diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions.yml b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions.yml index c29ad3f042b4..eccbce638929 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions.yml +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions.yml @@ -38,10 +38,10 @@ tasks: continueonerrortype: "" '1': id: '1' - taskid: 66b61c68-3550-4853-8519-a14f6d3426a7 + taskid: 15d703b6-7cd5-4a4e-856d-11141cec0875 type: condition task: - id: 66b61c68-3550-4853-8519-a14f6d3426a7 + id: 15d703b6-7cd5-4a4e-856d-11141cec0875 version: -1 name: Is policy enabled? type: condition @@ -429,10 +429,10 @@ tasks: continueonerrortype: "" '13': id: '13' - taskid: d4a6ca8c-00c3-4775-89d2-30f986c4a8b1 + taskid: 748be87f-33af-415f-8b5a-3fe0bed1677e type: condition task: - id: d4a6ca8c-00c3-4775-89d2-30f986c4a8b1 + id: 748be87f-33af-415f-8b5a-3fe0bed1677e version: -1 name: Was process handled? type: condition @@ -679,10 +679,10 @@ tasks: continueonerrortype: "" '19': id: '19' - taskid: f46aa1ab-ee2d-4802-8199-a4b9e5661913 + taskid: 282d6e1e-fc71-4571-8089-0ebc1404c838 type: regular task: - id: f46aa1ab-ee2d-4802-8199-a4b9e5661913 + id: 282d6e1e-fc71-4571-8089-0ebc1404c838 version: -1 name: Get full detection details description: Set a value in context under the key you entered. @@ -695,9 +695,10 @@ tasks: - '1' scriptarguments: key: - simple: Detection.Behavior.pattern_disposition_details + simple: Detection.Behavior value: - simple: ${inputs.PolicyBehaviourDetails} + complex: + root: inputs.PolicyBehaviourDetails separatecontext: false view: |- { @@ -788,4 +789,4 @@ tests: fromversion: 6.5.0 contentitemexportablefields: contentitemfields: {} -system: true +system: true \ No newline at end of file diff --git a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions_README.md b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions_README.md index 6d1b768a164f..790915ff31e1 100644 --- a/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions_README.md +++ b/Packs/CrowdStrikeFalcon/Playbooks/playbook-CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions_README.md @@ -2,21 +2,27 @@ This playbook is part of the 'Malware Investigation And Response' pack. For more This playbook verifies and sets the policy actions applied by CrowdStrike Falcon. ## Dependencies + This playbook uses the following sub-playbooks, integrations, and scripts. ### Sub-playbooks + This playbook does not use any sub-playbooks. ### Integrations + This playbook does not use any integrations. ### Scripts -Set + +* Set ### Commands + This playbook does not use any commands. ## Playbook Inputs + --- | **Name** | **Description** | **Default Value** | **Required** | @@ -24,6 +30,7 @@ This playbook does not use any commands. | PolicyBehaviourDetails | The path that contains the detection results. | | Optional | ## Playbook Outputs + --- | **Path** | **Description** | **Type** | @@ -33,5 +40,7 @@ This playbook does not use any commands. | Process.State | Was the process contained? | string | ## Playbook Image + --- + ![CrowdStrike Falcon Malware - Verify Containment Actions](../doc_files/CrowdStrike_Falcon_Malware_-_Verify_Containment_Actions.png) diff --git a/Packs/CrowdStrikeFalcon/ReleaseNotes/1_10_27.md b/Packs/CrowdStrikeFalcon/ReleaseNotes/1_10_27.md new file mode 100644 index 000000000000..11752930ac90 --- /dev/null +++ b/Packs/CrowdStrikeFalcon/ReleaseNotes/1_10_27.md @@ -0,0 +1,6 @@ + +#### Playbooks + +##### CrowdStrike Falcon Malware - Verify Containment Actions + +- Fixed an issue with the *'Get full detection details'* task's key. diff --git a/Packs/CrowdStrikeFalcon/pack_metadata.json b/Packs/CrowdStrikeFalcon/pack_metadata.json index 8b3e1dbd300c..a6f8ee4060b1 100644 --- a/Packs/CrowdStrikeFalcon/pack_metadata.json +++ b/Packs/CrowdStrikeFalcon/pack_metadata.json @@ -2,7 +2,7 @@ "name": "CrowdStrike Falcon", "description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.", "support": "xsoar", - "currentVersion": "1.10.26", + "currentVersion": "1.10.27", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",