Integrations

Doppel

• Added the last_activity_timestamp and page_size arguments to the doppel-get-alerts command, enabling retrieval of alerts filtered by their last activity time.
• Added reopen support for revived alerts. When Doppel moves an alert back into an active queue (for example, a taken-down domain that comes back online), incoming mirroring now reopens the corresponding closed incident instead of silently updating its fields.
• Added the x-doppel-client attribution header to every Doppel API request. The header identifies the integration and pack version for usage attribution on Doppel's side and does not affect request handling.

Classifiers

Doppel_Incident_Classifier

• Updated the Doppel_Incident_Classifier classifier to classify Doppel telco alerts into the Doppel Alert Telco incident type.

Incident Fields

• Doppel Product

• Updated the Doppel Product incident field to support the Doppel Alert Telco incident type and to include the telco and darkweb select values.

• Doppel Entity Content Social Media

• Added a new incident field Doppel Entity Content Social Media that displays the entity content of Doppel social media alerts in a grid.

• Doppel Entity

• Updated the Doppel Entity incident field to support the Doppel Alert Telco incident type.

• Doppel Entity Content Ecommerce

• Added a new incident field Doppel Entity Content Ecommerce that displays the entity content of Doppel ecommerce alerts in a grid.

• Doppel Notes

• Updated the Doppel Notes incident field to support the Doppel Alert Telco incident type.

• Doppel Link

• Updated the Doppel Link incident field to support the Doppel Alert Telco incident type.

• Doppel Platform

• Updated the Doppel Platform incident field to support the Doppel Alert Telco incident type.

• Doppel Entity Content Telco

• Added a new incident field Doppel Entity Content Telco that displays the entity content of Doppel telco alerts in a grid.

• Doppel Entity Content Mobile Apps

• Added a new incident field Doppel Entity Content Mobile Apps that displays the entity content of Doppel mobile app alerts in a grid.

• Doppel Audit Logs

• Added a new incident field Doppel Audit Logs that displays the audit log history of the Doppel alert in a grid.

• Doppel Uploaded By

• Updated the Doppel Uploaded By incident field to support the Doppel Alert Telco incident type.

• Doppel Queue State

• Updated the Doppel Queue State incident field to support the Doppel Alert Telco incident type.

• Doppel Screenshot URL

• Updated the Doppel Screenshot URL incident field to support the Doppel Alert Telco incident type.

• Doppel Entity Content

• Updated the Doppel Entity Content incident field to be associated only with the Doppel Alert Domains incident type. Other alert types now use their dedicated per-product entity content fields.

• Doppel Entity State

• Updated the Doppel Entity State incident field to support the Doppel Alert Telco incident type.

• Doppel Brand

• Updated the Doppel Brand incident field to support the Doppel Alert Telco incident type.

Incident Types

• Doppel Alert Telco
• Added a new incident type Doppel Alert Telco for Doppel telco alerts.

Integrations

Doppel

• Fixed an issue where incoming mirroring failed on the first sync for incidents whose dbotMirrorLastSync timestamp was not yet set.
• Fixed an issue where get-modified-remote-data returned only the first page of modified alerts, causing updates to be missed.
• Fixed an issue where incoming mirroring skipped alert updates when the alert had no audit logs.
• Updated the outgoing mirroring to send the incident close notes to Doppel as an alert comment when the incident is closed.
• Updated the product argument of the doppel-get-alerts command to use the correct email and paid_ads values and to add the telco and darkweb values. The previous emails and paid_adds values were not valid Doppel API values and were rejected by the API.
• Fixed an issue where flat entity content objects were dropped from the entity content grid instead of being displayed as rows.
• Improved implementation of error logging in outgoing mirroring to include the full traceback.
• Improved implementation of debug logging in outgoing mirroring to no longer include the content of incident close notes.
• Improved implementation of the alert commands to include the raw API response in the command results.

Layouts

• Doppel Incident Layout
• Updated the Doppel Incident Layout layout to display the Doppel Audit Logs incident field and the per-product entity content grid fields.

