Skip to main content

September Content Digest

Discover new integrations, steps, and improvements.

We've added the following new integrations, steps, and improvements:

  • New integrations:

    • Artemis

    • Brinqa BQL

    • Doppel

    • ExtraHop RevealX 360

    • Horizon3.ai

    • Kyberis

    • Maze

    • Noma Security

    • SOCRadar

    • SpyCloud

    • Thinkst Canary

    • Typesafe AI

    • Zscaler OneAPI ZDX

  • New steps and improvements:

    • Bitsight

    • Censys

    • Check Point Harmony Email

    • Drata

    • KnowBe4

    • Microsoft Teams Bot

    • Netskope

    • Nucleus

    • Vega

    • VMRay

    • Zendesk

New integrations

Artemis

A new Artemis steps integration is now available on the Integrations page. The following steps are available:

  • Get IP Enrichment

  • List Cases

  • Get Case

  • Get Investigation Status

  • Lookup Person

  • Get Investigation Result

  • Get Finding Signals

  • Get Case Response Guidance

  • Get SQL Query Results

  • List Findings

  • Get Observable Report

  • Update Case

Brinqa BQL

A new Brinqa BQL steps integration is now available on the Integrations page. The following steps are available:

  • Start CISA Overdue Query

  • Start SLA Breach Query

  • Start Asset Lookup Query

  • Start Updated Findings Query

  • Start Open Tickets Query

  • Start Unowned Findings Query

Doppel

A new Doppel steps integration is now available on the Integrations page. The following steps are available:

  • List HRM Campaigns

  • Get Alert

  • Delete Brand

  • Get HRM Campaign

  • Delete Protected Asset

  • Submit Referrer Logs

  • List Protected Assets

  • Create Protected Asset

  • Update Alert

ExtraHop RevealX 360

A new ExtraHop RevealX 360 steps integration is now available on the Integrations page. The following steps are available:

  • List Investigations

  • Assign Tag to Device

  • Update Tag Devices

  • Delete Investigation

  • Search Devices

  • Update Network Users Tags

  • Update Investigation

  • Get Device

  • Add Device to Watchlist

  • Get Investigation

  • Search Detections

  • Create Tag

Horizon3.ai

A new Horizon3.ai steps integration is now available on the Integrations page. The following steps are available:

  • Get Op

  • List Data Stores

  • Create Op

  • End Op

  • List Credentials

  • List Weaknesses

  • List Weakness Series

  • Resume Op

  • Get Report URL

  • Get Weakness

  • Generate Access Token

  • Pause Op

Kyberis

A new Kyberis steps integration is now available on the Integrations page. The following steps are available:

  • Assess Actor

  • Assess Threat

  • Assess IOC by Entity

  • Get Evidence

  • Assess IOC

Maze

A new Maze steps integration is now available on the Integrations page. The following steps are available:

  • List Daily Investigation Exports

  • Get Daily Investigation Export

  • Search Investigations

Noma Security

A new Noma Security steps integration is now available on the Integrations page. The following steps are available:

  • Create Profile

  • List Audit Logs

  • List Profiles

  • Create Application

  • Delete Profile

  • List Datasets

  • Set Profile to Application

  • Get Profile

  • Bulk Update Agent Access Decision

  • Bulk Update MCP Access Decision

  • Get Toolset

  • Get Issue

  • Run GraphQL Query

SOCRadar

A new SOCRadar steps integration is now available on the Integrations page. The following steps are available:

  • Get Entity Reputation

  • Add to Company Pocket

  • Add Alarm Comment

  • Submit Domain or URL Takedown Request

  • Add to Allowlist

  • Update Alarm Status

  • Get CVE Details

  • Get PII Exposure

  • Get Impersonating Domains

  • List Incidents

  • Get Botnet Data

  • Get Latest Vulnerabilities

  • Add or Remove Alarm Tag

SpyCloud

A new SpyCloud steps integration is now available on the Integrations page. The following steps are available:

  • Get All Records in Watchlist

  • Get All Compass Records

  • Get Records by Domain

  • Get an Identifier

  • Get Compass Records for a Device

  • List All Breach Metadata

  • Get Metadata for a Breach

  • Get Records by Email Address

  • Create an Identifier

  • Get Records by IP Address

Thinkst Canary

A new Thinkst Canary steps integration is now available on the Integrations page. The following steps are available:

  • Acknowledge Incident

Typesafe AI

A new Typesafe AI steps integration is now available on the Integrations page. The following steps are available:

