Skip to content

Commit

Permalink
Changed the 'key' input value of the 'Get full detection details' task (
Browse files Browse the repository at this point in the history
#27722)

* Changed the 'key' input value of the 'Get full detection details' task

* RN

* Added a a period (.) to the end of the RN line

* changed RN and YML tests configs

* added the 'system: true' to the YML file after it was removed by formatting command
  • Loading branch information
TalNos authored and MosheEichler committed Jul 2, 2023
1 parent c6f326b commit 6567d81
Show file tree
Hide file tree
Showing 4 changed files with 27 additions and 11 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,10 @@ tasks:
continueonerrortype: ""
'1':
id: '1'
taskid: 66b61c68-3550-4853-8519-a14f6d3426a7
taskid: 15d703b6-7cd5-4a4e-856d-11141cec0875
type: condition
task:
id: 66b61c68-3550-4853-8519-a14f6d3426a7
id: 15d703b6-7cd5-4a4e-856d-11141cec0875
version: -1
name: Is policy enabled?
type: condition
Expand Down Expand Up @@ -429,10 +429,10 @@ tasks:
continueonerrortype: ""
'13':
id: '13'
taskid: d4a6ca8c-00c3-4775-89d2-30f986c4a8b1
taskid: 748be87f-33af-415f-8b5a-3fe0bed1677e
type: condition
task:
id: d4a6ca8c-00c3-4775-89d2-30f986c4a8b1
id: 748be87f-33af-415f-8b5a-3fe0bed1677e
version: -1
name: Was process handled?
type: condition
Expand Down Expand Up @@ -679,10 +679,10 @@ tasks:
continueonerrortype: ""
'19':
id: '19'
taskid: f46aa1ab-ee2d-4802-8199-a4b9e5661913
taskid: 282d6e1e-fc71-4571-8089-0ebc1404c838
type: regular
task:
id: f46aa1ab-ee2d-4802-8199-a4b9e5661913
id: 282d6e1e-fc71-4571-8089-0ebc1404c838
version: -1
name: Get full detection details
description: Set a value in context under the key you entered.
Expand All @@ -695,9 +695,10 @@ tasks:
- '1'
scriptarguments:
key:
simple: Detection.Behavior.pattern_disposition_details
simple: Detection.Behavior
value:
simple: ${inputs.PolicyBehaviourDetails}
complex:
root: inputs.PolicyBehaviourDetails
separatecontext: false
view: |-
{
Expand Down Expand Up @@ -788,4 +789,4 @@ tests:
fromversion: 6.5.0
contentitemexportablefields:
contentitemfields: {}
system: true
system: true
Original file line number Diff line number Diff line change
Expand Up @@ -2,28 +2,35 @@ This playbook is part of the 'Malware Investigation And Response' pack. For more
This playbook verifies and sets the policy actions applied by CrowdStrike Falcon.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

This playbook does not use any integrations.

### Scripts
Set

* Set

### Commands

This playbook does not use any commands.

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| PolicyBehaviourDetails | The path that contains the detection results. | | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
Expand All @@ -33,5 +40,7 @@ This playbook does not use any commands.
| Process.State | Was the process contained? | string |

## Playbook Image

---

![CrowdStrike Falcon Malware - Verify Containment Actions](../doc_files/CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions.png)
6 changes: 6 additions & 0 deletions Packs/CrowdStrikeFalcon/ReleaseNotes/1_10_27.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Playbooks

##### CrowdStrike Falcon Malware - Verify Containment Actions

- Fixed an issue with the *'Get full detection details'* task's key.
2 changes: 1 addition & 1 deletion Packs/CrowdStrikeFalcon/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "CrowdStrike Falcon",
"description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.",
"support": "xsoar",
"currentVersion": "1.10.26",
"currentVersion": "1.10.27",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down

0 comments on commit 6567d81

Please sign in to comment.