Absolute

Absolute is an adaptive endpoint security solution that delivers device security, data security, and asset management of endpoints.

Endpoint · Absolute

Details

IDAbsolute
ProviderAbsolute Software
CategoryEndpoint
From Version6.0.0
Docker Imagedemisto/auth-utils:1.0.0.10133006
Supported ModulesAgentix XSIAM

README

Absolute is an adaptive endpoint security solution that delivers device security, data security, and asset management of endpoints.
This integration was integrated and tested with the API version 1.7 of Absolute.

Some changes have been made that might affect your existing content.
If you are upgrading from a previous version of this integration, see Breaking Changes.

Configure Absolute in Cortex

Parameter Description Required
Your Absolute server URL   True
Token ID Token ID and Secret Key. True
Secret Key   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Events Fetch Interval Only in XSIAM False
Max number of events per fetch Only in XSIAM False
Fetch Events Only in XSIAM False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

absolute-custom-device-field-list

Returns a list of custom device fields associated with the given device_id, based on the authorization token.

Base Command

absolute-custom-device-field-list

Input

Argument Name Description Required
device_id The system unique identifier of the device. Required
limit Maximum number of results to return. Default is 50. Optional
all_results Whether to retrieve all results or not. Possible values are: true, false. Optional

Context Output

Path Type Description
Absolute.CustomDeviceField.DeviceUID String The system-defined unique identifier of the device.
Absolute.CustomDeviceField.CDFValues.CDFUID String The unique identifier of the custom device field.
Absolute.CustomDeviceField.CDFValues.FieldKey String The unique identifier of the custom device field in the classic version of Absolute.
Absolute.CustomDeviceField.CDFValues.FieldName String The name assigned to the custom device field.
Absolute.CustomDeviceField.CDFValues.CategoryCode String The type of custom device field. Possible values are: PREDEFINED, ESNCOLUMN, UDF.
Absolute.CustomDeviceField.CDFValues.FieldValue String The current value of the custom device field.
Absolute.CustomDeviceField.CDFValues.Type String The data type of the field value. Possible values are: Text, Date, Dropdown.

Command example

!absolute-custom-device-field-list device_id=1234

Context Example

{
    "Absolute": {
        "CustomDeviceField": {
            "CDFValues": [
                {
                    "CDFUID": "4m9fUCZqTYec1bJgDSNg",
                    "CategoryCode": "ESNCOLUMN",
                    "FieldKey": 1,
                    "FieldName": "Asset Number",
                    "FieldValue": "aa",
                    "Type": "Text"
                },
                {
                    "CDFUID": "2iS3ryiSvSDsksJ289vtQ",
                    "CategoryCode": "UDF",
                    "FieldKey": 30,
                    "FieldName": "Custom2",
                    "FieldValue": "TPB",
                    "Type": "Text"
                }
            ],
            "DeviceUID": "1234"
        }
    }
}

Human Readable Output

Absolute Custom device field list

CDF ID Field Value Filed Name
4m9fUCZqTYec1bJgDSNg Asset Number Asset Number
2iS3ryiSvSDsksJ289vtQ Custom2 Custom2

absolute-custom-device-field-update

Updates the value of the included custom device fields for the given device_id.

Base Command

absolute-custom-device-field-update

Input

Argument Name Description Required
device_id The system unique identifier of the device. Required
cdf_uid The unique identifier of the custom device field. Note: In order to get this value, use the “absolute-custom-device-field-list” command. Required
value The new value of the custom device field to be set. Required

Context Output

There is no context output for this command.

Command example

!absolute-custom-device-field-update device_id=1234 cdf_uid=4m9fUCZqTYec1bJgDSNg value="test2"

Human Readable Output

Device 1234 with value test2 was updated successfully.

absolute-device-freeze-request

Creates a new Freeze request for the devices specified in the device_ids argument.

Base Command

absolute-device-freeze-request

Input

Argument Name Description Required
device_ids A comma-separated list of the unique identifiers of devices included in the request. The recommendation is to use up to 10,000 devices per request. Required
request_name The user-defined name for the Freeze request. The name should be a non-unique string and has 1-250 characters. Required
html_message The user-defined, HTML coded message shown on devices when the Freeze is applied. The message should be in a non-unique HTML format and has 1-4000 characters. Required
message_name The user-defined name for the Freeze message. Required
device_freeze_type The type of Freeze. You cannot freeze a device that has been reported Stolen in the Absolute console.
- OnDemand: Freezes a device on its next connection to the Absolute Monitoring Center, which is typically within 15 minutes. This applies for all supported operating systems.
- Scheduled: Freezes a device on its next connection to the Absolute Monitoring Center on or after a specified date and time. This applies to Windows and Mac devices. The scheduled freeze date is specified in the scheduled_freeze_date argument. Scheduled Freeze requests are only supported on Windows and Mac devices with an active Absolute agent that is regularly connecting to the Absolute Monitoring Center.
- Offline: Freezes a device if it has been offline for a specified period of time. Applies to Windows and Mac devices. Offline period is specified in the offline_time_seconds arguments. Offline freeze is not available if your Absolute account has been migrated to Offline Freeze Rules. For more information, see the console Help.
Possible values are: OnDemand, Scheduled, Offline.		 Required
scheduled_freeze_date The date and time (in UTC) when the device should be frozen in ISO 8601 format: YYYY-MM-DDThh:mm:ss.SSSZ. Required if device_freeze_type is Scheduled. For example, 2022-01-01T00:00:00.000Z. Optional
offline_time_seconds The length of time (in seconds) that a device can be offline before the device is frozen. Required if device_freeze_type is Offline. Must be between 1200 seconds (20 minutes) and 172800000 seconds (2000 days). Default value is 30 days. Default is 22592000. Optional
passcode_type The type of passcode to unfreeze a device.
- UserDefined: Manually set the passcode in passcode. You must specify the passcode argument.
- RandomForEach: A unique passcode is randomly generated for each device. You must specify the passcode_length argument.
- RandomForAll: A passcode is randomly generated and is the same for all devices. You must specify the passcode_length argument. Possible values are: UserDefined, RandomForEach, RandomForAll.		 Required
passcode The passcode used to unfreeze the devices. Required if passcode_type is UserDefined. A valid passcode is a number that has 4-8 characters. For example, 12345678. Optional
passcode_length The length of the passcode when it is randomly generated. Required if passcode_type is RandomForEach or RandomForAll. A valid passcode is a number from 4-8. For example, 8. Optional
notification_emails A comma-separated list of user-entered email addresses that will receive an email notification when the status of the Freeze request changes. The API supports up to 10 email addresses. Optional

Context Output

Path Type Description
Absolute.FreezeRequest.RequestUID String The system-defined, unique identifier of the Freeze request.
Absolute.FreezeRequest.SucceededDeviceUIDs Unknown An array of the unique devices identifiers that succeeded in creating a Freeze request.
Absolute.FreezeRequest.Errors.detail.deviceUids Unknown An array of the unique identifiers of devices for the Freeze request error.
Absolute.FreezeRequest.Errors.message String The reason for the Freeze failure.
Absolute.FreezeRequest.Errors.messageKey String The reference key for the error message.

Command example

!absolute-device-freeze-request device_ids=123456 device_freeze_type=Scheduled html_message="test" message_name="new name" request_name="name1" scheduled_freeze_date=2022-04-03T13:30:00.000Z passcode_type=RandomForEach passcode_length=5

Context Example

{
    "Absolute": {
        "FreezeRequest": {
            "RequestUID": "2b62b290-d590-4237-8ba0-57e4779b9f1c",
            "SucceededDeviceUIDs": [
                "123456"
            ]
        }
    }
}

Human Readable Output

Absolute device freeze requests results

RequestUID SucceededDeviceUIDs
2b62b290-d590-4237-8ba0-57e4779b9f1c 123456

absolute-device-remove-freeze-request

Creates a new Remove Freeze request for one or more devices, regardless of their Freeze status. You can submit Remove Freeze requests to perform the following actions: unfreeze frozen devices, remove newly submitted Freeze requests, or remove outstanding Scheduled and Offline Freeze requests. In case of removing from offline: In addition to creating a Remove Freeze request for devices with a status of Frozen by Condition: Offline, removes Offline Freeze requests from devices with a status of Freeze Requested or Freeze Condition - Offline Set. In case of not removing from offline: a Remove Freeze request is created for the devices but the Conditional - Offline Freeze request is not deleted (deprecated).

