211 (March 1, 2026)

Scripts

ValidateContent

Migrate from pkg_resources to importlib in ValidateContent script.

Related pull requests:
- 43033

Download

1.41.64 - 7309700 (February 24, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43262

Download

1.41.63 - R7266890 (February 22, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 43123

Download

1.41.62 - 7188558 (February 17, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43146

Download

1.41.61 - 7175321 (February 16, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42865

Download

1.41.60 - 7083702 (February 9, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 42961

Download

1.41.59 - 7001339 (February 3, 2026)

Scripts

CommonServerPython

Updated the get_integration_context function to include context structure validation.

Related pull requests:
- 42394

Download

1.41.58 - 6936977 (January 29, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42378
- 42230
- 42815
- 42788
- 42807
- 42808
- 42818
- 42812
- 42821
- 41995
- 42151
- 42798

Download

1.41.57 - 6927470 (January 29, 2026)

Scripts

CommonServerPython

Modified the send_events_to_xsiam and send_data_to_xsiam functions to support the ContentClient class.

Related pull requests:
- 42121

Download

1.41.56 - 6920594 (January 28, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42439

Download

1.41.55 - 6823328 (January 21, 2026)

Scripts

DBotTrainTextClassifierV2

Updated the Docker image to: demisto/ml:1.0.0.6144857.

DBotPredictPhishingWords

Updated the Docker image to: demisto/ml:1.0.0.6144857.

GetMLModelEvaluation

Updated the Docker image to: demisto/ml:1.0.0.6144857.

DBotPreProcessTextData

Updated the Docker image to: demisto/ml:1.0.0.6144857.

Related pull requests:
- 42750

Download

1.41.54 - 6802612 (January 20, 2026)

Scripts

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.12.6663663.

Related pull requests:
- 42720

Download

1.41.53 - 6580350 (January 6, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

1.41.52 - 6436886 (December 25, 2025)

Scripts

SearchIndicatorRelationships

Added support for searchAfter argument that use the SearchAfter token from the preceding response (found in the RelationshipsPagination output path) to indicate the starting point for retrieving the subsequent batch of relationships.
Added the output RelationshipsPagination which contains the searchAfter token that allows pagination.
Updated the Docker image to: demisto/python3:3.12.12.6391686.

Related pull requests:
- 42206

Download

1.41.51 - 6238358 (December 11, 2025)

Scripts

DBotBuildPhishingClassifier

Updated the Docker image to: demisto/python3:3.12.12.6204436.

CreateIndicatorRelationship

Updated the Docker image to: demisto/python3:3.12.12.6204436.

DeleteIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.12.6204436.

Related pull requests:
- 42247

Download

1.41.50 - R6221975 (December 10, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42149

Download

1.41.49 - 6204767 (December 9, 2025)

Scripts

StixParser

Fixed an issue where the tags field was not extracted for all indicator types when uploading STIX files via the UI.

Related pull requests:
- 42202

Download

1.41.48 - 6187133 (December 8, 2025)

Scripts

CommonServerPython

Updated the Docker image to: demisto/python:2.7.18.6174823.

Related pull requests:
- 42186

Download

1.41.47 - 6112909 (December 3, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 42076

Download

1.41.46 - 6088397 (December 1, 2025)

Scripts

DBotShowClusteringModelInfo

Documentation and metadata improvements.
Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 42096

Download

1.41.45 - 6062719 (November 30, 2025)

Scripts

ValidateContent

Improved the ValidateContent script to enhance the content validation process.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.6023010.

Related pull requests:
- 42056

Download

1.41.44 - 6046045 (November 27, 2025)

Scripts

CommonServerPython

Limited the size of the indicator context to prevent performance issues with large datasets.

Related pull requests:
- 41934

Download

1.41.43 - 6030142 (November 26, 2025)

Scripts

CommonServerPython

Fixed an issue where the tableToMarkdown function would not correctly display a dictionary that contained a single key with a dictionary as its value.

Related pull requests:
- 42013

Download

1.41.42 - 6012287 (November 25, 2025)

Scripts

CommonServerPython

Updated the CommonServerPython script with a time-sensitive command timeout strategy in BaseClient. This strategy enforces a strict execution time limit (default 15 seconds) for commands when the indicator extraction mode is inline by dynamically adjusting API timeouts and disabling retries. For more information, see the indicator extraction modes documentation.

