Merge branch 'master' into ciac-8764/generalize_mode_option_in_pre_co…

…mmit

Packs/BeyondTrustPrivilegedRemoteAccess/pack_metadata.json

@@ -11,7 +11,7 @@
     ],
     "tags": [],
     "useCases": [],
-    "keywords": ["BeyondTrust", "Beyond Trust", "Beyond", "Remote Access", "Privileged Remote Access", "PRA", "Privileged", "Remote Support", "Remote"],
+    "keywords": ["BeyondTrust", "Beyond Trust", "Beyond", "Remote Access", "Privileged Remote Access", "PRA", "Privileged"],
     "marketplaces": [
         "marketplacev2"
     ]

Packs/CommonPlaybooks/Playbooks/playbook-Get_host_forensics_-_Generic.yml

@@ -1,9 +1,7 @@
 id: 'Get host forensics - Generic'
 version: -1
 name: 'Get host forensics - Generic'
-description: "This playbook retrieves forensics from hosts for the following integrations:\n
-- Illusive Networks \n
-- Microsoft Defender For Endpoint"
+description: "This playbook retrieves forensics from hosts for the following integrations:\n - Illusive Networks \n - Microsoft Defender For Endpoint."
 starttaskid: "0"
 tasks:
   "0":
@@ -36,6 +34,7 @@ tasks:
     quietmode: 0
     isoversize: false
     isautoswitchedtoquietmode: false
+    continueonerrortype: ""
   "2":
     id: "2"
     taskid: 44e2bef7-db14-418e-8899-05b87ce087c1
@@ -74,6 +73,7 @@ tasks:
     quietmode: 0
     isoversize: false
     isautoswitchedtoquietmode: false
+    continueonerrortype: ""
   "3":
     id: "3"
     taskid: a407e17a-7005-4b1a-87c0-00e1e1c2cae2
@@ -101,6 +101,7 @@ tasks:
     quietmode: 0
     isoversize: false
     isautoswitchedtoquietmode: false
+    continueonerrortype: ""
   "4":
     id: "4"
     taskid: 4e87acfb-c838-448f-8c35-a81c306b37bf
@@ -144,6 +145,7 @@ tasks:
     quietmode: 0
     isoversize: false
     isautoswitchedtoquietmode: false
+    continueonerrortype: ""
   "5":
     id: "5"
     taskid: c7004145-36f8-47b3-8bbf-b08852b7b00c
@@ -182,6 +184,7 @@ tasks:
     quietmode: 0
     isoversize: false
     isautoswitchedtoquietmode: false
+    continueonerrortype: ""
   "6":
     id: "6"
     taskid: 1fb6f15e-7c4b-429b-8974-e30dcac00512
@@ -190,9 +193,7 @@ tasks:
       id: 1fb6f15e-7c4b-429b-8974-e30dcac00512
       version: -1
       name: 'Microsoft Defender For Endpoint - Collect investigation package'
-      description: "This playbook simplifies retrieving investigation packages to Cortex XSOAR from supported machines (See https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/collect-investigation-package?view=o365-worldwide). \n\n
-      The playbook receives information about the target devices (host name, IP, and device ID), validates the devices exist, and retrieves the collection package from those machines into the Cortex XSOAR console. \n 
-      Note: This action may take time, the average package size is around ~15 MB."
+      description: "This playbook simplifies retrieving investigation packages to Cortex XSOAR from supported machines (See https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/collect-investigation-package?view=o365-worldwide). \n\n The playbook receives information about the target devices (host name, IP, and device ID), validates the devices exist, and retrieves the collection package from those machines into the Cortex XSOAR console. \n Note: This action may take time, the average package size is around ~15 MB."
       playbookName: 'Microsoft Defender For Endpoint - Collect investigation package'
       type: playbook
       iscommand: false
@@ -229,6 +230,7 @@ tasks:
     quietmode: 0
     isoversize: false
     isautoswitchedtoquietmode: false
+    continueonerrortype: ""
 view: |-
   {
     "linkLabelsPosition": {},
@@ -261,8 +263,36 @@ inputs:
   value: {}
   required: false
   description: Provide the machine IDs of the systems you want to retrieve.
-  playbookInputQuery: null
-outputs: []
+  playbookInputQuery:
+outputs:
+- contextPath: MicrosoftATP
+  description: An object containing the machine action details.
+  type: unknown
+- contextPath: MicrosoftATP.MachineAction
+  description: Microsoft Defender For Endpoint machine action details.
+  type: unknown
+- contextPath: Illusive.Forensics.Evidence
+  description: An object containing evidence from Illusive Networks.
+  type: unknown
+- contextPath: Illusive.Forensics.Evidence.details
+  description: The forensics evidence details.
+- contextPath: Illusive.Forensics.Evidence.eventId
+  description: The event ID.
+- contextPath: Illusive.Forensics.Evidence.id
+  description: The forensics evidence ID.
+- contextPath: Illusive.Forensics.Evidence.source
+  description: The evidence source.
+- contextPath: Illusive.Forensics.Evidence.starred
+  description: Whether the forensics evidence has been starred.
+- contextPath: Illusive.Forensics.Evidence.time
+  description: 'Date and time of the forensics evidence. '
+- contextPath: Illusive.Forensics.Evidence.title
+  description: The forensics evidence description.
+- contextPath: Illusive.Forensics
+  description: Ab object containing the Incident ID in Illusive Networks.
+  type: unknown
+- contextPath: Illusive.Forensics.IncidentId
+  description: The incident ID.
 tests:
 - No tests (auto formatted)
 fromversion: 6.0.0