Base Command

absolute-device-remove-freeze-request

Input

Argument Name Description Required
device_ids A comma-separated list of the unique identifiers of devices included in the request. The recommendation is to use up to 10,000 devices per request. Required
remove_scheduled Whether to remove only a Scheduled Freeze request. Note: When setting to true, if the Freeze request is a Scheduled Freeze request, the Freeze request is removed. Otherwise, when setting to false, if the Freeze request is not a Scheduled Freeze request, the Freeze request is not removed. Possible values are: true, false. Optional
remove_offline Whether to remove only an Offline Freeze request. Note: When setting to true, if the Freeze request is an Offline Freeze request, the Freeze request is removed. Otherwise, when setting to false, if the Freeze request is not a Offline Freeze request, the Freeze request is not removed. Possible values are: true, false. Optional

Context Output

There is no context output for this command.

Command example

!absolute-device-remove-freeze-request device_ids=123456 remove_scheduled=true

Human Readable Output

Successfully removed freeze request for devices ids: 123456.

absolute-device-freeze-request-get

Gets detailed information about the Freeze request specified by request_uid.

Base Command

absolute-device-freeze-request-get

Input

Argument Name Description Required
request_uid The system-defined, unique identifier of the Freeze request. Required

Context Output

Path Type Description
Absolute.FreezeRequestDetail.ID String The system-defined, unique identifier of the Freeze request.
Absolute.FreezeRequestDetail.AccountUid String The system-defined, unique identifier associated with this Absolute account.
Absolute.FreezeRequestDetail.ActionRequestUid String The system-defined, unique identifier of the Freeze request (the same as ID).
Absolute.FreezeRequestDetail.DeviceUid String The system-defined, unique identifier of the device.
Absolute.FreezeRequestDetail.Statuses.actionUid String The system-defined, unique identifier of the Freeze action.
Absolute.FreezeRequestDetail.Statuses.messageKey String The reference key for the error message or the info message. Error messages start with ‘dds’. Info messages start with ‘ddsui’.
Absolute.FreezeRequestDetail.Statuses.messageParams Unknown A list of strings describing the error message when the status is LaunchFailed. If the status isn’t LaunchFailed, messageParams is empty.
Absolute.FreezeRequestDetail.Statuses.message String The message for the status change that occurred.
Absolute.FreezeRequestDetail.Statuses.updatedBy String The last entity to update the Freeze request.
Absolute.FreezeRequestDetail.Statuses.updatedDateTimeUtc Date The time (in Unix epoch) when the Freeze request was last updated.
Absolute.FreezeRequestDetail.Statuses.triggerActionUid String The system-defined, unique identifier of a new Freeze request that replaces another Freeze request of the same type.
Absolute.FreezeRequestDetail.Statuses.eventType String Device freeze type event.
Absolute.FreezeRequestDetail.Statuses.ackClientTS Number The acknowledgment timestamp (in UNIX epoch local time) when the request was downloaded on the device.
Absolute.FreezeRequestDetail.Statuses.ackClientDateTimeUtc Number The acknowledgment timestamp (in UNIX epoch UTC) when the request was downloaded to the device.
Absolute.FreezeRequestDetail.Statuses.instruction String All action instructions which are sent from the device DFZ agent component.
Absolute.FreezeRequestDetail.Statuses.scheduledFreezeDateTimeUtc Number The date and time (in Unix epoch) when a Scheduled Freeze request was scheduled to be performed.
Absolute.FreezeRequestDetail.Configuration.messageName String The user-defined name for the Freeze message.
Absolute.FreezeRequestDetail.Configuration.htmlClear String The user-defined, HTML coded message shown on the device when the Freeze is applied (the same as Configuration.freezeMessage except it contains the HTML tags).
Absolute.FreezeRequestDetail.Configuration.passcodeClear String The passcode that can be used to unfreeze the device.
Absolute.FreezeRequestDetail.Configuration.passcodeOption String The type of passcode to unfreeze a device.
Absolute.FreezeRequestDetail.Configuration.freezeMessage String The content of the Freeze message without the HTML tags.
Absolute.FreezeRequestDetail.Configuration.freezeId String The user-friendly identifier of the request that is displayed in the event history in the Absolute console (same as EventHistoryId).
Absolute.FreezeRequestDetail.Configuration.configurationUid String The system-defined unique identifier assigned to the Freeze configuration.
Absolute.FreezeRequestDetail.Configuration.action String The type of action being performed on the device.
Absolute.FreezeRequestDetail.Configuration.type String The type of Freeze.
Absolute.FreezeRequestDetail.Configuration.passcodeLength Number The length of the device unfreeze passcode when it is randomly generated.
Absolute.FreezeRequestDetail.Configuration.passcodeSalt String The salt used for hashing the passcode before the passcode is sent to the device.
Absolute.FreezeRequestDetail.Configuration.passcodeHashed String The hashed value of the passcode.
Absolute.FreezeRequestDetail.Configuration.html String The encoded value of Configuration.htmlClear.
Absolute.FreezeRequestDetail.Configuration.disableRemoteLogin Boolean Whether remote login is disabled on the device.
Absolute.FreezeRequestDetail.Configuration.disableFileSharing Boolean Whether file sharing is disabled on the device.
Absolute.FreezeRequestDetail.Configuration.Conditions.secondsUntilFreeze Number The amount of time (in seconds) a device can be offline before the device is frozen.
Absolute.FreezeRequestDetail.Configuration.Conditions.scheduledFreezeDate Date The date and time (in UTC) when a Scheduled Freeze request is scheduled to be performed.
Absolute.FreezeRequestDetail.Configuration.issuedDateTimeUTC Date The date and time (in UNIX epoch) when the Freeze request was created.
Absolute.FreezeRequestDetail.Configuration.preLoginEnabled Boolean Whether pre-login is enabled on the device.
Absolute.FreezeRequestDetail.Configuration.serviceControlList String List of service controls that the server sends to the device.
Absolute.FreezeRequestDetail.Name String The user-defined name for the Freeze request.
Absolute.FreezeRequestDetail.Requester String The user ID of the entity that created the Freeze request.
Absolute.FreezeRequestDetail.CreatedUTC Date The date and time (in UNIX epoch) when the Freeze request was created.
Absolute.FreezeRequestDetail.ChangedUTC Date The date and time (in UNIX epoch) when the Freeze request was last modified.
Absolute.FreezeRequestDetail.NotificationEmails Unknown An array of user-entered email addresses that will receive an email notification when the status of the Freeze request changes. Supports up to 10 email addresses.
Absolute.FreezeRequestDetail.EventHistoryId String The user-friendly identifier of the request that is displayed in the event history in the Absolute console (same as freezeId).
Absolute.FreezeRequestDetail.PolicyGroupUid String The system-defined unique identifier of the policy group that the device belongs to.
Absolute.FreezeRequestDetail.PolicyConfigurationVersion Number The version of the configuration for the policy.
Absolute.FreezeRequestDetail.FreezePolicyUid String The unique identifier of the Freeze policy.
Absolute.FreezeRequestDetail.Downloaded Boolean Whether the Freeze request has been downloaded to the device.
Absolute.FreezeRequestDetail.IsCurrent Boolean Internal flag.

Command example

!absolute-device-freeze-request-get request_uid=c638c2dc-1dd1-4cfa-8708-46f368012398

Context Example

{
    "Absolute": {
        "FreezeRequestDetail": {
            "AccountUid": "accountID",
            "ActionRequestUid": "c638c2dc-1dd1-4cfa-8708-46f368012398",
            "ChangedBy": null,
            "ChangedUTC": "2022-03-29T10:30:55.462+00:00",
            "Configuration": {
                "action": "DFZ",
                "conditions": [
                    {
                        "scheduledFreezeDate": "2022-03-29T10:30:22.000+00:00"
                    }
                ],
                "configurationUid": "c61b0cb7-3846-4d1e-9e78-641084b7747a",
                "disableFileSharing": true,
                "disableRemoteLogin": true,
                "forceReboot": false,
                "freezeId": "DeviceFreeze-0010",
                "freezeMessage": "test",
                "htmlClear": "<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\"></head><body><p style=\"font-size: small\">DeviceFreeze-0010</p><hr>test</body></html>",
                "issuedUTC": "2022-03-29T10:30:24.268+00:00",
                "messageName": "new name",
                "passcodeClear": "26148",
                "passcodeHashed": "c5pr+oaojn37SFZJ3uokRe0Uy/+kAhzPNv6TyrCzXOdL1vu/KyoFF7T6rQfLK6ej2jYWXPGRzxWCfrS9f/S8JA==",
                "passcodeLength": 5,
                "passcodeOption": "RandomForEach",
                "passcodeSalt": "/4VA8uE3DUv04mWy9iGkZp5rL3zDwtEP/YsqAvL190VIn9bhPZUzYXozoSSEPro0tVSVMtG9Rfssqpy2yvsm6g==",
                "preLoginEnabled": true,
                "type": "Scheduled"
            },
            "Content": null,
            "CreatedBy": null,
            "CreatedUTC": "2022-03-29T10:30:24.279+00:00",
            "DeviceUid": "123456",
            "Downloaded": false,
            "EventHistoryId": "DeviceFreeze-0010",
            "FreezePolicyUid": null,
            "ID": "fa72b6ed-62f4-40bd-b581-ef5c114efb8e",
            "IsCurrent": false,
            "Name": "name1",
            "NotificationEmails": [],
            "PolicyConfigurationVersion": 0,
            "PolicyGroupUid": null,
            "Requester": "example@test.com",
            "RequesterUid": "778f8cce-8cc6-4de1-b025-e0538f97e072",
            "Statuses": [
                {
                    "ackClientTS": 0,
                    "ackClientUTC": 1,
                    "eventType": "Remove",
                    "scheduledFreezeDateUTC": 0,
                    "status": "Removed",
                    "statusUid": "9e413f56-8b2d-4605-9527-536427b9ad02",
                    "updatedBy": "example@test.com",
                    "updatedUTC": "2022-03-29T10:30:55.462+00:00"
                },
                {
                    "ackClientTS": 0,
                    "ackClientUTC": 0,
                    "scheduledFreezeDateUTC": 0,
                    "status": "FreezeRequested",
                    "updatedBy": "example@test.com",
                    "updatedUTC": "2022-03-29T10:30:24.268+00:00"
                }
            ]
        }
    }
}