Related pull requests:
- 41930

Download

1.41.41 - 5940029 (November 20, 2025)

Scripts

ValidateContent

Updated the Docker image to: demisto/xsoar-tools:1.0.0.5493431.

DBotFindSimilarIncidentsByIndicators

Updated the Docker image to: demisto/sklearn:1.0.0.5898415.

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.5898415.

Related pull requests:
- 41956

Download

1.41.40 - 5917085 (November 18, 2025)

Scripts

StixParser

Fixed an issue where the MitreID field was not preserved when parsing STIX attack patterns.
Updated the Docker image to: demisto/taxii:1.0.0.5187594.

Related pull requests:
- 41898
- 41917
- 41927
- 41917

Download

1.41.39 - 5888286 (November 16, 2025)

Documentation and metadata improvements.

Related pull requests:
- 41659

Download

1.41.38 - R5879558 (November 16, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41805

Download

1.41.37 - 5801457 (November 10, 2025)

Scripts

CommonServerPython

Added a randomized backoff (jitter) for connection retries in the CommonServerPython base client to improve system resilience.

Related pull requests:
- 41857
- 41807
- 41869

Download

1.41.35 - R5785253 (November 9, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41838
- 41766
- 41804
- 41275

Download

1.41.34 - 5717993 (November 3, 2025)

Scripts

CheckDockerImageAvailable

Updated the Docker image to: demisto/python3:3.12.12.5490952.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.12.5490952.

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.12.5490952.

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.12.5490952.

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 41760

Download

1.41.33 - 5698874 (November 2, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41748

Download

1.41.32 - 5610417 (October 28, 2025)

Scripts

CommonServerPowerShell

Updated the Docker image to: demisto/powershell:7.5.0.3759715.

Related pull requests:
- 41360

Download

1.41.31 - 5538136 (October 23, 2025)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

1.41.30 - R5499225 (October 21, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41557

Download

1.41.29 - 5392573 (October 15, 2025)

Scripts

CommonServerPython

Add a custom JSONEncoder class that converts datetime objects to ISO 8601 strings.

Related pull requests:
- 41517

Download

1.41.28 - 5320194 (October 9, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41449

Download

1.41.27 - 5281566 (October 5, 2025)

Scripts

CommonServerPython

Fixed an issue with the timestamp parsing logic to prevent errors when microsecond components are missing.

Related pull requests:
- 41384

Download

1.41.26 - 5208238 (September 30, 2025)

Base

Documentation and metadata improvements.

Scripts

CommonServerPython

Updated the CommonServerPython script to support the A++ reliability level.

Related pull requests:
- 41444

Download

1.41.24 - 5080075 (September 25, 2025)

Scripts

CommonServerPython

Fixed an issue where duplicate events were fetched.

Related pull requests:
- 41216

Download

1.41.23 - 5007705 (September 21, 2025)

Changes are not relevant for XSOAR marketplace.

Download

1.41.22 - 4796908 (September 7, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41196

Download

1.41.21 - 4677309 (August 27, 2025)

Scripts

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.4666041.

Related pull requests:
- 41085

Download

1.41.20 - 4669908 (August 27, 2025)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41087

Download

1.41.19 - 4653163 (August 26, 2025)

Scripts

CommonServerPython

Rename the is_ip_internal function to is_ip_address_internal.

Related pull requests:
- 41055

Download

1.41.18 - 4647015 (August 25, 2025)

Scripts

CommonServerPython

Added the is_ip_internal function to check if an IP address is internal.

Related pull requests:
- 41013

Download

1.41.17 - 4583601 (August 20, 2025)

Scripts

CommonServer

Added Informational and Critical values to the scoreToReputation function.

Related pull requests:
- 40720

Download

1.41.16 - 4568132 (August 18, 2025)

Scripts

CommonServerPython

Documentation and metadata improvements.

Related pull requests:
- 40978

Download

1.41.15 - 4555709 (August 17, 2025)

Scripts

CommonServerPython

Enhanced the argToBoolean function to support additional boolean string values ('y', 'yes', 't', 'true', 'on', '1' for true; 'n', 'no', 'f', 'false', 'off', '0' for false) to replace the deprecated distutils.util.strtobool function and ensure Python 3.12 compatibility.