Packs/CommonPlaybooks/Playbooks/playbook-Get_host_forensics_-_Generic_README.md

@@ -1,37 +1,60 @@
 This playbook retrieves forensics from hosts for the following integrations:
-- Illusive Networks 
-- Microsoft Defender For Endpoint
+ - Illusive Networks 
+ - Microsoft Defender For Endpoint.
 
 ## Dependencies
+
 This playbook uses the following sub-playbooks, integrations, and scripts.
 
 ### Sub-playbooks
+
 * Illusive-Collect-Forensics-On-Demand
 * Microsoft Defender For Endpoint - Collect investigation package
 
 ### Integrations
+
 This playbook does not use any integrations.
 
 ### Scripts
-IsIntegrationAvailable
+
+* IsIntegrationAvailable
 
 ### Commands
+
 This playbook does not use any commands.
 
 ## Playbook Inputs
+
 ---
 
 | **Name** | **Description** | **Default Value** | **Required** |
 | --- | --- | --- | --- |
 | fqdn_or_ip | If using the Illusive Networks integration to retrieve additional forensics, provide the host fqdn_or_ip from which to get the forensics.  |  | Optional |
 | start_date | Date_range must be "number date_range_unit", for example 2 hours, 4 minutes, 6 months, 1 day. |  | Optional |
 | end_date | Date_range must be "number date_range_unit" for example 2 hours, 4 minutes, 6 months, 1 day. |  | Optional |
-| machine_ID | The machine IDs of the systems you want to retrieve. |  | Optional |
+| machine_ID | Provide the machine IDs of the systems you want to retrieve. |  | Optional |
 
 ## Playbook Outputs
+
 ---
-There are no outputs for this playbook.
+
+| **Path** | **Description** | **Type** |
+| --- | --- | --- |
+| MicrosoftATP | An object containing the machine action details. | unknown |
+| MicrosoftATP.MachineAction | Microsoft Defender For Endpoint machine action details. | unknown |
+| Illusive.Forensics.Evidence | An object containing evidence from Illusive Networks. | unknown |
+| Illusive.Forensics.Evidence.details | The forensics evidence details. | unknown |
+| Illusive.Forensics.Evidence.eventId | The event ID. | unknown |
+| Illusive.Forensics.Evidence.id | The forensics evidence ID. | unknown |
+| Illusive.Forensics.Evidence.source | The evidence source. | unknown |
+| Illusive.Forensics.Evidence.starred | Whether the forensics evidence has been starred. | unknown |
+| Illusive.Forensics.Evidence.time | Date and time of the forensics evidence.  | unknown |
+| Illusive.Forensics.Evidence.title | The forensics evidence description. | unknown |
+| Illusive.Forensics | Ab object containing the Incident ID in Illusive Networks. | unknown |
+| Illusive.Forensics.IncidentId | The incident ID. | unknown |
 
 ## Playbook Image
+
 ---
+
 ![Get host forensics - Generic](../doc_files/Get_host_forensics_-_Generic.png)

Packs/CommonPlaybooks/ReleaseNotes/2_4_25.md

@@ -0,0 +1,6 @@
+
+#### Playbooks
+
+##### Get host forensics - Generic
+
+Added investigation data and forensics to the outputs of the playbook.

