[Playbook] Deactivating the detection field on Indicator does not work

[Lhorus6]

Description

When I try to deactivate / set to false the detection field of an Indicator, the playbook runs until the end but the detection field remains at “true”.

I can see in the execution traces that in the bundle sent for ingestion, the field is set to true, so the playbook component doesn't seem to be doing anything.

Environment

OCTI 6.3.4

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Create this playbook

Listener

Manipulate

Send for ingestion

2. Switch the detection field of an Indicator to "true"
3. Apply the label "test"
4. Check out the playbook. It ran but did not modify the detection field.

[romain-filigran]

Reproduced