Related pull requests:
- 40759

Download

1.41.14 - 4498927 (August 12, 2025)

Scripts

CommonServerPython

Added a context manager for limiting code execution time. This helps prevent commands from being abruptly ended by the server.

Related pull requests:
- 40862

Download

1.42.17 - 11856720 (August 12, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 45357
- 45369

Download

1.42.16 - 11803561 (August 10, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45412

Download

1.42.15 - 11621516 (August 4, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 45334

Download

1.42.14 - 11444670 (July 29, 2026)

Scripts

DBotFindSimilarIncidents

Fixed an issue where the generated similar incident hyperlinks used the legacy hash-based format (#/Details/ID), which redirected to the dashboard on Cortex XSOAR 8.x. Links now use the correct format for each version.

Related pull requests:
- 45259

Download

1.42.13 - 11340468 (July 26, 2026)

Scripts

GetMLModelEvaluation

Updated the Docker image to: demisto/ml:1.0.0.9793547.

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 44722

Download

1.42.12 - 11291149 (July 24, 2026)

Base

Documentation and metadata improvements.

Scripts

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 45213

Download

1.42.10 - 11275253 (July 23, 2026)

Scripts

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.10866354.

DBotFindSimilarIncidentsByIndicators

Updated the Docker image to: demisto/sklearn:1.0.0.10866354.

FindSimilarIncidentsByText

Updated the Docker image to: demisto/sklearn:1.0.0.10866354.

Related pull requests:
- 45112

Download

1.42.9 - 11158821 (July 19, 2026)

Scripts

CheckDockerImageAvailable

Updated the Docker image to: demisto/python3:3.12.13.10404775.

Related pull requests:
- 45062

Download

1.42.8 - 11088954 (July 16, 2026)

Scripts

CommonServerPython

Fixed an issue where integrations would fail to connect on some environments due to a retry configuration error.

Related pull requests:
- 45035

Download

1.42.7 - 10962791 (July 12, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 45007

Download

1.42.6 - 10935523 (July 12, 2026)

Scripts

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.10404775.

DeleteIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.10404775.

CreateIndicatorRelationship

Updated the Docker image to: demisto/python3:3.12.13.10404775.

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.10120494.

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10404775.

DBotBuildPhishingClassifier

Updated the Docker image to: demisto/python3:3.12.13.10404775.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.13.10404775.

Related pull requests:
- 45017

Download

1.42.5 - 10906419 (July 10, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44915

Download

1.42.4 - 10828903 (July 7, 2026)

Scripts

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.10737051.

Related pull requests:
- 44965
- 44973

Download

1.42.3 - 10750492 (July 5, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44960

Download

1.42.2 - 10744796 (July 5, 2026)

Scripts

CommonServerPython

Added standardized error classification and taxonomy (CortexError hierarchy and CortexErrorCode) for machine-readable error codes.

1.42.1 - 10610743 (June 30, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44448

Download

1.42.0 - 10480202 (June 25, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44377

Download

1.41.99 - 10456373 (June 25, 2026)

Scripts

DBotFindSimilarIncidents

Fixed an issue where the script failed with a TypeError when processing historical alerts that contained numeric field values (such as port lists) in the commandline field.

Related pull requests:
- 44836

Download

1.41.98 - 10442616 (June 24, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44831

Download

1.41.97 - 10424072 (June 24, 2026)

Scripts

CommonServerPython

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).

CommonServerPowerShell

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).
Updated the Docker image to: demisto/powershell:7.5.0.9017890.

CommonServer

Added Unified Connector (UCP) parameter interpolation: connector field values are now reshaped into the parameter structure integrations expect (for example, folding username and password into a single credentials object).

Related pull requests:
- 44788

Download

1.41.96 - 10395148 (June 23, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44797

Download

1.41.95 - 10352549 (June 21, 2026)

Scripts

CommonServerPython

Internal code improvements.

Related pull requests:
- 44771

Download

1.41.94 - 10281058 (June 18, 2026)

Scripts

StixParser

Updated the Docker image to: demisto/taxii:1.0.0.10133006.

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.9988134.

DBotPreProcessTextData

Updated the Docker image to: demisto/ml:1.0.0.9793547.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.13.10116658.

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.10116658.

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.13.10116658.

