What's New?

We've introduced new integrations for Cyberint, DeskPro, Google Chat OAuth, and Rootly, along with new steps for existing integrations, various enhancements, and new templates. For full details, check out the complete digest.

You can now leverage the AI-generated case summary in the Overview tab of each case to streamline your investigations. Designed for clarity, the summary highlights essential details such as key events, critical timestamps, potential impacts, and significant indicators.

The summary, drawing from various case attributes—including the case description, observables, notes, and timeline comments—is automatically updated with every major change.

More information is available in our knowledge base.

In addition to the severity levels of Low, Medium, High, and Critical, you now have the option to set the severity of cases to Informational. This level is intended for non-threatening events that provide relevant context and details, such as software updates, non-critical alerts from third-party systems, routine user activity, and more.

We've implemented the following enhancements to notes in cases:

• Mark a Note as Key: Mark a note as key to make it visible in the case Overview tab. This ensures that anyone reviewing the case can quickly access important information.
• Mark a Note as Public: Mark a note as public to indicate its potential communication with external stakeholders. When retrieved, the note's visibility status is displayed, allowing you to automatically share the comment outside of Torq case management. For more details, refer to our knowledge base.

We’ve added advanced logic directly into your Torq Interactions. Enhance the end-user experience by dynamically presenting questions and information based on live responses. This dramatically reduces form completion and creation time and increases accuracy and user-centricity.

Insert conditional elements in your Interactions using the Condition element under Control Elements. Create a condition and drag relevant display and input elements under your conditional. These elements will only be shown should the condition be met.

By placing elements under a condition, you receive ultimate specificity within your Torq Interactions and can dynamically adjust your automated interactions with all possible scenarios.

We've introduced new integrations for Akeyless, Cribl Lake, Cribl Search, Cribl Stream, DNSTWISTER, Flashpoint CTI, Genea, Ollama, and Vectra, along with new steps for existing integrations, various enhancements, and a new template. For full details, check out the complete digest.

We've added two new RBAC scopes to provide more granular control over case visibility: cases.read.attr.assigned.to.others and cases.read.attr.unassigned.

You can use these scopes to create custom roles with tailored visibility controls. For example, by reaching out to Torq support, you can easily set up a role that restricts users from viewing cases not assigned to them, boosting security and safeguarding sensitive cases.

All Torq roles with case management access have been updated to include the new scopes, maintaining the same visibility to all workspace cases as before. Additionally, all users with case management access will always have visibility into cases assigned to them.

For more details on roles and scopes, visit our Knowledge Base.

The new infrastructure for the Cases page UI significantly enhances performance, boosting user efficiency. Our upgraded interface delivers faster load and response times for a smoother, more streamlined experience.

All functionality remains the same—everything you could do in the older version can still be done exactly the same way in the new version. All cases and related data remain intact; this is purely a UI infrastructure change.

The Cases page is the core of SOC operations. To ensure a seamless experience for analysts, both views will remain accessible throughout the transition period. The navigation bar now includes both options: Cases and Cases [Legacy]. Enjoy the enhanced features of the new infrastructure, but if needed, you can easily switch back to the older version at any time.

More information is available on our knowledge base.

Trigger a workflow upon a request to share a resource with the workspace using the Share request created scenario under the System Events trigger. Define the desired logic for handling new share requests and set up an automatic response for the event. Utilize the available steps to accept, deny, retrieve, or remove share requests as needed.

More information is available in our knowledge base.

Torq is always looking for ways to save analysts' time. Our newest update does just that: it reduces cognitive load and minimizes unnecessary workflow executions with a simple checkbox.

Allow analysts to cancel Cases tasks:

• When configuring the settings of an Interaction Flow, you can check the box Allow end-users to cancel tasks.
• Analysts can then "delete" pending tasks and redo the handling process should they need to start handling a case from scratch.
• Upon canceling a pending task, the related workflow execution will also be stopped.

Additionally, we've updated the timeout for tasks and Interaction web pages. Now, you can select to cancel workflow executions entirely upon timeout.