Human Readable Output

Absolute Freeze request details for: c638c2dc-1dd1-4cfa-8708-46f368012398

ID Name AccountUid ActionRequestUid EventHistoryId CreatedUTC ChangedUTC Requester
fa72b6ed-62f4-40bd-b581-ef5c114efb8e name1 accountID c638c2dc-1dd1-4cfa-8708-46f368012398 DeviceFreeze-0010 2022-03-29T10:30:24.279+00:00 2022-03-29T10:30:55.462+00:00 example@test.com

absolute-device-freeze-message-list

Gets all the Freeze messages that are configured for the account by the given message_id. If message_id is not given all the messages will be returned.

Base Command

absolute-device-freeze-message-list

Input

Argument Name Description Required
message_id The system-defined, unique identifier of the Freeze message. Optional
limit Maximum number of results to return. Default is 50. Optional
page The page number of the results to retrieve. Default is 0. Optional

Context Output

Path Type Description
Absolute.FreezeMessage.ID String The system-defined, unique identifier of the Freeze message.
Absolute.FreezeMessage.Name String The user-defined name for the Freeze message.
Absolute.FreezeMessage.Content String The user-defined, HTML coded message that shows on a device when a Freeze is applied.
Absolute.FreezeMessage.CreatedBy String The username of the entity that created the Freeze message.
Absolute.FreezeMessage.ChangedBy String The username of the entity that last updated the Freeze message.
Absolute.FreezeMessage.CreatedUTC String The date and time when the Freeze message was created.
Absolute.FreezeMessage.ChangedUTC String The date and time when the Freeze message was last modified.