Related pull requests:
- 44716

Download

1.41.93 - 10264963 (June 17, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44704

Download

1.41.92 - 10126628 (June 14, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44514

Download

1.41.91 - 9852988 (June 4, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 44386

Download

1.41.90 - 9839730 (June 3, 2026)

Scripts

CommonServerPython

Added the resolve_should_push_events utility function for graceful handling of the should_push_events flag on non-XSIAM platforms.

Related pull requests:
- 44483

Download

1.41.89 - 9761505 (June 2, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44492

Download

1.41.88 - 9705440 (June 1, 2026)

Base

Documentation and metadata improvements.

Scripts

CommonServerPython

Documentation and metadata improvements.

DBotTrainClustering

Documentation and metadata improvements.
Updated the Docker image to: demisto/mlclustering:1.0.0.9062583.

Related pull requests:
- 44428

Download

1.41.86 - 9383878 (May 26, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44332

Download

1.41.85 - 9153993 (May 19, 2026)

Scripts

CheckDockerImageAvailable

Updated the Docker image to: demisto/python3:3.12.13.9059085.

Related pull requests:
- 44156

Download

1.41.84 - 9008008 (May 14, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 44301

Download

1.41.83 - 8994397 (May 13, 2026)

Scripts

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.13.8428455.

DBotBuildPhishingClassifier

Updated the Docker image to: demisto/python3:3.12.13.8428455.

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.13.8428455.

DeleteIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.13.8428455.

CreateIndicatorRelationship

Updated the Docker image to: demisto/python3:3.12.13.8428455.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.13.8428455.

Related pull requests:
- 44128

Download

1.41.82 - 8937460 (May 12, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44253

Download

1.41.81 - 8865647 (May 10, 2026)

Scripts

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.8425368.

DBotFindSimilarIncidentsByIndicators

Updated the Docker image to: demisto/sklearn:1.0.0.8425368.

Related pull requests:
- 44109

Download

1.41.80 - 8801294 (May 6, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 44205

Download

1.41.78 - 8687052 (May 3, 2026)

Scripts

CommonServerPython

Updated the documentation and metadata.
Maintenance and stability improvements.

Related pull requests:
- 44158

Download

1.41.77 - 8624674 (April 30, 2026)

Scripts

CommonServerPython

Updated the documentation and metadata.
Maintenance and stability improvements.

StixParser

Updated the documentation and metadata.
Maintenance and stability improvements.
Updated the Docker image to: demisto/taxii:1.0.0.8240011.

Related pull requests:
- 43930

Download

1.41.76 - 8564799 (April 29, 2026)

Scripts

ValidateContent

Updated the ValidateContent script to ignore BA106 validation.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.8457987.

Related pull requests:
- 43951

Download

1.41.75 - 8436624 (April 24, 2026)

Scripts

CommonServerPython

Updated the CommonServerPython script to support unified connectors (UCP).

CommonServer

Updated the CommonServer script to support unified connectors (UCP).

Related pull requests:
- 43626
- 43930

Download

1.41.74 - 8382811 (April 20, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43976

Download

1.41.73 - 8368185 (April 20, 2026)

Scripts

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.8356897.

Related pull requests:
- 43945

Download

1.41.72 - 8315166 (April 16, 2026)

Scripts

CommonServerPython

Related pull requests:
- 43746

Download

1.41.71 - 8195766 (April 12, 2026)

Scripts

CommonServerPython

Fixed an issue in the tableToMarkdown function where passing a single-key dictionary with an empty list value and no explicit headers caused an IndexError: list index out of range.

Related pull requests:
- 43751

Download

1.41.70 - 7889240 (March 25, 2026)

Scripts

CommonServerPython

Updated the is_xsiam() function to support unified platform module codes (x1, x3, x5).

1.41.69 - 7867350 (March 24, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 43408

Download

1.41.68 - 7576188 (March 11, 2026)

Scripts

CommonServerPython

Improve compatibility with new style of integrations established in Hello World V2.

Related pull requests:
- 42692

Download

1.41.67 - 7502515 (March 9, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43414

Download

1.41.66 - 7489104 (March 8, 2026)

Scripts

ValidateContent

Fixed an issue with the handling of proxy configuration.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.6671630.

Related pull requests:
- 43256

Download

1.41.65 - 7389211 (March 1, 2026)

Scripts

ValidateContent

Migrate from pkg_resources to importlib in ValidateContent script.