  • Evaluate state JSON

  • Evaluate state string

Zscaler OneAPI ZDX

A new Zscaler OneAPI ZDX steps integration is now available on the Integrations page. The following steps are available:

  • List Ongoing Alerts

  • Get Device Deep Trace

  • List Software Inventory

  • List Devices

  • Get Alert

  • Get Users

  • List Device Events

  • List Historical Alerts

  • Get Device

  • Get User's Devices

  • Get Device Trace Top Processes

New steps and improvements

Bitsight

Several new steps were added to the Bitsight integration:

  • Get Company Rating History

  • Get Latest Alerts

  • Get Alert Details by Type

  • Get Breach Intelligence Event

  • Get Threat Evidence

  • Update Finding Remediation

  • List Breach Intelligence Events

  • List Vulnerabilities

The Get Alerts step has several new optional parameters:

  • HTTP proxy: Your HTTP proxy URL. If you need to use a SOCKS proxy, set the `HTTP_PROXY` environment variable to `socks5://...`.

  • End date: Return alerts on or before this date (YYYY-MM-DD)

  • Sort: Sort field. Prefix with - for descending. Options: alert_date, severity, alert_type, company_name, folder_name, trigger

  • Folder GUID: Return alerts for this folder.

  • Company GUID: Return alerts for this company.

  • HTTPS proxy: Your HTTPS proxy URL. If you need to use a SOCKS proxy, set the `HTTPS_PROXY` environment variable to `socks5://...`.

  • Custom certificates PEM: The contents of a .pem file containing a self-signed certificate or certificate chain. Useful when connecting to local servers.

  • Retry delay: Initial delay before retry attempts in seconds, exponential backoff calculation will be applied over this value.

  • Max retries: The maximum number of times a step will be retried. By default (-1), the step will keep retrying for up to 50 seconds.

  • Retry on status: If set, the step will automatically retry the request on the specified status codes. The maximum retry duration is 50 seconds.

  • Skip SSL verification: If set, request will not verify SSL certificates. Where applicable, it might be better to provide a self-signed certificate using the `CUSTOM_CERTIFICATES_PEM` parameter.

  • Timeout: Timeout for request in seconds. By default, timeout is 30 seconds.

  • Query: Full-text search across alert fields.

Censys

Several new steps were added to the Censys integration:

  • Get a Web Property

  • Get a Collection's Events

  • Get DNS Names That Resolved to an IP

  • Create a Tag Assignment

  • Get Host Enrichment

  • Create a Tag

  • Get DNS Resolution Records for a Name

  • List Tag Assignments

  • Delete a Tag Assignment

  • Aggregate Results for a Search Query

  • Get Service History for a Host

  • Get a Certificate

  • Retrieve Multiple Web Properties

  • Live Rescan

  • Get a Host

  • Retrieve Multiple Certificates

  • List Tags

  • Get Scan Status

  • Get Organization Credit Balance

  • Get Host Event History

  • Create a Comment

The Retrieve Multiple Hosts step has several new optional parameters:

  • Base URL

  • Access token

  • Organization ID

  • Host IDs: A JSON array of host IP addresses. Up to 100 per call.

Check Point Harmony Email

Several new steps were added to the Check Point Harmony Email integration:

  • Create URL Exception

  • Add CTP List Item

  • Create CP2 Exception

  • Get CTP List

  • Get URL Exception

  • Update DLP Exception

  • Update URL Exception

  • Delete CP2 Exceptions

  • Get Action Result

  • Delete URL Exceptions

Drata

Several new steps were added to the Drata integration:

  • Get Personnel

  • Get Monitoring Test

  • Upload User Document

  • List Monitors Tests

  • Upload Device Document

The List Controls step has several new optional parameters:

  • Regional endpoint: The regional endpoint domain. For North America: public-api, Europe: public-api.eu, Asia-Pacific: public-api.apac

  • Workspace ID: The Workspace ID associated with the account.

  • Cursor: Pagination cursor. Leave empty on the first request; use the pagination.cursor value from the previous response to fetch the next page.

  • Size: Number of results to return per page (1-500, default 50).

  • Ticket status: Only include controls with an associated task management ticket.

  • Policy ID: Filter controls associated with a specific policy ID.

  • Is enabled: Filter controls that are or are not enabled.

The List Personnel step has several new optional parameters:

  • Regional endpoint: The regional endpoint domain. For North America: public-api, Europe: public-api.eu, Asia-Pacific: public-api.apac

  • Cursor: Pagination cursor. Leave empty on the first request; use the pagination.cursor value from the previous response to fetch the next page.