Command example


#### Context Example

```json
{
    "Absolute": {
        "FreezeMessage": {
            "ChangedBy": "778f8cce-8cc6-4de1-b025-e0538f97e072",
            "ChangedUTC": "2022-04-03T07:45:01.487+00:00",
            "Content": "some text- new",
            "CreatedBy": "example@test.com",
            "CreatedUTC": "2022-04-03T07:45:01.487+00:00",
            "ID": "711b5da9-3867-473f-9d8f-9aba3de42b7a",
            "Name": "name"
        }
    }
}

Human Readable Output

Absolute Device freeze message details

ID Name CreatedUTC ChangedUTC ChangedBy CreatedBy
711b5da9-3867-473f-9d8f-9aba3de42b7a name 2022-04-03T07:45:01.487+00:00 2022-04-03T07:45:01.487+00:00 778f8cce-8cc6-4de1-b025-e0538f97e072 example@test.com

absolute-device-freeze-message-create

Creates a new Freeze message for the account.

Base Command

absolute-device-freeze-message-create

Input

Argument Name Description Required
html_message The user-defined, HTML coded message that shows on a device when a Device Freeze is applied. Should be in HTML format with 1-4000 characters. Required
message_name The user-defined name for the Device Freeze message. The name should be a string with 1-255 characters. Required

Context Output

Path Type Description
Absolute.FreezeMessage.ID String The system-defined, unique identifier of the Freeze message.

Command example

!absolute-device-freeze-message-create html_message="some text" message_name="name name"

Context Example

{
    "Absolute": {
        "FreezeMessage": {
            "ID": "bdaf3a55-411a-4393-a0bf-7340f38fbc68"
        }
    }
}

Human Readable Output

Absolute New freeze message was created with ID: bdaf3a55-411a-4393-a0bf-7340f38fbc68

absolute-device-freeze-message-update

Updates the content of an existing Freeze message.

Base Command

absolute-device-freeze-message-update

Input

Argument Name Description Required
html_message The user-defined, HTML coded message that shows on a device when a Device Freeze is applied. Should be in HTML format with 1-4000 characters. Required
message_name The user-defined name for the Device Freeze message. The name should be a string with 1-255 characters. Required
message_id The system-defined, unique identifier of the Freeze message. Required

Context Output

There is no context output for this command.

Command example

!absolute-device-freeze-message-update html_message="new mesg" message_id=711b5da9-3867-473f-9d8f-9aba3de42b7a message_name="name-new"

Human Readable Output

Absolute Freeze message: 711b5da9-3867-473f-9d8f-9aba3de42b7a was updated successfully

absolute-device-freeze-message-delete

Deletes an existing Freeze message for the account.

Base Command

absolute-device-freeze-message-delete

Input

Argument Name Description Required
message_id The system-defined, unique identifier of the Freeze message. Required

Context Output

There is no context output for this command.

Command example

!absolute-device-freeze-message-delete message_id="711b5da9-3867-473f-9d8f-9aba3de42b7a"

Human Readable Output

Absolute Freeze message: 711b5da9-3867-473f-9d8f-9aba3de42b7a was deleted successfully

absolute-device-unenroll

Initiates an unenroll request on a list of eligible devices.

Base Command

absolute-device-unenroll

Input

Argument Name Description Required
device_ids A comma-separated list of device UIDs that should be unenrolled. Required
exclude_missing_devices Whether to exclude missing devices or not. Possible values are: true, false. Optional

Context Output

Path Type Description
Absolute.DeviceUnenroll.TotalDevices String The total number of devices in the request.
Absolute.DeviceUnenroll.Pending Number The number of pending devices.
Absolute.DeviceUnenroll.Processing Number The number of processing devices.
Absolute.DeviceUnenroll.Completed Number The number of completed device unenroll.
Absolute.DeviceUnenroll.Canceled Number The number of canceled device unenroll.
Absolute.DeviceUnenroll.Failed Number The number of failed device unenroll.
Absolute.DeviceUnenroll.RequestId String The unique ID identifier of the request.
Absolute.DeviceUnenroll.RequestUid String The unique GUID identifier of the request.
Absolute.DeviceUnenroll.RequestStatus String The status of the request.
Absolute.DeviceUnenroll.UpdatedDateTimeUtc Date The time (in Unix epoch) when the request was last updated.
Absolute.DeviceUnenroll.CreatedDateTimeUtc Date The time (in Unix epoch) when the request was created.
Absolute.DeviceUnenroll.Requester String The requester of the request.
Absolute.DeviceUnenroll.ExcludeMissingDevices Boolean Whether the request includes missing devices or not.
Absolute.DeviceUnenroll.Devices.DeviceUid String The unique GUID identifier of the device.
Absolute.DeviceUnenroll.Devices.ActionUid String The unique GUID identifier of the action.
Absolute.DeviceUnenroll.Devices.RequestUid String The unique GUID identifier of the request.
Absolute.DeviceUnenroll.Devices.DeviceName String The unique device name of the device.
Absolute.DeviceUnenroll.Devices.ActionStatus String The status of the action.
Absolute.DeviceUnenroll.Devices.ESN String The unique Electronic SerialNumber (ESN) that is assigned to the agent installed on the device.
Absolute.DeviceUnenroll.Devices.UpdatedDateTimeUtc Date The time (in Unix epoch) when the request was last updated.
Absolute.DeviceUnenroll.Devices.CreatedDateTimeUtc Date The time (in Unix epoch) when the request was created.

Command example

!absolute-device-unenroll device_ids="1"

Context Example

{
    "Absolute": {
        "DeviceUnenroll": [
            {
                "DeviceUid": "1",
                "ESN": "2BU2PJD28VAA1UYL0008",
                "EligibleStatus": 0,
                "Serial": "CNF83051BN",
                "SystemName": "user1",
                "Username": "example@test.com"
            },
            {
                "DeviceUid": "2",
                "ESN": "2BU2PJ545L0008",
                "EligibleStatus": 1,
                "Serial": "CNF43051BN",
                "SystemName": "user2",
                "Username": "example2@test.com"
            }
        ]
    }
}

Human Readable Output

Absolute unenroll devices

DeviceUid ESN EligibleStatus Serial SystemName Username
1 2BU2PJD28VAA1UYL0008 0 CNF83051BN user1 example@test.com
2 2BU2PJ545L0008 1 CNF43051BN user2 example2@test.com

absolute-device-application-list

Gets a list of device records and the corresponding software application data for each device on the account that you have access to or that meets the given filter.

Base Command

absolute-device-application-list

Input

Argument Name Description Required
filter The query by which to filter the device applications. If this argument is set, it overrides the others. For example, appName eq ‘someName’ or availableVirtualMemoryBytes lt 1073741824. Optional
return_fields A comma-separated list of all specific values to return. If not set, all possible values will be returned. Optional
device_ids A comma-separated list of the system-defined unique identifier of the devices. Optional
device_names A comma-separated list of the devices names. Optional
app_names A comma-separated list of the application names. Optional
app_publishers A comma-separated list of the name of the software publishers of the application. Optional
user_names A comma-separated list of the user names of the users logged in to the device. Optional
os A comma-separated list of the operating systems that are installed on the device. Optional
esn A comma-separated list of the system-defined unique Electronic Serial Numbers (ESN) assigned to the Absolute agent installed on the device. Optional
limit Maximum number of results to return. Default is 50. Optional
page The page number of the results to retrieve. Minimum value is 0. Default is 0. Optional

Context Output

Path Type Description
Absolute.DeviceApplication.DeviceAppId String The unique ID of the application.
Absolute.DeviceApplication.DeviceUid String The system-defined unique identifier of the device.
Absolute.DeviceApplication.AppId String The identifier of the application.
Absolute.DeviceApplication.AppName String The name of the application.
Absolute.DeviceApplication.AppPublisher String The name of the software publisher of the application.
Absolute.DeviceApplication.AppOriginalPublisher String The original name of the software publisher of the application.
Absolute.DeviceApplication.AppVersion String The version of the application.
Absolute.DeviceApplication.Ens String The system-defined unique Electronic Serial Number (ESN) assigned to the Absolute agent installed on the device.
Absolute.DeviceApplication.DeviceName String The name of the device.
Absolute.DeviceApplication.DeviceSerialNumber String The identification number that is assigned to the device by the device manufacturer.
Absolute.DeviceApplication.UserName String Includes the device name and the username of the user logged in to the device at the time of the agent call.
Absolute.DeviceApplication.InstallPath String The location where the application is installed.
Absolute.DeviceApplication.InstallDate Date The date (in UNIX epoch time) when the application was installed.
Absolute.DeviceApplication.FirstDetectUtc Date The date and time (in Unix epoch time) when the indicated version of the application was first detected on the device.
Absolute.DeviceApplication.OsName String The operating system that is installed on the device.
Absolute.DeviceApplication.LastScanTimeUtc Date The date and time (in Unix epoch time) of the most recent installed software (SNG) scan.

Command example

!absolute-device-application-list device_ids=1234 filter="appName eq 'Notepad++' or appName eq 'Settings'"

Context Example

{
    "Absolute": {
        "DeviceApplication": [
            {
                "AccountUid": "accountID",
                "AppId": "U2V0dGluZ3N8fE1pY3Jvc29mdHx8MTAuMC4yLjEwMDA=",
                "AppName": "Settings",
                "AppOriginalName": "Settings",
                "AppOriginalPublisher": "Microsoft Corporation",
                "AppOriginalVersion": "10.0.2.1000",
                "AppPublisher": "Microsoft",
                "AppVersion": "10.0.2.1000",
                "DeviceAppId": "123456_24222cfe5ccbe45e6d5a78faa58cd977921b4c1dd552884ec38653934c3b75f9",
                "DeviceName": "ABSOLUTE-ASSET-",
                "DeviceSerialNumber": "GoogleCloud-B8736A4405BF0E968020BCBC46EDA096",
                "DeviceUid": "123456",
                "Esn": "D0001",
                "FirstDetectUtc": 1648601001193,
                "InstallDate": 1536995941018,
                "InstallPath": "C:\\Windows\\ImmersiveControlPanel",
                "LastScanTimeUtc": 1648627356120,
                "OsName": "Microsoft Windows Server 2019 Datacenter"
            },
            {
                "AccountUid": "accountID",
                "AppId": "Tm90ZXBhZCsrfHxOb3RlUGFkfHw4LjMuMw==",
                "AppName": "Notepad++",
                "AppOriginalName": "Notepad++ (64-bit x64)",