Related pull requests:
- 43033

Download

1.41.64 - 7309700 (February 24, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43262

Download

1.41.63 - R7266890 (February 22, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 43123

Download

1.41.62 - 7188558 (February 17, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 43146

Download

1.41.61 - 7178553 (February 16, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42865

Download

1.41.60 - 7083702 (February 9, 2026)

Base

Documentation and metadata improvements.

Related pull requests:
- 42961

Download

1.41.59 - 7001339 (February 3, 2026)

Scripts

CommonServerPython

Updated the get_integration_context function to include context structure validation.

Related pull requests:
- 42394

Download

1.41.58 - 6936977 (January 29, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42378
- 42230
- 42815
- 42788
- 42807
- 42808
- 42818
- 42812
- 42821
- 41995
- 42151
- 42798

Download

1.41.57 - 6927470 (January 29, 2026)

Scripts

CommonServerPython

Modified the send_events_to_xsiam and send_data_to_xsiam functions to support the ContentClient class.

Related pull requests:
- 42121

Download

1.41.56 - 6920581 (January 28, 2026)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42439

Download

1.41.55 - 6823328 (January 21, 2026)

Scripts

GetMLModelEvaluation

Updated the Docker image to: demisto/ml:1.0.0.6144857.

DBotPreProcessTextData

Updated the Docker image to: demisto/ml:1.0.0.6144857.

Related pull requests:
- 42750

Download

1.41.54 - 6802612 (January 20, 2026)

Scripts

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.12.6663663.

Related pull requests:
- 42720

Download

1.41.53 - 6580350 (January 6, 2026)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 42564

Download

1.41.52 - 6436886 (December 25, 2025)

Scripts

SearchIndicatorRelationships

Added support for searchAfter argument that use the SearchAfter token from the preceding response (found in the RelationshipsPagination output path) to indicate the starting point for retrieving the subsequent batch of relationships.
Added the output RelationshipsPagination which contains the searchAfter token that allows pagination.
Updated the Docker image to: demisto/python3:3.12.12.6391686.

Related pull requests:
- 42206

Download

1.41.51 - 6238358 (December 11, 2025)

Scripts

DBotBuildPhishingClassifier

Updated the Docker image to: demisto/python3:3.12.12.6204436.

CreateIndicatorRelationship

Updated the Docker image to: demisto/python3:3.12.12.6204436.

DeleteIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.12.6204436.

Related pull requests:
- 42247

Download

1.41.50 - 6216498 (December 10, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42149

Download

1.41.49 - 6204767 (December 9, 2025)

Scripts

StixParser

Fixed an issue where the tags field was not extracted for all indicator types when uploading STIX files via the UI.

Related pull requests:
- 42202

Download

1.41.48 - 6187133 (December 8, 2025)

Scripts

CommonServerPython

Updated the Docker image to: demisto/python:2.7.18.6174823.

Related pull requests:
- 42186

Download

1.41.47 - 6112909 (December 3, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42076

Download

1.41.46 - 6088397 (December 1, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 42096

Download

1.41.45 - 6062719 (November 30, 2025)

Scripts

ValidateContent

Improved the ValidateContent script to enhance the content validation process.
Updated the Docker image to: demisto/xsoar-tools:1.0.0.6023010.

Related pull requests:
- 42056

Download

1.41.44 - 6046045 (November 27, 2025)

Scripts

CommonServerPython

Limited the size of the indicator context to prevent performance issues with large datasets.

Related pull requests:
- 41934

Download

1.41.43 - 6030142 (November 26, 2025)

Scripts

CommonServerPython

Fixed an issue where the tableToMarkdown function would not correctly display a dictionary that contained a single key with a dictionary as its value.

Related pull requests:
- 42013

Download

1.41.42 - 6012287 (November 25, 2025)

Scripts

CommonServerPython

Updated the CommonServerPython script with a time-sensitive command timeout strategy in BaseClient. This strategy enforces a strict execution time limit (default 15 seconds) for commands when the indicator extraction mode is inline by dynamically adjusting API timeouts and disabling retries. For more information, see the indicator extraction modes documentation.

Related pull requests:
- 41930

Download

1.41.41 - 5940029 (November 20, 2025)

Scripts

ValidateContent

Updated the Docker image to: demisto/xsoar-tools:1.0.0.5493431.

