Containment plan fix

Packs/CommonPlaybooks/Playbooks/playbook-Containment_Plan.yml

@@ -506,7 +506,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:
@@ -584,7 +586,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:
@@ -615,7 +619,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:
@@ -727,7 +733,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:
@@ -761,7 +769,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:
@@ -873,7 +883,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:
@@ -942,7 +954,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:
@@ -973,7 +987,9 @@ tasks:
                   simple: inputs.AutoContainment
                 iscontext: true
               lhsB: {}
-              options: {}
+              options:
+                value:
+                  simple: case_insensitive
               optionsB: {}
               rhs:
                 value:

Packs/CommonPlaybooks/Playbooks/playbook-Containment_Plan_-_Isolate_Device.yml

@@ -28,7 +28,7 @@ tasks:
       {
         "position": {
           "x": 490,
-          "y": -782
+          "y": -812
         }
       }
     note: false
@@ -176,7 +176,7 @@ tasks:
       {
         "position": {
           "x": 30,
-          "y": -454
+          "y": -484
         }
       }
     note: false
@@ -403,31 +403,35 @@ tasks:
     nexttasks:
       '#default#':
       - "10"
-      "yes":
-      - "24"
+      Endpoint ID:
       - "13"
+      Endpoint Name:
+      - "24"
     separatecontext: false
     conditions:
-    - label: "yes"
+    - label: Endpoint ID
       condition:
       - - operator: isNotEmpty
           left:
             value:
               complex:
                 root: inputs.EndpointID
             iscontext: true
-        - operator: isNotEmpty
+          right:
+            value: {}
+    - label: Endpoint Name
+      condition:
+      - - operator: isNotEmpty
           left:
             value:
-              complex:
-                root: inputs.EndpointHostName
+              simple: inputs.EndpointHostName
             iscontext: true
     continueonerrortype: ""
     view: |-
       {
         "position": {
           "x": 490,
-          "y": -653
+          "y": -683
         }
       }
     note: false
@@ -470,7 +474,7 @@ tasks:
       {
         "position": {
           "x": 490,
-          "y": -454
+          "y": -484
         }
       }
     note: false
@@ -536,10 +540,10 @@ view: |-
     },
     "paper": {
       "dimensions": {
-        "height": 1286,
-        "width": 841,
+        "height": 1316,
+        "width": 840,
         "x": 30,
-        "y": -782
+        "y": -812
       }
     }
   }

Packs/CommonPlaybooks/ReleaseNotes/2_7_36.md

@@ -0,0 +1,10 @@
+
+#### Playbooks
+
+##### Containment Plan - Isolate Device
+
+- Fixed endpoint isolation condition logic: isolation now triggers when **either** an Endpoint ID **or** an Endpoint Hostname is provided, instead of requiring both simultaneously.
+
+##### Containment Plan
+
+- Added case-insensitive comparison for the **AutoContainment** input condition checks, ensuring the playbook correctly handles 'True or 'False' values regardless of casing.

Packs/CommonPlaybooks/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Common Playbooks",
     "description": "Frequently used playbooks pack.",
     "support": "xsoar",
-    "currentVersion": "2.7.35",
+    "currentVersion": "2.7.36",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/Core/.pack-ignore

@@ -41,6 +41,12 @@ ignore=SC105
 [file:CoreUnisolateEndpoint.yml]
 ignore=SC105
 
+[file:playbook-T1059_-_Command_and_Scripting_Interpreter.yml]
+ignore=GR109
+
+[file:playbook-T1036_-_Masquerading.yml]
+ignore=GR109
+
 [known_words]
 xsiam
 coreirapimodule

Packs/Core/Playbooks/playbook-T1036_-_Masquerading.yml

@@ -813,7 +813,7 @@ tasks:
               applyIfEmpty: {}
               defaultValue:
                 value:
-                  simple: "true"
+                  simple: "false"
       BlockIndicators:
         simple: "True"
       ClearUserSessions:

Packs/Core/Playbooks/playbook-T1059_-_Command_and_Scripting_Interpreter.yml

@@ -839,7 +839,7 @@ tasks:
               applyIfEmpty: {}
               defaultValue:
                 value:
-                  simple: "true"
+                  simple: "false"
       BlockIndicators:
         simple: "True"
       ClearUserSessions:
@@ -879,7 +879,7 @@ tasks:
                 applyIfEmpty: {}
                 defaultValue:
                   value:
-                    simple: "true"
+                    simple: "false"
         BlockIndicators:
           simple: "True"
         ClearUserSessions:

Packs/Core/ReleaseNotes/3_5_49.md

@@ -0,0 +1,10 @@
+
+#### Playbooks
+
+##### T1059 - Command and Scripting Interpreter
+
+- Fixed the default value of the **AutoContainment** input passed to the *Containment Plan* sub-playbook from 'true' to 'false'.
+
+##### T1036 - Masquerading
+
+- Fixed the default value of the **AutoContainment** input passed to the *Containment Plan* sub-playbook from 'true' to 'false'.

Packs/Core/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Core",
     "description": "Automates incident response",
     "support": "xsoar",
-    "currentVersion": "3.5.48",
+    "currentVersion": "3.5.49",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",