                "AppOriginalPublisher": "Notepad++ Team",
                "AppOriginalVersion": "8.3.3",
                "AppPublisher": "NotePad",
                "AppVersion": "8.3.3",
                "DeviceAppId": "1234_3653d2a872cd1208dfc4845a20670a6c9364a626cd6c987cd5e916ca71f38105",
                "DeviceName": "ABSOLUTE-ASSET-",
                "DeviceSerialNumber": "GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA",
                "DeviceUid": "1234",
                "Esn": "D0004",
                "FirstDetectUtc": 1648027180153,
                "InstallDate": 1648026266334,
                "InstallPath": "C:\\Program Files\\Notepad++",
                "LastScanTimeUtc": 1648894013571,
                "OsName": "Microsoft Windows Server 2022 Datacenter"
            },
            {
                "AccountUid": "accountID",
                "AppId": "U2V0dGluZ3N8fE1pY3Jvc29mdHx8MTAuMC40LjEwMDA=",
                "AppName": "Settings",
                "AppOriginalName": "Settings",
                "AppOriginalPublisher": "Microsoft Corporation",
                "AppOriginalVersion": "10.0.4.1000",
                "AppPublisher": "Microsoft",
                "AppVersion": "10.0.4.1000",
                "DeviceAppId": "1234_f3ef442d95c3b7155fe9b138384bda2219afb3048c2a9466f1174fc1488ca671",
                "DeviceName": "ABSOLUTE-ASSET-",
                "DeviceSerialNumber": "GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA",
                "DeviceUid": "1234",
                "Esn": "D0004",
                "FirstDetectUtc": 1648027180153,
                "InstallDate": 1620462024187,
                "InstallPath": "C:\\Windows\\ImmersiveControlPanel",
                "LastScanTimeUtc": 1648894013571,
                "OsName": "Microsoft Windows Server 2022 Datacenter"
            }
        ]
    }
}

Human Readable Output

Absolute device applications list

|AccountUid|AppId|AppName|AppOriginalName|AppOriginalPublisher|AppOriginalVersion|AppPublisher|AppVersion|DeviceAppId|DeviceName|DeviceSerialNumber|DeviceUid|Esn|FirstDetectUtc|InstallDate|InstallPath|LastScanTimeUtc|OsName|
|—|—|—|—|—|—|—|—|—|—|—|—|—|—|—|—|—|—|
| accountID | U2V0dGluZ3N8fE1pY3Jvc29mdHx8MTAuMC4yLjEwMDA= | Settings | Settings | Microsoft Corporation | 10.0.2.1000 | Microsoft | 10.0.2.1000 | 123456_24222cfe5ccbe45e6d5a78faa58cd977921b4c1dd552884ec38653934c3b75f9 | ABSOLUTE-ASSET- | GoogleCloud-B8736A4405BF0E968020BCBC46EDA096 | 123456 | D0001 | 1648601001193 | 1536995941018 | C:\Windows\ImmersiveControlPanel | 1648627356120 | Microsoft Windows Server 2019 Datacenter |
| accountID | Tm90ZXBhZCsrfHxOb3RlUGFkfHw4LjMuMw== | Notepad++ | Notepad++ (64-bit x64) | Notepad++ Team | 8.3.3 | NotePad | 8.3.3 | 1234_3653d2a872cd1208dfc4845a20670a6c9364a626cd6c987cd5e916ca71f38105 | ABSOLUTE-ASSET- | GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA | 1234 | D0004 | 1648027180153 | 1648026266334 | C:\Program Files\Notepad++ | 1648894013571 | Microsoft Windows Server 2022 Datacenter |
| accountID | U2V0dGluZ3N8fE1pY3Jvc29mdHx8MTAuMC40LjEwMDA= | Settings | Settings | Microsoft Corporation | 10.0.4.1000 | Microsoft | 10.0.4.1000 | 1234_f3ef442d95c3b7155fe9b138384bda2219afb3048c2a9466f1174fc1488ca671 | ABSOLUTE-ASSET- | GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA | 1234 | D0004 | 1648027180153 | 1620462024187 | C:\Windows\ImmersiveControlPanel | 1648894013571 | Microsoft Windows Server 2022 Datacenter |
Above results are with page number: 0 and with size: 50.

absolute-device-list

Gets a list of device records and their corresponding data that meets the required filter for all devices in your account, based on your authorization token.

Base Command

absolute-device-list

Input

Argument Name Description Required
filter The query by which to filter all the devices managed by the account. If this argument is set, it overrides the others. For example, agentStatus eq ‘A’ or lastConnectedUtc lt datetime’2021-01-01T00:00:00Z’. Optional
agent_status The status of the Absolute agent on the device. Possible values are: Active, Disabled, Inactive. Optional
os_name Short description of the operating system expressed as a one-line string that includes the version of the operating system. Optional
os_version The version of the operating system. Optional
manufacturer The manufacturer of the device. Optional
model The product name from the manufacturer. Optional
user_names A comma-separated list of the usernames of the users who were logged in to the device at the time of the most recent agent call. If no user was logged in during the last agent call, the last detected username is used. Optional
limit Maximum number of results to return. Default is 50. Optional
page The page number of the results to retrieve. Minimum value is 0. Default is 0. Optional

Context Output

Path Type Description
Absolute.Device.Id String The unique identifier assigned to the device.
Absolute.Device.Esn String The unique ESN (Absolute Identifier) assigned to the agent installed on the device.
Absolute.Device.LastConnectedUtc Number The date and time (in Unix epoch) when the device last connected to the Absolute Monitoring Center.
Absolute.Device.SystemName String The name assigned to the device.
Absolute.Device.FullSystemName String The full name assigned to the device consisting of the system name and the domain name.
Absolute.Device.AgentStatus String The status of the Absolute agent on the device.
Absolute.Device.osName String Short description of the operating system expressed as a one-line string that includes the version of the operating system.
Absolute.Device.SystemManufacturer String The manufacturer of the device.
Absolute.Device.SystemModel String The product name from the manufacturer.
Absolute.Device.SystemType String The system running on the Windows-based computer.
Absolute.Device.Serial String The manufacturer-defined unique identifier assigned to the device. May correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.
Absolute.Device.LocalIp String Last known local IP address of this device.
Absolute.Device.PublicIp String Last known public IP address of this device.
Absolute.Device.EncryptionStatus String The summarized encryption status of the device.

Command example

!absolute-device-list os_name="Microsoft Windows Server 2019 Datacenter"

Context Example

{
    "Absolute": {
        "Device": {
            "AgentStatus": "A",
            "Esn": "D0001",
            "FullSystemName": "ABSOLUTE-ASSET-.WORKGROUP",
            "Id": "123456",
            "LastConnectedUtc": 1648971645189,
            "LocalIp": "127.0.0.1",
            "PublicIp": "127.0.0.1",
            "Serial": "GoogleCloud-B8736A4405BF0E968020BCBC46EDA096",
            "SystemManufacturer": "Google",
            "SystemModel": "GOOGLE COMPUTE ENGINE",
            "SystemName": "ABSOLUTE-ASSET-",
            "SystemType": "x64-based PC",
            "osName": "Microsoft Windows Server 2019 Datacenter"
        }
    }
}

Human Readable Output

Absolute devices list

|AgentStatus|Esn|FullSystemName|Id|LastConnectedUtc|LocalIp|PublicIp|Serial|SystemManufacturer|SystemModel|SystemName|SystemType|osName|
|—|—|—|—|—|—|—|—|—|—|—|—|—|
| A | D0001 | ABSOLUTE-ASSET-.WORKGROUP | 123456 | 1648971645189 | 127.0.0.1 | 127.0.0.1 | GoogleCloud-B8736A4405BF0E968020BCBC46EDA096 | Google | GOOGLE COMPUTE ENGINE | ABSOLUTE-ASSET- | x64-based PC | Microsoft Windows Server 2019 Datacenter |
Above results are with page number: 0 and with size: 50.

absolute-device-get

Gets a list of device records and their corresponding data that meets the required fields for all devices in your account. Note that the command supports returning a maximum of 500 distinct devices.

Base Command

absolute-device-get

Input

Argument Name Description Required
fields A comma-separated list of all specific values to return. Optional
device_ids A comma-separated list of the system-defined unique identifier of the devices. Optional
device_names A comma-separated list of the devices names. Optional
local_ips A comma-separated list of the last known local IP addresses of a device. Optional
public_ips A comma-separated list of the last known public IP addresses of a device. Optional

Context Output

Path Type Description
Absolute.Device.Id String The unique identifier assigned to the device.
Absolute.Device.Esn String The unique ESN (Absolute Identifier) assigned to the agent installed on the device.
Absolute.Device.Domain String The name of the Windows domain to which this device belongs.
Absolute.Device.LastConnectedUtc Number The date and time (in Unix epoch) when the device last connected to the Absolute Monitoring Center.
Absolute.Device.SystemName String The name assigned to the device.
Absolute.Device.FullSystemName String The full name assigned to the device consisting of the system name and the domain name.
Absolute.Device.AgentStatus String The status of the Absolute agent on the device.
Absolute.Device.Os.name String Short description of the operating system expressed as a one-line string that includes the version of the operating system.
Absolute.Device.Os.version String The version of the operating system.
Absolute.Device.Os.currentBuild String The current build number of the operating system.
Absolute.Device.Os.architecture String The architecture of the operating system.
Absolute.Device.Os.installDate Number The date and time (in Unix epoch) when the operating system was installed.
Absolute.Device.Os.productKey String The product key of the operating system.
Absolute.Device.Os.serialNumber String The serial identification number of the operating system.
Absolute.Device.Os.lastBootTime Number The date and time (in Unix epoch) when the operating system was last restarted.
Absolute.Device.Bios.id String The unique identifier of this BIOS given by the manufacturer.
Absolute.Device.Bios.serialNumber String The serial number assigned to the BIOS.
Absolute.Device.Bios.smBiosVersion String The major version number of the BIOS, as reported by SMBIOS.
Absolute.Device.Bios.version String The version of the BIOS, as reported by SMBIOS.
Absolute.Device.Bios.versionDate String A substring of the manufacturer of the BIOS + the version of the BIOS version, as reported by SMBIOS + the release date of the Window BIOS.
Absolute.Device.SystemManufacturer String The manufacturer of the device.
Absolute.Device.SystemModel String The product name from the manufacturer.
Absolute.Device.SystemType String The system running on the Windows-based computer.
Absolute.Device.Serial String The manufacturer-defined unique identifier assigned to the device. May correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.
Absolute.Device.LocalIp String Last known local IP address of this device.
Absolute.Device.PublicIp String Last known public IP address of this device.
Absolute.Device.EncryptionStatus String The summarized encryption status of the device.
Absolute.Device.Username String The unique username of the user that was logged in to the device at the time of the most recent agent call.
