Milestone 64

What's New




  • Get recommendations on building playbooks in Easy Mode.
  • regex operator allows you to parse table rows based on regex.
  • LogicHub DSL operator allows you to include multiple operators within a single LQL expression.



  • Easy Mode supports adding JSON paths and expressions in integration forms. See Add an integration in Easy Mode.
  • In case management, markdown is available for hyperlinks in summary and comments.
  • Enhancements are added for alert summary view, advanced filter, sorting, and retention.
  • Report links are added to Virustotal URL, Virustotal File Hash, FalconHost URL, FalconHost File, and Wildfire
  • With the CrowdStrike integration, you can search for incidents and obtain details.
  • With the Amazon EC2 integration, you can start an instance.
  • For the Urlscan_IO integration, URL screenshots are updated.
  • The Active Directory integration now includes deleting users.
  • Box integration now pulls in audit events.
  • Microsoft 365 Defender integration supports incident management.

Bug Fixes

  • An error was generated when using an event type created from a step in a playbook.
  • The RunScript operator didn't preserve columns from the parent node.
  • The MS Graph list user action returned only 100 users.