Mappers

Doppel Incoming_Mapper

• Updated the Doppel Incoming_Mapper mapper to map the Doppel Audit Logs field, the per-product entity content fields, and the new Doppel Alert Telco incident type.

Doppel Outgoing_Mapper

• Updated the Doppel Outgoing_Mapper mapper to map the incident close notes and to support the Doppel Alert Telco incident type.

Integrations

Doppel

• Fixed an issue in fetch-incidents that could create many duplicate incidents from a single Doppel alert. Alerts are now de-duplicated by their Doppel alert ID both within a run and across runs.
• Updated the fetch-incidents command to process alerts page by page with a bounded number of pages per run, so a large backlog is drained safely over consecutive runs without timing out or looping.
• Updated the fetch-incidents command to fetch alerts using the maximum page size (200) supported by the Doppel API, reducing the number of requests.
• Updated the fetch-incidents command to name incidents using the external Doppel alert ID (for example, Doppel Alert TET-1953421) and to set the dbotMirrorId field explicitly for reliable mirroring and de-duplication.
• Fixed the handling of blank or invalid Fetch Timeout and Maximum incidents per fetch parameter values.
• Updated the Docker image to: demisto/python3:3.12.13.10404775.

Integrations

Doppel

• Documentation and metadata improvements.

Integrations

Doppel

• Implemented the get-modified-remote-data command.
• Significantly improved the incoming mirroring Incident update timing from 300-600 seconds to 40-120 seconds.
• Updated the Docker image to: demisto/python3:3.12.13.8428455.

Mappers

Doppel Incoming_Mapper

• Updated Screenshot URL references to use consistent naming convention.

Doppel

Documentation and metadata improvements.

Classifiers

Doppel_Incident_Classifier

• Updated the Doppel_Incident_Classifier classifier to remove duplicate Doppel Alert Crypto in associated types.

Incident Fields

• Doppel Brand

• Updated the Doppel Brand incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Entity

• Updated the Doppel Entity incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Entity Content

• Updated the Doppel Entity Content incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Entity State

• Updated the Doppel Entity State incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Link

• Updated the Doppel Link incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Notes

• Updated the Doppel Notes incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Platform

• Updated the Doppel Platform incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Product

• Updated the Doppel Product incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Queue State

• Updated the Doppel Queue State incident field to remove duplicate Doppel Alert Crypto in associated types.

• New: Doppel Screenshot URL

• New: Added a new incident field - Doppel Screenshot URL which is screenshot URL received from Doppel alert data.

• Doppel Uploaded By

• Updated the Doppel Uploaded By incident field to remove duplicate Doppel Alert Crypto in associated types.

Incident Types

• Doppel Alert Crypto

• Updated the Doppel Alert Crypto incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Domains

• Updated the Doppel Alert Domains incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Ecommerce

• Updated the Doppel Alert Ecommerce incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Email

• Updated the Doppel Alert Email incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Mobile_Apps

• Updated the Doppel Alert Mobile_Apps incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Paid_Ads

• Updated the Doppel Alert Paid_Ads incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Social_Media

• Updated the Doppel Alert Social_Media incident type to include Doppel Screenshot Preview playbook id.

Integrations

Doppel

• Added the Organization Code parameter to enable using the organization code provided by Doppel.
• Added support to the Proxy, and SSL flag parameter to enable the use of a proxy with a Cortex engine.

Layouts

• Doppel Incident Layout
• Updated the Doppel Incident Layout layout to include Doppel Screenshot URL.

Mappers

Doppel Incoming_Mapper

• Updated the Doppel Incoming_Mapper mapper to include Doppel Screenshot URL.

Playbooks

New: Doppel Screenshot Preview

• New: Added a new playbook- Doppel Screenshot Preview that previews the Doppel Screenshot URL to an actual image in the Incident War Room.

Integrations

Doppel

• Added support for User API Key parameter that the user api key (optional) to use for connection with doppel.
• Updated the Docker image to: demisto/python3:3.12.11.4819260.