Absolute.Device.PolicyGroupUid String The unique identifier of the policy group that the device belongs to.
Absolute.Device.PolicyGroupName String The name of the policy group that the device belongs to.
Absolute.Device.IsStolen String Indicates whether this device was reported as stolen.
Absolute.Device.DeviceStatus.type String The status of the device. Possible values are STOLEN or MISSING.
Absolute.Device.DeviceStatus.reported Number The data and time (in Unix epoch) when the device was reported missing or stolen.
Absolute.Device.NetworkAdapters.networkSSID String The Service Set Identifier (SSID) of the connected Wi-Fi adapter.

Command example

!absolute-device-get device_names="ABSOLUTE-ASSET-"

Context Example

{
    "Absolute": {
        "Device": [
            {
                "AgentStatus": "A",
                "Bios": {
                    "id": "Google - 1 Google ",
                    "serialNumber": "GoogleCloud-B8736A4405BF0E968020BCBC46EDA096",
                    "smBiosVersion": "2.4",
                    "version": "Google - 1 Google ",
                    "versionDate": "Google Google, 01/01/2011"
                },
                "Domain": "WORKGROUP",
                "Esn": "D0001",
                "FullSystemName": "ABSOLUTE-ASSET-.WORKGROUP",
                "Id": "123456",
                "LastConnectedUtc": 1648971645189,
                "LocalIp": "127.0.0.1",
                "NetworkAdapters": [
                    {},
                    {}
                ],
                "Os": {
                    "architecture": "64-bit",
                    "currentBuild": "17763",
                    "installDate": 1643800616000,
                    "lastBootTime": 1646884562500,
                    "name": "Microsoft Windows Server 2019 Datacenter",
                    "productKey": "WMDGN-G9PQG-XVVXX-R3X43-63DFG",
                    "serialNumber": "00430-00000-00000-AA691",
                    "version": "10.0.17763"
                },
                "PolicyGroupName": "Global Policy Group",
                "PublicIp": "127.0.0.1",
                "Serial": "GoogleCloud-B8736A4405BF0E968020BCBC46EDA096",
                "SystemManufacturer": "Google",
                "SystemModel": "GOOGLE COMPUTE ENGINE",
                "SystemName": "ABSOLUTE-ASSET-",
                "SystemType": "x64-based PC",
                "Username": "Administrator"
            },
            {
                "AgentStatus": "A",
                "Bios": {
                    "id": "Google - 1 Google ",
                    "serialNumber": "GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA",
                    "smBiosVersion": "2.4",
                    "version": "Google - 1 Google ",
                    "versionDate": "Google Google, 01/01/2011"
                },
                "Domain": "WORKGROUP",
                "Esn": "D0004",
                "FullSystemName": "ABSOLUTE-ASSET-.WORKGROUP",
                "Id": "1234",
                "LastConnectedUtc": 1648971873079,
                "LocalIp": "127.0.0.1",
                "NetworkAdapters": [
                    {},
                    {}
                ],
                "Os": {
                    "architecture": "64-bit",
                    "currentBuild": "20348",
                    "installDate": 1648025097000,
                    "lastBootTime": 1648025060499,
                    "name": "Microsoft Windows Server 2022 Datacenter",
                    "productKey": "WX4NM-KYWYW-QJJR4-XV3QB-6VM33",
                    "serialNumber": "00454-60000-00001-AA937",
                    "version": "10.0.20348"
                },
                "PolicyGroupName": "Global Policy Group",
                "PublicIp": "127.0.0.1",
                "Serial": "GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA",
                "SystemManufacturer": "Google",
                "SystemModel": "GOOGLE COMPUTE ENGINE",
                "SystemName": "ABSOLUTE-ASSET-",
                "SystemType": "x64-based PC",
                "Username": "Administrator"
            }
        ]
    }
}

Human Readable Output

Absolute devices list

AgentStatus Bios Domain Esn FullSystemName Id LastConnectedUtc LocalIp NetworkAdapters Os PolicyGroupName PublicIp Serial SystemManufacturer SystemModel SystemName SystemType Username
A id: Google - 1 Google
serialNumber: GoogleCloud-B8736A4405BF0E968020BCBC46EDA096
version: Google - 1 Google
versionDate: Google Google, 01/01/2011
smBiosVersion: 2.4		 WORKGROUP D0001 ABSOLUTE-ASSET-.WORKGROUP 123456 1648971645189 127.0.0.1 {},
{}		 architecture: 64-bit
installDate: 1643800616000
lastBootTime: 1646884562500
name: Microsoft Windows Server 2019 Datacenter
productKey: WMDGN-G9PQG-XVVXX-R3X43-63DFG
serialNumber: 00430-00000-00000-AA691
version: 10.0.17763
currentBuild: 17763		 Global Policy Group 127.0.0.1 GoogleCloud-B8736A4405BF0E968020BCBC46EDA096 Google GOOGLE COMPUTE ENGINE ABSOLUTE-ASSET- x64-based PC Administrator
A id: Google - 1 Google
serialNumber: GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA
version: Google - 1 Google
versionDate: Google Google, 01/01/2011
smBiosVersion: 2.4		 WORKGROUP D0004 ABSOLUTE-ASSET-.WORKGROUP 1234 1648971873079 127.0.0.1 {},
{}		 architecture: 64-bit
installDate: 1648025097000
lastBootTime: 1648025060499
name: Microsoft Windows Server 2022 Datacenter
productKey: WX4NM-KYWYW-QJJR4-XV3QB-6VM33
serialNumber: 00454-60000-00001-AA937
version: 10.0.20348
currentBuild: 20348		 Global Policy Group 127.0.0.1 GoogleCloud-6420CF930DEE84DE8497CF40F0D56AFA Google GOOGLE COMPUTE ENGINE ABSOLUTE-ASSET- x64-based PC Administrator

absolute-device-location-get

Gets a list of devices geo locations records and their corresponding data that meets the required devices IDs.

Base Command

absolute-device-location-get

Input

Argument Name Description Required
device_ids A comma-separated list of the system-defined unique identifier of the devices. Required

Context Output

Path Type Description
Absolute.LocationReport.Coordinates Unknown A comma-separated list where the first number is the estimated latitude and the second number is the estimated longitude (in degrees) where the device is located.
Absolute.LocationReport.ID String The system-defined unique identifier of the device.
Absolute.LocationReport.City String The city where the device is located.
Absolute.LocationReport.State String The state or province where the device is located.
Absolute.LocationReport.CountryCode String The country code for the country where the device is located.
Absolute.LocationReport.Country String The country where the device is located.
Absolute.LocationReport.LocationTechnology String The technology used to get the location.
Absolute.LocationReport.Accuracy Number The estimated accuracy (in meters) of the technology used to locate the device.
Absolute.LocationReport.LastUpdate Number The date and time (in Unix epoch) when the device last changed its location.

Command example

!absolute-device-location-get device_ids=1234

Human Readable Output

No device locations found in Absolute for the given filters: {‘device_ids’: ‘1234’}

absolute-device-get-events

Retrieves a list of events from the Absolute device instance.

Base Command

absolute-device-get-events

Input

Argument Name Description Required
should_push_events Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false. Optional
start_date Filters the results to the records on or after the start date. Optional
end_date Filters the results to the records until the end date. Optional
limit The maximum number of records to return per page. Note, this may be restricted by fixed system limits. Optional

Command Example

!absolute-device-get-events start_date="one minute ago" end_date="now" limit=10

Creating a filtering and sorting query

The following commands have the option to insert a filter argument:

  • absolute-device-application-list
  • absolute-device-list

Absolute uses a subset of query options from Open Data Protocol (OData) for filtering and sorting.
OData version 1 and 2 are supported. OData query parameters must be alphabetized and URI encoded.
For more information about OData, see: https://www.odata.org/documentation.

A few examples of creating a query (i.e., passing a filter argument):

  • Using the eq operator
    • Get a list of all devices with an active status: agentStatus eq ‘A’
    • Get a list of all devices that are currently frozen: dfStatus.statusCode eq ‘FRZN’
    • Get a list of all devices that have 1734 in their ESN (Identifier): substringof(‘1734’,esn) eq true
  • Using the ne operator
    • Get a list of all devices that are not active: agentStatus ne ‘A’
  • Using the gt operator
    • Get a list of all devices with greater than 1 GB (1073741824 bytes) of available physical: availablePhysicalRamBytes gt 1073741824
  • Using the or operator:
    • Get a list of all devices with less than 1 GB (1073741824 bytes) of available physical ram or less than 1 GB (1073741824 bytes) of available virtual raml: availablePhysicalMemroyBytes lt 1073741824 or availableVirtualMemoryBytes lt 1073741824

For more examples and explanations, see the Absolute docs (from page 10).

Breaking changes from the previous version of this integration - Absolute

The following sections list the changes in this version.

Arguments

The following arguments were removed in this version

In the absolute-device-application-list command, the following argument was removed:

  • account_uids

Outputs

  • In the absolute-device-unenroll command the following outputs were replaced:
    • Absolute.DeviceUnenroll.DeviceUid - replaced by Absolute.DeviceUnenroll.Devices.DeviceUid.
    • Absolute.DeviceUnenroll.ESN - replaced by Absolute.DeviceUnenroll.Devices.ESN.
  • In the absolute-device-freeze-request-get command the following outputs were replaced:
    • Absolute.FreezeRequestDetail.Configuration.issuedUtc - replaced by Absolute.FreezeRequestDetail.Configuration.issuedDateTimeUTC.
    • Absolute.FreezeRequestDetail.RequesterUid - replaced by Absolute.FreezeRequestDetail.Requester.
    • Absolute.FreezeRequestDetail.Statuses.ackClientUtc - replaced by Absolute.FreezeRequestDetail.Statuses.ackClientDateTimeUtcs.
    • Absolute.FreezeRequestDetail.Statuses.scheduledFreezeDateUTC - replaced by Absolute.FreezeRequestDetail.Statuses.scheduledFreezeDateTimeUtc.
    • Absolute.FreezeRequestDetail.Statuses.updatedUtc - replaced by Absolute.FreezeRequestDetail.Statuses.updatedDateTimeUtc.
  • In the absolute-device-application-list command the following output was removed:
    • Absolute.DeviceApplication.AccountUid
  • In the absolute-custom-device-field-list command the following output was removed:
    • Absolute.CustomDeviceField.ESN
  • In the absolute-device-freeze-request-get command the following outputs were removed:
    • Absolute.FreezeRequestDetail.Statuses.statusUid
    • Absolute.FreezeRequestDetail.RequesterUid
