demisto · OmriItzhak · Feb 11, 2024 · Jan 7, 2024 · Jan 7, 2024 · Jan 7, 2024
@@ -1,4 +1,4 @@
-This playbook handles all the endpoint investigation actions available with Cortex XSIAM, including the following tasks:
+This playbook handles all the endpoint investigation actions by performing the following tasks  on every alert associated with the incident:
 * Pre-defined MITRE Tactics
 * Host fields (Host ID)
 * Attacker fields (Attacker IP, External host)
@@ -8,21 +8,27 @@ This playbook handles all the endpoint investigation actions available with Cort
 Note: The playbook inputs enable manipulating the execution flow; read the input descriptions for details.
 
 ## Dependencies
+
 This playbook uses the following sub-playbooks, integrations, and scripts.
 
 ### Sub-playbooks
+
 This playbook does not use any sub-playbooks.
 
 ### Integrations
+
 This playbook does not use any integrations.
 
 ### Scripts
+
 * SearchIncidentsV2
 
 ### Commands
+
 This playbook does not use any commands.
 
 ## Playbook Inputs
+
 ---
 
 | **Name** | **Description** | **Default Value** | **Required** |
@@ -47,12 +53,14 @@ This playbook does not use any commands.
 | attackerExternalHost | The external host used by the attacker. The 'HuntAttacker' inputs should also be set to True. |  | Optional |
 | mitreTechniqueID | A MITRE technique identifier. The 'HuntByTechnique' inputs should also be set to True. |  | Optional |
 | FileSHA256 | The file SHA256. The 'HuntByFile' inputs should also be set to True. |  | Optional |
-| timeRange | A time range to execute the hunting in.<br/>The input should be in the following format:<br/>\* 1 day ago<br/>\* 2 minutes ago<br/>\* 4 hours ago<br/>\* 8 days ago<br/>etc. | 2 hours ago | Optional |
 
 ## Playbook Outputs
+
 ---
 There are no outputs for this playbook.
 
 ## Playbook Image
+
 ---
-![Endpoint Investigation Plan](../doc_files/Endpoint_Investigation_Plan.png)
+
+![Endpoint Investigation Plan](../doc_files/Endpoint_Investigation_Plan.png)
@@ -0,0 +1,7 @@
+
+#### Playbooks
+
+##### Endpoint Investigation Plan
+
+- Updated the playbook to perform investigation only on the alerts associated with the incident.
+- Removed the unnecessary input 'timeRange'.
@@ -2,7 +2,7 @@
     "name": "Common Playbooks",
     "description": "Frequently used playbooks pack.",
     "support": "xsoar",
-    "currentVersion": "2.6.9",
+    "currentVersion": "2.6.10",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

diff --git a/Packs/Core/Playbooks/playbook-IOC_Alert.yml b/Packs/Core/Playbooks/playbook-IOC_Alert.yml
@@ -566,8 +566,6 @@ tasks:
         complex:
           root: alert
           accessor: agentid
-      timeRange:
-        simple: 2 hours ago
     separatecontext: false
     continueonerrortype: ""
     loop:

diff --git a/Packs/Core/Playbooks/playbook-Local_Analysis_alert_Investigation.yml b/Packs/Core/Playbooks/playbook-Local_Analysis_alert_Investigation.yml
@@ -1116,8 +1116,6 @@ tasks:
         complex:
           root: alert
           accessor: agentid
-      timeRange:
-        simple: 2 hours ago
     separatecontext: false
     loop:
       iscommand: false

diff --git a/Packs/Core/Playbooks/playbook-NGFW_Internal_Scan.yml b/Packs/Core/Playbooks/playbook-NGFW_Internal_Scan.yml
@@ -589,8 +589,6 @@ tasks:
       attackerRemoteIP:
         complex:
           root: inputs.scannerIP
-      timeRange:
-        simple: 24 hours ago
     separatecontext: false
     loop:
       iscommand: false

diff --git a/Packs/Core/Playbooks/playbook-NGFW_Scan.yml b/Packs/Core/Playbooks/playbook-NGFW_Scan.yml
@@ -1061,8 +1061,6 @@ tasks:
       attackerRemoteIP:
         complex:
           root: inputs.scannerIP
-      timeRange:
-        simple: 2 hours ago
     separatecontext: false
     loop:
       iscommand: false

diff --git a/Packs/Core/Playbooks/playbook-Ransomware_Response.yml b/Packs/Core/Playbooks/playbook-Ransomware_Response.yml
@@ -1153,8 +1153,6 @@ tasks:
         complex:
           root: alert
           accessor: agentid
-      timeRange:
-        simple: 2 hours ago
     separatecontext: false
     loop:
       iscommand: false

diff --git a/Packs/Core/Playbooks/playbook-T1036_-_Masquerading.yml b/Packs/Core/Playbooks/playbook-T1036_-_Masquerading.yml
@@ -1228,8 +1228,6 @@ tasks:
         complex:
           root: alert
           accessor: agentid
-      timeRange:
-        simple: 2 hours ago
     separatecontext: true
     loop:
       iscommand: false

diff --git a/Packs/Core/Playbooks/playbook-T1059_-_Command_and_Scripting_Interpreter.yml b/Packs/Core/Playbooks/playbook-T1059_-_Command_and_Scripting_Interpreter.yml
@@ -783,8 +783,6 @@ tasks:
         complex:
           root: alert
           accessor: agentid
-      timeRange:
-        simple: 2 hours ago
     separatecontext: true
     loop:
       iscommand: false

diff --git a/Packs/Core/Playbooks/playbook-WildFire_Malware.yml b/Packs/Core/Playbooks/playbook-WildFire_Malware.yml
@@ -1273,8 +1273,6 @@ tasks:
         complex:
           root: alert
           accessor: agentid
-      timeRange:
-        simple: 24 hours ago
     separatecontext: true
     loop:
       iscommand: false

diff --git a/Packs/Core/ReleaseNotes/3_0_18.md b/Packs/Core/ReleaseNotes/3_0_18.md
@@ -0,0 +1,26 @@
+
+#### Playbooks
+
+##### Ransomware Response
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
+
+##### T1059 - Command and Scripting Interpreter
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
+
+##### IOC Alert
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
+
+##### NGFW Scan
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
+
+##### NGFW Internal Scan
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
+
+##### Local Analysis alert Investigation
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
+
+##### T1036 - Masquerading
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
+
+##### WildFire Malware
+Removed the unnecessary input `timeRange` used by the sub-playbook **Endpoint Investigation Plan**.
diff --git a/Packs/Core/TestPlaybooks/Test_Playbook_-_NGFW_Scan.yml b/Packs/Core/TestPlaybooks/Test_Playbook_-_NGFW_Scan.yml
@@ -625,7 +625,7 @@ tasks:
       AutoCloseAlert:
         simple: "false"
       AutoContainment:
-        simple: "True"
+        simple: "true"
       AutoRecovery:
         simple: "false"
       CommentToAdd:

diff --git a/Packs/Core/pack_metadata.json b/Packs/Core/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Core - Investigation and Response",
     "description": "Automates incident response",
     "support": "xsoar",
-    "currentVersion": "3.0.17",
+    "currentVersion": "3.0.18",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",