Local Analysis Malware

Packs/CommonPlaybooks/Playbooks/playbook-Containment_Plan.yml

@@ -2178,7 +2178,7 @@ tasks:
             value:
               simple: WORKSTATION
           ignorecase: true
-      - - operator: isNotEqualString
+      - - operator: isEqualString
           left:
             value:
               complex:
@@ -2187,7 +2187,18 @@ tasks:
             iscontext: true
           right:
             value:
-              simple: "True"
+              simple: AGENT_UNISOLATED
+          ignorecase: true
+      - - operator: isNotEqualString
+          left:
+            value:
+              complex:
+                root: Core.Endpoint
+                accessor: endpoint_status
+            iscontext: true
+          right:
+            value:
+              simple: DISCONNECTED
           ignorecase: true
     - label: Manual
       condition:
@@ -2211,7 +2222,7 @@ tasks:
           right:
             value:
               simple: WORKSTATION
-      - - operator: isNotEqualString
+      - - operator: isEqualString
           left:
             value:
               complex:
@@ -2220,7 +2231,7 @@ tasks:
             iscontext: true
           right:
             value:
-              simple: "true"
+              simple: AGENT_UNISOLATED
           ignorecase: true
     view: |-
       {

Packs/CommonPlaybooks/ReleaseNotes/2_2_5.md

@@ -0,0 +1,4 @@
+
+#### Playbooks
+##### Containment Plan
+- Fixes to Containment Plan playbook conditions.

Packs/CommonPlaybooks/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Common Playbooks",
     "description": "Frequently used playbooks pack.",
     "support": "xsoar",
-    "currentVersion": "2.2.4",
+    "currentVersion": "2.2.5",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/Core/.pack-ignore

@@ -11,4 +11,5 @@ ignore=RM104
 ignore=CJ105
 
 [known_words]
-XSIAM
+XSIAM
+CoreIRApiModule