• If a task or web page is not completed or submitted within the set time, the related workflow execution will automatically be stopped.
• To enable the timeout, check the Stop workflow execution box when configuring the Interaction Flow settings.

PS: Check out the new Expand button and start reading tasks without squinting.

You can now save the sorting criteria and order as part of your Cases page view presets.

With this enhancement, presets now include both filter and sorting settings. Create presets to help users easily find and prioritize key cases.

By default, the cases are sorted by severity in descending order.

More information about presets is available in our knowledge base.

If you have the same custom SLA timer across multiple cases, you can start and pause them all in bulk by providing multiple case IDs to the Start Custom SLA Timer and Pause Custom SLA Timer steps.

For example, if your SLA is measured in working days (Monday to Friday, 08:00-17:00) rather than calendar days, you can create workflows to pause the custom SLA for all cases every weekday at 17:00 and resume it every weekday at 08:00.

For more information about custom SLA timers, refer to our knowledge base.

We're thrilled to announce significant upgrades to Torq Interact, designed to streamline your processes and enhance user engagement.

1. Date & Time Parameter: End users can easily select specific dates and times within interactions. For example, they can pinpoint the exact date of a thwarted phishing attempt.
2. Enhanced File Parameter: Users can upload multiple files simultaneously, with each file allowing up to 50MB. This update simplifies the user experience, especially when dealing with an unpredictable amount of files. For any pre-existing workflows utilizing Torq Interact: The Enhanced File parameter updated version requires visiting the Update Steps button in the workflow options. After updating the Interact, you are recommended to rearrange the workflow logic related to uploaded files, due to increased available information and files. If you do not opt-in to update the parameter, your workflow will remain functional as is (though without access to file size information etc.)
3. Download File Parameter: Send files directly to end users for download, either directly or through workflow context.
4. Secondary Button: Add flexibility to your workflows with a secondary button that allows users to submit forms without filling in all required fields, perfect for adapting to various interaction scenarios.

Explore these new features today, and see how Torq is dedicated to improving your Interactions on every end!

We've introduced new integrations for Entro Security, Mensatek, NVIDIA AI Enterprise, Panorays, and sysdig, along with new steps for existing integrations, and various enhancements. For full details, check out the complete digest.

Use table workspace variables to manage data that is best presented in tabular form. These variables enable simple visualization and enhance data clarity and accessibility, streamlining your work and increasing efficiency.

1. Use the Create a Workspace Variable step and select the table data type, or navigate to the Workspace Variables page to create a table workspace variable.
2. Perform actions on tables automatically using workflow steps or manually from the Workspace Variables page.
3. Use the System Events > Variable updated trigger to execute workflows upon table updates.

More information is available in our knowledge base.

Set a condition for which a step will retry - such as step failure, error code return, or other responses. Use this functionality to replace loops and stacked If conditions.

See the step retry condition in action in this Recorded Future Sandbox - File Analysis with Cache template. The Sample Summary step will retry until the set condition is met.

We've added new integrations for Anvilogic, BitSight, Censys, DarkTrace, and PlanHat, along with new steps for existing integrations, including Duo, Google Chronicle, Microsoft Excel, Microsoft OneDrive, Microsoft SharePoint, Palo Alto Networks PAN-OS, Qualys, Veriti, VMRay, Zammad, and Zscaler Internet Access. We've also made various improvements and added new templates. For more details, check out the complete digest.

Customize your steps - and how they run. After creating your own steps with the custom step builder, you can now run them using your configured runners, as you do with the Torq public steps.

Simply add a custom step to your workflow and select your own runner under Execution Options.

In addition to the previously introduced ability to automatically create an integration, you can now automatically update and delete integrations using workflow steps. The new steps are:

• Update an integration
• Delete an integration

For example, the Update an integration step can be used for automatic secret rotation. Use the List integrations step to retrieve the list of workspace integrations, iterate over them, and update the secrets with new values according to the integration type.

Note that custom secrets should be managed with dedicated steps: List secrets and Update a secret.