  • In the absolute-device-unenroll command the following outputs were removed:
    • Absolute.DeviceUnenroll.EligibleStatus
    • Absolute.DeviceUnenroll.Serial
    • Absolute.DeviceUnenroll.SystemName
    • Absolute.DeviceUnenroll.Username

<~PLATFORM>

License Requirements

The following configuration parameters require the Cortex XSIAM license:

  • Fetch Events

</~PLATFORM>

Configuration parameters

  • url — Your Absolute server URL (required)
  • credentials — Token ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • eventFetchInterval — Events Fetch Interval
  • max_events_per_fetch — Max number of events per fetch
  • isFetchEvents —

Commands (15)

  • absolute-custom-device-field-list

    Returns a list of custom device fields associated with the given device_id, based on the authorization token.

  • absolute-custom-device-field-update

    Updates the value of the included custom device fields for the given device_id.

  • absolute-device-application-list

    Gets a list of device records and the corresponding software application data for each device on the account that you have access to or that meets the given filter.

  • absolute-device-freeze-message-create

    Creates a new Freeze message for the account.

  • absolute-device-freeze-message-delete

    Deletes an existing Freeze message for the account. Use absolute-device-freeze-message-list in order to get the message_id.

  • absolute-device-freeze-message-list

    Gets all the Freeze messages that are configured for the account by the given message_id. If message_id is not given all the messages will be returned.

  • absolute-device-freeze-message-update

    Updates the content of an existing Freeze message. Use absolute-device-freeze-message-list in order to get the message_id.

  • absolute-device-freeze-request

    Creates a new Freeze request for the devices specified in the device_ids argument.

  • absolute-device-freeze-request-get

    Gets detailed information about the Freeze request specified by request_uid.

  • absolute-device-get

    Gets a list of device records and their corresponding data that meets the required fields for all devices in your account. Note that the command supports returning a maximum of 500 distinct devices.

  • absolute-device-get-events

    Retrieves a list of events from the Absolute instance.

  • absolute-device-list

    Gets a list of device records and their corresponding data that meets the required filter for all devices in your account, based on your authorization token.

  • absolute-device-location-get

    Gets a list of devices geo location records and their corresponding data that meets the required devices IDs.

  • absolute-device-remove-freeze-request

    Creates a new Remove Freeze request for one or more devices, regardless of their Freeze status. You can submit Remove Freeze requests to perform the following actions: unfreeze frozen devices, remove newly submitted Freeze requests, or remove outstanding Scheduled and Offline Freeze requests. In case of removing from offline: In addition to creating a Remove Freeze request for devices with a status of Frozen by Condition: Offline, removes Offline Freeze requests from devices with a status of Freeze Requested or Freeze Condition - Offline Set. In case of not removing from offline: a Remove Freeze request is created for the devices but the Conditional - Offline Freeze request is not deleted (deprecated).

  • absolute-device-unenroll

    Initiates an unenroll request on a list of eligible devices.

Source

Absolute.py Absolute_test.py Absolute.yml Absolute_description.md command_examples.txt
Download History Raw 
category: Endpoint
provider: Absolute Software
sectionorder:
- Connect
- Collect
commonfields:
  id: Absolute
  version: -1
configuration:
- defaultvalue: https://cc.absolute.com
  display: Your Absolute server URL
  name: url
  required: true
  type: 0
  section: Connect
- name: credentials
  display: Token ID
  required: true
  defaultvalue:
  type: 9
  additionalinfo: Token ID and Secret Key.
  displaypassword: "Secret Key"
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: '1'
  display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  required: false
  advanced: true
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- defaultvalue: 10000
  section: Collect
  display: Max number of events per fetch
  name: max_events_per_fetch
  required: false
  type: 0
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- defaultvalue: 'false'
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
description: "Absolute is an adaptive endpoint security solution that delivers device security, data security, and asset management of endpoints."
display: Absolute
name: Absolute
script:
  commands:
  - arguments:
    - description: The system unique identifier of the device.
      name: device_id
      required: true
    - description: Maximum number of results to return.
      name: limit
      defaultValue: '50'
    - auto: PREDEFINED
      description: Whether to retrieve all results or not.
      name: all_results
      predefined:
      - 'true'
      - 'false'
    description: Returns a list of custom device fields associated with the given device_id, based on the authorization token.
    name: absolute-custom-device-field-list
    outputs:
    - contextPath: Absolute.CustomDeviceField.DeviceUID
      description: The system-defined unique identifier of the device.
      type: String
    - contextPath: Absolute.CustomDeviceField.CDFValues.CDFUID
      description: The unique identifier of the custom device field.
      type: String
    - contextPath: Absolute.CustomDeviceField.CDFValues.FieldKey
      description: The unique identifier of the custom device field in the classic version of Absolute.
      type: String
    - contextPath: Absolute.CustomDeviceField.CDFValues.FieldName
      description: The name assigned to the custom device field.
      type: String
    - contextPath: Absolute.CustomDeviceField.CDFValues.CategoryCode
      description: 'The type of custom device field. Possible values are: PREDEFINED, ESNCOLUMN, UDF.'
      type: String
    - contextPath: Absolute.CustomDeviceField.CDFValues.FieldValue
      description: 'The current value of the custom device field.'
      type: String
    - contextPath: Absolute.CustomDeviceField.CDFValues.Type
      description: 'The data type of the field value. Possible values are: Text, Date, Dropdown.'
      type: String
  - arguments:
    - description: The system unique identifier of the device.
      name: device_id
      required: true
    - description: 'The unique identifier of the custom device field. Note: In order to get this value, use the "absolute-custom-device-field-list" command.'
      name: cdf_uid
      required: true
    - description: The new value of the custom device field to be set.
      name: value
      required: true
    description: Updates the value of the included custom device fields for the given device_id.
    name: absolute-custom-device-field-update
  - arguments:
    - description: A comma-separated list of the unique identifiers of devices included in the request. The recommendation is using up to 10,000 devices per request.
      isArray: true
      name: device_ids
      required: true
    - description: The user-defined name for the Freeze request. The name should be a non-unique string and has 1-250 characters.
      name: request_name
      required: true
    - description: The user-defined HTML coded message shown on devices when the Freeze is applied. The message should be in a non-unique HTML format and has 1-4000 characters.
      name: html_message
      required: true
    - description: The user-defined name for the Freeze message.
      name: message_name
      required: true
    - auto: PREDEFINED
      description: 'The type of Freeze. You cannot freeze a device that has been reported stolen in the Absolute console. - OnDemand: Freezes a device on its next connection to the Absolute Monitoring Center, which is typically within 15 minutes. This applies for all supported operating systems. - Scheduled: Freezes a device on its next connection to the Absolute Monitoring Center on or after a specified date and time. This applies to Windows and Mac devices. The scheduled freeze date is specified in the scheduled_freeze_date argument. Scheduled Freeze requests are only supported on Windows and Mac devices with an active Absolute agent that is regularly connecting to the Absolute Monitoring Center. - Offline: Freezes a device if it has been offline for a specified period of time. Applies to Windows and Mac devices. Offline period is specified in the offline_time_seconds argument. Offline freeze is not available if your Absolute account has been migrated to Offline Freeze Rules. For more information, see the console Help.'
      name: device_freeze_type
      predefined:
      - 'OnDemand'
      - 'Scheduled'
      - 'OffLine'
      required: true
    - description: 'The date and time (in UTC) when the device should be frozen in ISO 8601 format: YYYY-MM-DDThh:mm:ss.SSSZ. Required if device_freeze_type is Scheduled. For example, 2022-01-01T00:00:00.000Z.'
      name: scheduled_freeze_date
    - description: 'The length of time (in seconds) that a device can be offline before the device is frozen. Required if device_freeze_type is Offline. Must be between 1200 seconds (20 minutes) and 172800000 seconds (2000 days). Default value is 30 days.'
      defaultValue: 22592000
      name: offline_time_seconds
    - auto: PREDEFINED
      description: 'The type of passcode to unfreeze a device. - UserDefined: Manually set the passcode in passcode. You must specify the passcode argument. - RandomForEach: A unique passcode is randomly generated for each device. You must specify the passcode_length argument. - RandomForAll: A passcode is randomly generated and is the same for all devices. You must specify the passcode_length argument.'
      name: passcode_type
      predefined:
      - 'UserDefined'
      - 'RandomForEach'
      - 'RandomForAll'
      required: true
    - description: 'The passcode used to unfreeze the devices. Required if passcode_type is UserDefined. A valid passcode is a number that has 4-8 characters. For example, 12345678.'
      name: passcode
    - description: 'The length of the passcode when it is randomly generated. Required if passcode_type is RandomForEach or RandomForAll. A valid passcode is a number from 4 - 8. For example, 8.'
      name: passcode_length
    - description: 'A comma-separated list of user-entered email addresses that will receive an email notification when the status of the Freeze request changes. The API supports up to 10 email addresses.'
      isArray: true
      name: notification_emails
    description: Creates a new Freeze request for the devices specified in the device_ids argument.
    name: absolute-device-freeze-request
    outputs:
    - contextPath: Absolute.FreezeRequest.RequestUID