  • Size: Number of results to return per page (1-500, default 50).

  • Employment status: Filter personnel by employment status (e.g., ACTIVE, INACTIVE).

  • Sort: Field to sort by.

  • Sort direction: Sort direction.

  • Include total count: Include total count of all matching records in response. Only honored on the first page (when cursor is empty)

  • HTTPS proxy: Your HTTPS proxy URL. If you need to use a SOCKS proxy, set the `HTTPS_PROXY` environment variable to `socks5://...`.

  • HTTP proxy: Your HTTP proxy URL. If you need to use a SOCKS proxy, set the `HTTP_PROXY` environment variable to `socks5://...`.

  • Custom certificates PEM: The contents of a .pem file containing a self-signed certificate or certificate chain. Useful when connecting to local servers.

  • Retry delay: Initial delay before retry attempts in seconds, exponential backoff calculation will be applied over this value.

The List Workspaces step has several new optional parameters:

  • Endpoint region: The regional endpoint subdomain for your Drata tenant. Use public-api for North America, public-api.eu for Europe, or public-api.apac for Asia-Pacific.

  • Cursor: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a pagination.cursor value that can be used in the subsequent request to retrieve the next page of results.

  • Size: Number of results to return[1...500].

  • Sort: Which field to sort by.

  • Sort direction: The direction to sort the data.

  • Include total count: Include total count of all matching records in response. Only honored on first page (when cursor is null).

  • HTTPS proxy: Your HTTPS proxy URL. If you need to use a SOCKS proxy, set the `HTTPS_PROXY` environment variable to `socks5://...`.

  • HTTP proxy: Your HTTP proxy URL. If you need to use a SOCKS proxy, set the `HTTP_PROXY` environment variable to `socks5://...`.

  • Custom certificates PEM: The contents of a .pem file containing a self-signed certificate or certificate chain. Useful when connecting to local servers.

KnowBe4

Several new steps were added to the KnowBe4 integration:

  • Delete PhishER Rule

  • Bulk Remove PhishER Tags

  • Bulk Add PhishER Tags

  • Create PhishER Comment

  • Remove PhishER Tags

  • Publish PhishER Rule Changes

  • Bulk Update PhishER Messages

  • Create PhishER Rule

Microsoft Teams Bot

The Generate Microsoft Teams Bot API Token step has several new optional parameters:

  • Bot type: The bot's app type in Azure. Bots created after July 2025 are Single-Tenant.

  • Tenant ID: Your Microsoft Tenant ID. Used when Bot Type is Single-Tenant.

Netskope

Several new steps were added to the Netskope integration:

  • Export Alert Data

  • Get Alerts Data V2

  • Search Device Status

  • Get Events Data V2

  • Search Alert Events

  • Get URL Lists

  • Update URL List

  • Apply Changes to URL List

Nucleus

Several new steps were added to the Nucleus integration:

  • Link Issues

  • Update Asset

  • Bulk Update Findings

  • Update Issues

  • Get Job

  • Get Asset

  • Search Findings

  • List Asset Groups

  • Get Finding Details

  • List Projects

Vega

The List Incidents step has several new optional parameters:

  • User statuses: Filter by the analyst-managed user status. Independent from the AI investigation status.

  • Investigation statuses: Filter by the automatic AI investigation status.

The Update Incidents step has several new optional parameters:

  • User status: New user status for the incidents.

  • Assignee emails: Email addresses of the users to assign these incidents to. Must be a user in the Vega organization.

  • Verdict: Verdict and reasoning to record on the incidents, as a JSON object. value is required; reasoning is optional and is recorded on the incident audit trail. Omit this parameter entirely to leave the verdict unchanged.

VMRay

Several new steps were added to the VMRay integration:

  • Add Tag to Submission

  • List Analyses by Submission

  • Get Sample MITRE ATTACK Techniques

  • Get Sample IOCs STIX 2.0

  • Add Tag to Analysis

  • Remove Tag from Analysis

  • Get Analysis Archive File

  • Reanalyze Analysis

  • Get Analyses by Tag

  • Remove Tag from Submission

Zendesk

The List Custom Ticket Statuses, Create User, List SLA Policies, Update Ticket, List Ticket Metrics, Upload File, Get Organization by ID, List Organization Users, List Users, and List Organization Tickets steps have a new optional parameter:

  • Access token

Related Articles
Did this answer your question?