Respond

You can now view the Playbook ID and Run Log IDs in the Activity Logs for incidents, devices, and other modules created in Respond through playbooks. This helps you trace which playbook run created a specific record, improving visibility, auditing, and troubleshooting. For more information, see Manage Activity Logs.

While creating triggers in Rule Engine, Field Update now supports selecting None for both From Field and To Field. This enables triggers when a field changes from None to a value, such as when the Assigned User field is updated from None to a user.

For more information, see Configure Automation Rules.

You can now add tables and images directly within Knowledge Base articles for better layout and clarity.

For more information, see Create Knowledge Base Article.

You can now configure default values for single-select and multi-select fields of an incident in Form Management > Incident Workflows. The configured default values are automatically selected when creating an incident.

For more information, see Manage Field Library.

In an incident, you can now move between phases by simply editing any field in the required phase, reducing clicks, and accelerating incident investigations. For more information, see Incident Response and Response.

Admins can now configure whether users can add notes after an incident is closed using the Allow Notes After Incident Closure option in Admin > Configurations > Incident > Incident Notes. For more information, see Configure Incident Settings.

While creating new threat intel, you can now view the threat intel already associated with an incident in Connected IPs, Connected Domains, and other threat intel. The Remove Connection option is now available in Threat Intel to remove connections associated with the incident. These enhancements are available in both the New and Classic incident response layouts.

For more information, see Connect the Dots and Mission Control.

When exporting Threat Intel, the export file now includes the Linked Business Units column, providing better visibility into the business units impacted. For more information, see Manage Threat Intel.

While creating Reports, you can now add overview widgets that provide summarized data, enabling stakeholders to quickly track incident trends and key metrics.