Integrations

Doppel

• Added the last_activity_timestamp and page_size arguments to the doppel-get-alerts command, enabling retrieval of alerts filtered by their last activity time.
• Added reopen support for revived alerts. When Doppel moves an alert back into an active queue (for example, a taken-down domain that comes back online), incoming mirroring now reopens the corresponding closed incident instead of silently updating its fields.
• Added the x-doppel-client attribution header to every Doppel API request. The header identifies the integration and pack version for usage attribution on Doppel's side and does not affect request handling.

Classifiers

Doppel_Incident_Classifier

• Updated the Doppel_Incident_Classifier classifier to classify Doppel telco alerts into the Doppel Alert Telco incident type.

Incident Fields

• Doppel Product

• Updated the Doppel Product incident field to support the Doppel Alert Telco incident type and to include the telco and darkweb select values.

• Doppel Entity Content Social Media

• Added a new incident field Doppel Entity Content Social Media that displays the entity content of Doppel social media alerts in a grid.

• Doppel Entity

• Updated the Doppel Entity incident field to support the Doppel Alert Telco incident type.

• Doppel Entity Content Ecommerce

• Added a new incident field Doppel Entity Content Ecommerce that displays the entity content of Doppel ecommerce alerts in a grid.

• Doppel Notes

• Updated the Doppel Notes incident field to support the Doppel Alert Telco incident type.

• Doppel Link

• Updated the Doppel Link incident field to support the Doppel Alert Telco incident type.

• Doppel Platform

• Updated the Doppel Platform incident field to support the Doppel Alert Telco incident type.

• Doppel Entity Content Telco

• Added a new incident field Doppel Entity Content Telco that displays the entity content of Doppel telco alerts in a grid.

• Doppel Entity Content Mobile Apps

• Added a new incident field Doppel Entity Content Mobile Apps that displays the entity content of Doppel mobile app alerts in a grid.

• Doppel Audit Logs

• Added a new incident field Doppel Audit Logs that displays the audit log history of the Doppel alert in a grid.

• Doppel Uploaded By

• Updated the Doppel Uploaded By incident field to support the Doppel Alert Telco incident type.

• Doppel Queue State

• Updated the Doppel Queue State incident field to support the Doppel Alert Telco incident type.

• Doppel Screenshot URL

• Updated the Doppel Screenshot URL incident field to support the Doppel Alert Telco incident type.

• Doppel Entity Content

• Updated the Doppel Entity Content incident field to be associated only with the Doppel Alert Domains incident type. Other alert types now use their dedicated per-product entity content fields.

• Doppel Entity State

• Updated the Doppel Entity State incident field to support the Doppel Alert Telco incident type.

• Doppel Brand

• Updated the Doppel Brand incident field to support the Doppel Alert Telco incident type.

Incident Types

• Doppel Alert Telco
• Added a new incident type Doppel Alert Telco for Doppel telco alerts.

Integrations

Doppel

• Fixed an issue where incoming mirroring failed on the first sync for incidents whose dbotMirrorLastSync timestamp was not yet set.
• Fixed an issue where get-modified-remote-data returned only the first page of modified alerts, causing updates to be missed.
• Fixed an issue where incoming mirroring skipped alert updates when the alert had no audit logs.
• Updated the outgoing mirroring to send the incident close notes to Doppel as an alert comment when the incident is closed.
• Updated the product argument of the doppel-get-alerts command to use the correct email and paid_ads values and to add the telco and darkweb values. The previous emails and paid_adds values were not valid Doppel API values and were rejected by the API.
• Fixed an issue where flat entity content objects were dropped from the entity content grid instead of being displayed as rows.
• Improved implementation of error logging in outgoing mirroring to include the full traceback.
• Improved implementation of debug logging in outgoing mirroring to no longer include the content of incident close notes.
• Improved implementation of the alert commands to include the raw API response in the command results.

Layouts

• Doppel Incident Layout
• Updated the Doppel Incident Layout layout to display the Doppel Audit Logs incident field and the per-product entity content grid fields.

Mappers

Doppel Incoming_Mapper

• Updated the Doppel Incoming_Mapper mapper to map the Doppel Audit Logs field, the per-product entity content fields, and the new Doppel Alert Telco incident type.

