Prior Releases
Turbine Content March 2024 Release Drop 2
March 22, 2024
In this release, Swimlane is updating the SOC Solution to version 1.2.6. This version:
- Allows the SOC Solution to install properly in tenants that previously may have experienced an issue due to a correlation field.
- Includes the following updated VICs in the SOC Solution so that the Threat Intel playbooks continue to work when the assets are not configured correctly:
- GetEnrichment from IPQualityScore
- Get Enrichment from URLHaus
- Get Enrichment from VirusTotal
Turbine Content March 2024 Release Drop 1
March 15, 2024
In this release, Swimlane is updating the SOC Solution to version 1.2.5. This version includes the following fixes
- Missing Threat Intel record trigger added to the Threat Intel Enrich Observable playbook.
- An input corrected in the Run Observable Enrichments script
Known Issue:
- Correlation fields installed via SSP will not correlate. They must be re-created after installation.
Turbine Content March 2024 Release
March 11, 2024
In this release, Swimlane is updating the SOC Solution to version 1.2.4. This version fixes the following bugs in SOC Solution v1.2.3
- Threat Intell is failing to complete when the Extended_value is set to null.
- Processing Observables in SOC Solution fails for single observable.
- Signal Display Widget not showing images properly
In addition, the Recorded Future VIC is updated to map a failure to find an observable to the next action.
Turbine Content February 2024 Release Drop 1
February 22, 2024
In this release, Swimlane is updating the SOC Solution to version 1.2.3. This version fixes a bug in SOC Solution v1.2.2 where it was missing its Dashboards.
The SOC Solution also changed paths containing β/record2β to be β/recordβ. Any customer widgets referring to β/record2β should be modified to instead reference β/recordβ.
Turbine Content February 2024 Release
February 1, 2024
In this release, Swimlane is addressing a bug where configured ids are present in the current SOC Solution. These ids are now removed
Turbine Content January 2024 Release
January 24, 2024
In this release, Swimlane added a new functionality within the SOC Solution. As an Orchestrator, improve your phishing triage incident response by saving phishing email attachments to a threat intel (TI) record. This allows you to interact with files to take appropriate actions using the TI application, which now has an easy-to-read widget that shows the name and hashes of the file, and has a download option.
Additionally, we fixed two bugs:
- When working with correlations, field values with the same UID were duplicating. Now, correlation fields do not duplicate. Instead they overwrite values with the same UID.
- Also, typos in the SOC solution were fixed. This bug did not affect functionality.
Turbine Content December 2023 Release Drop 2
December 22, 2023
In this release, we fixed an issue relating to a Correlation functionality. Now, preconfigured correlation has been removed, and the Correlation section will be completed manually. Turbine documentation, under Case and Incident Management (CIM) Application, provides step-by-step instructions on how to manually configure the Correlation section to ensure CIM records correlate.
Turbine Content December 2023 Release Drop 1
December 19, 2023
In this release, Swimlane has enhanced the SOC Solution based on your feedback. Now, the SOC Solution has new features under the Case and Incident Management (CIM) application including knowledge base articles, remediation, correlation, and After Actions Reports (AARs).
The Knowledge Base section houses previously user-created knowledge base articles (KBAs) that allow you to access lessons learned and other tips for that record, or a similar record feature like signal type. There is context summary, guidance, and date/time stamps to ensure you are accessing the most detailed and recent KBAs.
The new Remediation section executes playbooks for remediation actions for a CIM record. As an orchestrator, you can customize these remediation playbooks to block/unblock observables, disable/enable users, isolate/rejoin hosts, notify managers, and perform a SIEM query.
The new Correlation section provides 15 fields for matching observables, text strings, and file attachments.Β Upon correlation with a matching CIM record, tracking IDs for the matching records are provided, which also now display under the CIM tab, with a new widget for better visual representation of the current and correlating records and more fields for Alert and Phishing cases.
In addition, we are introducing the Post Incident Activity section that generates an AAR in a PDF file that has an easy-to-read layout that includes the following information for that record:
- Case number
- Automated brief
- Investigation summary
- Remediation actions taken
- Timeline summary
- Incident handler information
Additionally, there are improved banners for incident promotion and/or de-escalation.
New Turbine Connectors
- Devo API
- Recorded Future Sandbox
- Sekoia.io XDR
- ThreatStop
- Wazuh
- Open CTI
- ConnectWise Manage
- IBM XForce
- Sailpoint IdentityNow
Updated Turbine Connectors
- Active Directory (On Prem)
Turbine Content November 2023 Release
December 4, 2023
In this release, we are introducing the new Turbine Collaboration Solution that provides the capability to send messages out to non-Swimlane users over email, Slack, or Teams. Message recipients can select from user-configured responses like approve, deny, confirm, yes, no, etc. Also, the Collaboration Solution can improve existing workflow (including the SOC Solution). Click Collaboration Solution to access documentation for the Collaboration Solution, including installation, configuration, and usage information.
In addition, we have enhanced the SOC Solution by using newer Turbine native features such as loops, if/else conditions, and variables. We also optimized playbooks by using the new and improved, faster, and more reliable Turbine Record Actions feature. Lastly, we now document playbook actions in the newly created Description field per action.
New Turbine Vendor Interaction Components
- Netscope Get Alerts
- Analyst1 Get Indicators
- Dataminr Get Alerts
New Turbine Connectors
- Tripwire Enterprise
- KnowBe4
- Bitbucket Cloud
- ServiceNow CMDB
- Azure DevOps Server
- Workday
- O365 eDiscovery
- GitHub
Updated Turbine Connectors
- OASIS STIX/TAXII