IBM Security QRadar SOAR

Audit log

Audit messages are logged for threat service enable and threat service disable.

Report and Analytics Performance

Introduced a number of performance improvements regarding generating reports and viewing analytics dashboards. These improvements include optimizing the Incident History Report, loading widgets in the Analytics Dashboard more efficiently, and improving the process of running multiple incident reports simultaneously.

Resilient for MSSPs

IMPORTANT: If you are using the Resilient QRadar plugin and you are upgrading your Resilient platform from Version 36.1 or earlier, make sure to upgrade the plugin to V3.4.1 before using it with the Resilient platform V37.

Security Updates

The security update for this release addresses various security issues. For on-premises customers, consult your Resilient Installation Guide for the location of these updates. On-Cloud customers are updated automatically.

SNMP monitoring

For on-premises customers, the Resilient SOAR Platform Virtual Appliance Installation Guide provides the procedures to monitor the Resilient platform using SNMP. This enhancement was in response to a customer's Request for Enhancement (RFE).

System Requirements

For on-premises customers, the virtual appliance default configuration has been changed to 4 CPUs and 16GB memory. This does not impact upgrades. For standalone installations, the minimum memory recommendation for the system hosting the Resilient platform has increased to 16GB, and the CPU recommendation is 4 CPUs.

Usability Improvements

This release contains a number of usability enhancements, including:

• The list of attachments displayed in an incident page is limited to three with the option to display more.
• The banner timeout in the task window is extended, and a user can make it remain open by hovering the mouse over it.

Web Browser Support

Internet Explorer is no longer supported. The Resilient platform supports the Chrome, Firefox, Safari, and Edge web browsers.

Dark Mode Default for New Users

Due to the extreme popularity, all new users added to Resilient will now have their default theme setting changed to Very Dark.

Notifications

We are now introducing the ability to enable/disable notifications within Resilient.  The notifications can be disabled globally (turned off) or disabled within the platform or via email, allowing admins to become very granular and exact with their notifications.

Privacy

The privacy tab has now been revamped to only show the most relevant information for your organizations.   Through configuration only the relevant data types and regulators are displayed to be able to gather your privacy regulation insights in the blink of an eye.

Performance

Performance improvements have been made to the Incident History Reporting, Auditing, and Privacy features. 

Diagnostics

Improvements to logging have been done to accelerate troubleshooting complex support issues.

Apps and App Host

The new Apps and App Host feature is our next-generation integration infrastructure that containerizes integrations and brings the integration management into the WebUI, bringing install times down to just a few minutes.   A new tab has been added to the Administrator Settings for the management of App installation, configuration, deployment, and debugging through log retrieval.    Additionally, the pairing of a new App Host is managed through the WebUI such that hosts are registered for deployment of containers to.  

Apps (like integrations) are still downloaded from the AppXchange in a zip package, however if you look at the content of what you download it has changed slightly to include specifics about containers and configuration.  The zip for an App then uploaded into the UI pushing the App configuration and customizations into the Resilient server.  Certain parts of the configuration are auto generated such as the API key, certificate, host, port, and org when the app is installed to reduce configuration time.  Further configuration may be necessary to log into remote systems and can be done via a file editor in the WebUI.   Once configuration is complete the app executable can be deployed to the paired Apphost, which will pull down containers from our centralized container repository.   If the App run into issues while running the container can be restarted or a guided log retrieval experience is displayed in the UI. 

If you have existing integration from the AppXchange today, the integrations can be redownloaded and installed into the WebUI.   If any of your integrations have been customized or home grown, then we will be providing a new resilient-circuits-SDK that will include the new commands to create the new packaging as well as the containers.   Once the container is built a container registry will need to be setup and configure in the App Host.  Once configured the packaging can be uploaded to the WebUI. 

For information on the Apps and App Host deliverable see the documentation for v37.2 when its available here.

For more information on developing your own apps go here when v37.2 has been released.