Fix search hash in sandbox generic cs falcon (demisto#33719)

* Added limit for each report to be retrieved on a hash + removed the transformer "firstarrayelment" * Added limit for each report to be retrieved on a hash + removed the transformer "firstarrayelment" * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <[email protected]> --------- Co-authored-by: ShirleyDenkberg <[email protected]>
SEKOIA-IO · Apr 7, 2024 · 7404408 · 7404408
1 parent 0de2c34
commit 7404408
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 4 deletions.
diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Search_For_Hash_In_Sandbox_-_Generic.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Search_For_Hash_In_Sandbox_-_Generic.yml
@@ -181,6 +181,8 @@ tasks:
           root: inputs.FileSha256
           transformers:
           - operator: uniq
+      limit:
+        simple: "1"
     separatecontext: false
     view: |-
       {
@@ -289,10 +291,10 @@ tasks:
         simple: "true"
       ids:
         complex:
-          root: csfalconx.resource.FindReport
-          accessor: reportIds
+          root: csfalconx.resource
+          accessor: resources
           transformers:
-          - operator: FirstArrayElement
+          - operator: uniq
     separatecontext: false
     view: |-
       {

diff --git a/Packs/CommonPlaybooks/ReleaseNotes/2_6_27.md b/Packs/CommonPlaybooks/ReleaseNotes/2_6_27.md
@@ -0,0 +1,6 @@
+
+#### Playbooks
+
+##### Search For Hash In Sandbox - Generic
+
+Fixed an issue where a CrowdStrike report was retrieved only for a single SH256 file instead of for multiple SH256 files.
diff --git a/Packs/CommonPlaybooks/pack_metadata.json b/Packs/CommonPlaybooks/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Common Playbooks",
     "description": "Frequently used playbooks pack.",
     "support": "xsoar",
-    "currentVersion": "2.6.26",
+    "currentVersion": "2.6.27",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",