Classifiers
New: Graph Security Classifier
New: Sets the incident type to Graph Security Alert or Graph Security Incident. (Available from Cortex XSOAR 6.10.0).
Incident Fields
New: Microsoft Graph Security Alert Status
New: Holds the Microsoft Graph Security alert status. Alert mirroring uses this field. (Available from Cortex XSOAR 6.10.0).
New: Microsoft Graph Security Incident Status
New: Holds the Microsoft Graph Security incident status. Incident mirroring uses this field. (Available from Cortex XSOAR 6.10.0).
New: Microsoft Graph Security Classification
New: Holds the classification and determination of the Microsoft Graph Security alert or incident. Mirroring uses this field. (Available from Cortex XSOAR 6.10.0).
New: Microsoft Graph Security Incident Tags
New: Holds the custom tags of the Microsoft Graph Security incident. Incident mirroring uses this field. (Available from Cortex XSOAR 6.10.0).
New: Microsoft Graph Security Incident ID
New: The ID of the Microsoft Graph Security incident. (Available from Cortex XSOAR 6.10.0).
Integrations
Microsoft Graph Security
- Added support for incoming and outgoing mirroring of alerts and incidents, including comments.
- Added the following parameters to configure mirroring: Incident Mirroring Direction, Close Mirrored Cortex XSOAR Incident, Close Mirrored Microsoft Alert/Incident, Comment Entry Tag (to Microsoft) and Comment Entry Tag (from Microsoft).
- You can now enable mirroring on an existing instance by selecting the Graph Security Classifier, Graph Security Mapper - Incoming and Graph Security Mapper - Outgoing in the instance settings.
- New integration instances now use the Graph Security Classifier and the Graph Security Mapper - Incoming by default.
- Updated the Azure Cloud parameter to remove the Germany option, as Microsoft retired Microsoft Cloud Deutschland.
Mappers
New: Graph Security Mapper - Incoming
New: Maps Microsoft Graph Security alerts and incidents. Includes the fields used for mirroring. (Available from Cortex XSOAR 6.10.0).
New: Graph Security Mapper - Outgoing
New: Maps Cortex XSOAR incident fields to Microsoft Graph Security alerts and incidents. Outgoing mirroring uses this mapper. (Available from Cortex XSOAR 6.10.0).
Related pull requests:
-
46350 Download