DBotFindSimilarIncidentsByIndicators

Updated the Docker image to: demisto/sklearn:1.0.0.5898415.

DBotFindSimilarIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.5898415.

Related pull requests:
- 41956

Download

1.41.40 - 5917085 (November 18, 2025)

Scripts

StixParser

Fixed an issue where the MitreID field was not preserved when parsing STIX attack patterns.
Updated the Docker image to: demisto/taxii:1.0.0.5187594.

Related pull requests:
- 41898
- 41917
- 41927
- 41917

Download

1.41.39 - 5888286 (November 16, 2025)

Documentation and metadata improvements.

Related pull requests:
- 41659

Download

1.41.38 - R5879558 (November 16, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41805

Download

1.41.37 - 5801457 (November 10, 2025)

Scripts

CommonServerPython

Added a randomized backoff (jitter) for connection retries in the CommonServerPython base client to improve system resilience.

Related pull requests:
- 41869
- 41807
- 41857

Download

1.41.35 - R5785253 (November 9, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41804
- 41766
- 41275
- 41838

Download

1.41.34 - 5717993 (November 3, 2025)

Scripts

CheckDockerImageAvailable

Updated the Docker image to: demisto/python3:3.12.12.5490952.

HighlightWords

Updated the Docker image to: demisto/python3:3.12.12.5490952.

GetIncidentsByQuery

Updated the Docker image to: demisto/python3:3.12.12.5490952.

GetIndicatorsByQuery

Updated the Docker image to: demisto/python3:3.12.12.5490952.

SearchIndicatorRelationships

Updated the Docker image to: demisto/python3:3.12.12.5490952.

Related pull requests:
- 41760

Download

1.41.33 - 5698874 (November 2, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41748

Download

1.41.32 - 5610417 (October 28, 2025)

Scripts

CommonServerPowerShell

Updated the Docker image to: demisto/powershell:7.5.0.3759715.

Related pull requests:
- 41360

Download

1.41.31 - 5538136 (October 23, 2025)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41627

Download

1.41.30 - 5423932 (October 17, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41557

Download

1.41.29 - 5392573 (October 15, 2025)

Scripts

CommonServerPython

Add a custom JSONEncoder class that converts datetime objects to ISO 8601 strings.

Related pull requests:
- 41517

Download

1.41.28 - 5320194 (October 9, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41449

Download

1.41.27 - 5281566 (October 5, 2025)

Scripts

CommonServerPython

Fixed an issue with the timestamp parsing logic to prevent errors when microsecond components are missing.

Related pull requests:
- 41384

Download

1.41.26 - 5212533 (October 1, 2025)

Base

Documentation and metadata improvements.

Scripts

CommonServerPython

Updated the CommonServerPython script to support the A++ reliability level.

Related pull requests:
- 41444

Download

1.41.24 - 5080075 (September 25, 2025)

Scripts

CommonServerPython

Fixed an issue where duplicate events were fetched.

Related pull requests:
- 41216

Download

1.41.23 - 5007705 (September 21, 2025)

Changes are not relevant for XSIAM marketplace.

Download

1.41.22 - 4796908 (September 7, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41196

Download

1.41.21 - 4677309 (August 27, 2025)

Scripts

SanePdfReports

Updated the Docker image to: demisto/sane-pdf-reports:1.0.0.4666041.

Related pull requests:
- 41085

Download

1.41.20 - 4669908 (August 27, 2025)

Base

Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.

Related pull requests:
- 41087

Download

1.41.19 - 4653163 (August 26, 2025)

Scripts

CommonServerPython

Rename the is_ip_internal function to is_ip_address_internal.

Related pull requests:
- 41055

Download

1.41.18 - 4647015 (August 25, 2025)

Scripts

CommonServerPython

Added the is_ip_internal function to check if an IP address is internal.

Related pull requests:
- 41013

Download

1.41.17 - 4583601 (August 20, 2025)

Scripts

CommonServer

Added Informational and Critical values to the scoreToReputation function.

Related pull requests:
- 40720

Download

1.41.16 - 4568132 (August 18, 2025)

Scripts

CommonServerPython

Documentation and metadata improvements.

Related pull requests:
- 40978

Download

1.41.15 - 4555709 (August 17, 2025)

Scripts

CommonServerPython

Related pull requests:
- 40759

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	August 2, 2020
Last Release	August 12, 2026

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.