Doppel Outgoing_Mapper

• Updated the Doppel Outgoing_Mapper mapper to map the incident close notes and to support the Doppel Alert Telco incident type.

Integrations

Doppel

• Fixed an issue in fetch-incidents that could create many duplicate incidents from a single Doppel alert. Alerts are now de-duplicated by their Doppel alert ID both within a run and across runs.
• Updated the fetch-incidents command to process alerts page by page with a bounded number of pages per run, so a large backlog is drained safely over consecutive runs without timing out or looping.
• Updated the fetch-incidents command to fetch alerts using the maximum page size (200) supported by the Doppel API, reducing the number of requests.
• Updated the fetch-incidents command to name incidents using the external Doppel alert ID (for example, Doppel Alert TET-1953421) and to set the dbotMirrorId field explicitly for reliable mirroring and de-duplication.
• Fixed the handling of blank or invalid Fetch Timeout and Maximum incidents per fetch parameter values.
• Updated the Docker image to: demisto/python3:3.12.13.10404775.

Integrations

Doppel

• Documentation and metadata improvements.

Integrations

Doppel

• Implemented the get-modified-remote-data command.
• Significantly improved the incoming mirroring Incident update timing from 300-600 seconds to 40-120 seconds.
• Updated the Docker image to: demisto/python3:3.12.13.8428455.

Mappers

Doppel Incoming_Mapper

• Updated Screenshot URL references to use consistent naming convention.

Doppel

Documentation and metadata improvements.

Classifiers

Doppel_Incident_Classifier

• Updated the Doppel_Incident_Classifier classifier to remove duplicate Doppel Alert Crypto in associated types.

Incident Fields

• Doppel Brand

• Updated the Doppel Brand incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Entity

• Updated the Doppel Entity incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Entity Content

• Updated the Doppel Entity Content incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Entity State

• Updated the Doppel Entity State incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Link

• Updated the Doppel Link incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Notes

• Updated the Doppel Notes incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Platform

• Updated the Doppel Platform incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Product

• Updated the Doppel Product incident field to remove duplicate Doppel Alert Crypto in associated types.

• Doppel Queue State

• Updated the Doppel Queue State incident field to remove duplicate Doppel Alert Crypto in associated types.

• New: Doppel Screenshot URL

• New: Added a new incident field - Doppel Screenshot URL which is screenshot URL received from Doppel alert data.

• Doppel Uploaded By

• Updated the Doppel Uploaded By incident field to remove duplicate Doppel Alert Crypto in associated types.

Incident Types

• Doppel Alert Crypto

• Updated the Doppel Alert Crypto incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Domains

• Updated the Doppel Alert Domains incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Ecommerce

• Updated the Doppel Alert Ecommerce incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Email

• Updated the Doppel Alert Email incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Mobile_Apps

• Updated the Doppel Alert Mobile_Apps incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Paid_Ads

• Updated the Doppel Alert Paid_Ads incident type to include Doppel Screenshot Preview playbook id.

• Doppel Alert Social_Media

• Updated the Doppel Alert Social_Media incident type to include Doppel Screenshot Preview playbook id.

Integrations

Doppel

• Added the Organization Code parameter to enable using the organization code provided by Doppel.
• Added support to the Proxy, and SSL flag parameter to enable the use of a proxy with a Cortex engine.

Layouts

• Doppel Incident Layout
• Updated the Doppel Incident Layout layout to include Doppel Screenshot URL.

Mappers

Doppel Incoming_Mapper

• Updated the Doppel Incoming_Mapper mapper to include Doppel Screenshot URL.

Playbooks

New: Doppel Screenshot Preview

• New: Added a new playbook- Doppel Screenshot Preview that previews the Doppel Screenshot URL to an actual image in the Incident War Room.

Integrations

Doppel

• Added support for User API Key parameter that the user api key (optional) to use for connection with doppel.
• Updated the Docker image to: demisto/python3:3.12.11.4819260.