Packs/CommonPlaybooks/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Common Playbooks",
     "description": "Frequently used playbooks pack.",
     "support": "xsoar",
-    "currentVersion": "2.4.24",
+    "currentVersion": "2.4.25",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/Jira/Integrations/JiraV2/JiraV2.py

@@ -800,14 +800,14 @@ def add_user_to_project_command(user_email, project_key, role_name):
     return jira_req('POST', url, json.dumps(json_data)).text
 
 
-def edit_issue_command(issue_id, mirroring=False, headers=None, status=None, transition=None, **kwargs):
+def edit_issue_command(issue_id, mirroring=False, headers=None, status=None, transition=None, resolution=None, **kwargs):
     issue = get_issue_fields(mirroring=mirroring, **kwargs)
     if status and transition:
         return_error("Please provide only status or transition, but not both.")
     elif status:
-        edit_status(issue_id, status, issue)
+        edit_status(issue_id, status, issue, resolution)
     elif transition:
-        edit_transition(issue_id, transition, issue)
+        edit_transition(issue_id, transition, issue, resolution)
     else:
         url = f'rest/api/latest/issue/{issue_id}/'
         jira_req('PUT', url, json.dumps(issue))
@@ -901,7 +901,7 @@ def __create_value_by_type(type, value):
         raise DemistoException(f"Command only support string or array-typed fields. Field given is typed {type}")
 
 
-def edit_status(issue_id, status, issue):
+def edit_status(issue_id, status, issue, resolution=None):
     # check for all authorized transitions available for this user
     # if the requested transition is available, execute it.
     if not issue:
@@ -913,6 +913,11 @@ def edit_status(issue_id, status, issue):
         if transition.lower() == status.lower():
             url = f'rest/api/latest/issue/{issue_id}/transitions?expand=transitions.fields'
             issue['transition'] = {"id": str(j_res.get('transitions')[i].get('id'))}
+            if resolution:
+                if issue.get('fields'):
+                    issue['fields'].update({"resolution": {'name': resolution}})
+                else:
+                    issue['fields'] = {"resolution": {'name': resolution}}
             return jira_req('POST', url, json.dumps(issue))
 
     return_error(f'Status "{status}" not found. \nValid statuses are: {statuses} \n')
@@ -929,7 +934,7 @@ def list_transitions_data_for_issue(issue_id):
     return jira_req('GET', url, resp_type='json')
 
 
-def edit_transition(issue_id, transition_name, issue):
+def edit_transition(issue_id, transition_name, issue, resolution=None):
     """
     This function changes a transition for a given issue.
     :param issue_id: The ID of the issue.
@@ -944,6 +949,11 @@ def edit_transition(issue_id, transition_name, issue):
         if transition.get('name') == transition_name:
             url = f'rest/api/latest/issue/{issue_id}/transitions?expand=transitions.fields'
             issue['transition'] = {"id": transition.get("id")}
+            if resolution:
+                if issue.get('fields'):
+                    issue['fields'].update({"resolution": {'name': resolution}})
+                else:
+                    issue['fields'] = {"resolution": {'name': resolution}}
             return jira_req('POST', url, json.dumps(issue))
 
     return_error(f'Transitions "{transition_name}" not found. \nValid transitions are: {transitions_data} \n')

Packs/Jira/Integrations/JiraV2/JiraV2.yml

@@ -402,6 +402,8 @@ script:
     - description: The component names of the issue. For example components="component1,component2".
       isArray: true
       name: components
+    - description: Resolution to update in the issue, to be used when transitioning to a closed status.
+      name: resolution
     description: Modifies an issue in Jira.
     name: jira-edit-issue
     outputs:

Packs/Jira/ReleaseNotes/3_1_5.md

@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### Atlassian Jira v2 (Deprecated)
+
+- Added the **resolution** argument to the ***jira-edit-issue*** command when closing an issue.

Packs/Jira/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Atlassian Jira",
     "description": "Use the Jira integration to manage issues and create Cortex XSOAR incidents from Jira projects.",
     "support": "xsoar",
-    "currentVersion": "3.1.4",
+    "currentVersion": "3.1.5",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/Reco/Integrations/Reco/README.md

@@ -328,3 +328,30 @@ update alert status in Reco
 #### Context Output
 
 There is no context output for this command.
+
+### reco-get-user-context-by-email-address
+
+***
+Get user context by email address from Reco.
+
+#### Base Command
+
+`reco-get-user-context-by-email-address`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| email_address | user email address. | Required | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| Reco.User.email_account | String | The email of the user. | 
+| Reco.User.departments | String | User departments. | 
+| Reco.User.job_titles | String | Job Title. | 
+| Reco.User.category | String | Category. | 
+| Reco.User.groups | String | The groups user is member of. | 
+| Reco.User.full_name | String | The user full name. | 
+| Reco.User.labels | Unknown | User Labels. |