      description: The system-defined, unique identifier of the Freeze request.
      type: String
    - contextPath: Absolute.FreezeRequest.SucceededDeviceUIDs
      description: An array of the unique devices identifiers that succeeded in creating a Freeze request.
      type: Unknown
    - contextPath: Absolute.FreezeRequest.Errors.detail.deviceUids
      description: An array of the unique identifiers of devices for the Freeze request error.
      type: Unknown
    - contextPath: Absolute.FreezeRequest.Errors.message
      description: The reason for the Freeze failure.
      type: String
    - contextPath: Absolute.FreezeRequest.Errors.messageKey
      description: The reference key for the error message.
      type: String
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: A comma-separated list of the unique identifiers of devices included in the request. The recommendation is to use up to 10,000 devices per request.
      isArray: true
      name: device_ids
      required: true
    - auto: PREDEFINED
      description: 'Whether to remove only a Scheduled Freeze request. Note: When setting to true, if the Freeze request is a Scheduled Freeze request, the Freeze request is removed. Otherwise, when setting to false, if the Freeze request is not a Scheduled Freeze request, the Freeze request is not removed.'
      name: remove_scheduled
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'Whether to remove only an Offline Freeze request. Note: When setting to true, if the Freeze request is an Offline Freeze request, the Freeze request is removed. Otherwise, when setting to false, if the Freeze request is not a Offline Freeze request, the Freeze request is not removed.'
      name: remove_offline
      predefined:
      - 'true'
      - 'false'
    description: 'Creates a new Remove Freeze request for one or more devices, regardless of their Freeze status. You can submit Remove Freeze requests to perform the following actions: unfreeze frozen devices, remove newly submitted Freeze requests, or remove outstanding Scheduled and Offline Freeze requests. In case of removing from offline:  In addition to creating a Remove Freeze request for devices with a status of Frozen by Condition: Offline, removes Offline Freeze requests from devices with a status of Freeze Requested or Freeze Condition - Offline Set. In case of not removing from offline: a Remove Freeze request is created for the devices but the Conditional - Offline Freeze request is not deleted (deprecated).'
    name: absolute-device-remove-freeze-request
  - arguments:
    - description: The system-defined, unique identifier of the Freeze request.
      name: request_uid
      required: true
    description: Gets detailed information about the Freeze request specified by request_uid.
    name: absolute-device-freeze-request-get
    outputs:
    - contextPath: Absolute.FreezeRequestDetail.ID
      description: The system-defined, unique identifier of the Freeze request.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.AccountUid
      description: The system-defined, unique identifier associated with this Absolute account.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.ActionRequestUid
      description: The system-defined, unique identifier of the Freeze request (the same as ID).
      type: String
    - contextPath: Absolute.FreezeRequestDetail.DeviceUid
      description: The system-defined, unique identifier of the device.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.actionUid
      description: The system-defined, unique identifier of the Freeze action.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.messageKey
      description: The reference key for the error message or the info message. Error messages start with 'dds'. Info messages start with 'ddsui'.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.messageParams
      description: A list of strings describing the error message when the status is LaunchFailed. If the status isn't LaunchFailed, messageParams is empty.
      type: Unknown
    - contextPath: Absolute.FreezeRequestDetail.Statuses.message
      description: The message for the status change that occurred.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.updatedBy
      description: The last entity to update the Freeze request.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.updatedDateTimeUtc
      description: The time (in Unix epoch) when the Freeze request was last updated.
      type: Date
    - contextPath: Absolute.FreezeRequestDetail.Statuses.triggerActionUid
      description: The system-defined, unique identifier of a new Freeze request that replaces another Freeze request of the same type.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.eventType
      description: Device freeze type event.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.ackClientTS
      description: The acknowledgment timestamp (in UNIX epoch local time) when the request was downloaded on the device.
      type: Number
    - contextPath: Absolute.FreezeRequestDetail.Statuses.ackClientDateTimeUtc
      description: The acknowledgment timestamp (in UNIX epoch UTC) when the request was downloaded to the device.
      type: Number
    - contextPath: Absolute.FreezeRequestDetail.Statuses.instruction
      description: All action instructions which are sent from the device DFZ agent component.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Statuses.scheduledFreezeDateTimeUtc
      description: The date and time (in Unix epoch) when a Scheduled Freeze request was scheduled to be performed.
      type: Number
    - contextPath: Absolute.FreezeRequestDetail.Configuration.messageName
      description: The user-defined name for the Freeze message.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.htmlClear
      description: The user-defined, HTML coded message shown on the device when the Freeze is applied (the same as Configuration.freezeMessage except it contains the HTML tags).
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.passcodeClear
      description: The passcode that can be used to unfreeze the device.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.passcodeOption
      description: The type of passcode to unfreeze a device.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.freezeMessage
      description: The content of the Freeze message without the HTML tags.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.freezeId
      description: The user-friendly identifier of the request that is displayed in the event history in the Absolute console (same as EventHistoryId).
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.configurationUid
      description: The system-defined unique identifier assigned to the Freeze configuration.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.action
      description: The type of action being performed on the device.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.type
      description: The type of Freeze.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.passcodeLength
      description: The length of the device unfreeze passcode when it is randomly generated.
      type: Number
    - contextPath: Absolute.FreezeRequestDetail.Configuration.passcodeSalt
      description: The salt used for hashing the passcode before the passcode is sent to the device.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.passcodeHashed
      description: The hashed value of the passcode.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.html
      description: The encoded value of Configuration.htmlClear.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Configuration.disableRemoteLogin
      description: Whether remote login is disabled on the device.
      type: Boolean
    - contextPath: Absolute.FreezeRequestDetail.Configuration.disableFileSharing
      description: Whether file sharing is disabled on the device.
      type: Boolean
    - contextPath: Absolute.FreezeRequestDetail.Configuration.Conditions.secondsUntilFreeze
      description: The amount of time (in seconds) a device can be offline before the device is frozen.
      type: Number
    - contextPath: Absolute.FreezeRequestDetail.Configuration.Conditions.scheduledFreezeDate
      description: The date and time (in UTC) when a Scheduled Freeze request is scheduled to be performed.
      type: Date
    - contextPath: Absolute.FreezeRequestDetail.Configuration.issuedDateTimeUTC
      description: The date and time (in UNIX epoch) when the Freeze request was created.
      type: Date
    - contextPath: Absolute.FreezeRequestDetail.Configuration.preLoginEnabled
      description: Whether pre-login is enabled on the device.
      type: Boolean
    - contextPath: Absolute.FreezeRequestDetail.Configuration.serviceControlList
      description: List of service controls that the server sends to the device.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Name
      description: The user-defined name for the Freeze request.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Requester
      description: The user ID of the entity that created the Freeze request.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.CreatedUTC
      description: The date and time (in UNIX epoch) when the Freeze request was created.
      type: Date
    - contextPath: Absolute.FreezeRequestDetail.ChangedUTC
      description: The date and time (in UNIX epoch) when the Freeze request was last modified.
      type: Date
    - contextPath: Absolute.FreezeRequestDetail.NotificationEmails
      description: An array of user-entered email addresses that will receive an email notification when the status of the Freeze request changes. Supports up to 10 email addresses.
      type: Unknown
    - contextPath: Absolute.FreezeRequestDetail.EventHistoryId
      description: The user-friendly identifier of the request that is displayed in the event history in the Absolute console (same as freezeId).
      type: String
    - contextPath: Absolute.FreezeRequestDetail.PolicyGroupUid
      description: The system-defined unique identifier of the policy group that the device belongs to.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.PolicyConfigurationVersion
      description: The version of the configuration for the policy.
      type: Number
    - contextPath: Absolute.FreezeRequestDetail.FreezePolicyUid
      description: The unique identifier of the Freeze policy.
      type: String
    - contextPath: Absolute.FreezeRequestDetail.Downloaded
      description: Whether the Freeze request has been downloaded to the device.
      type: Boolean
    - contextPath: Absolute.FreezeRequestDetail.IsCurrent
      description: Internal flag.
      type: Boolean
  - arguments:
    - description: The system-defined, unique identifier of the Freeze message.
      name: message_id
    - description: Maximum number of results to return.
      name: limit
      defaultValue: '50'
    - defaultValue: '0'
      description: The page number of the results to retrieve. Minimum value is 0.
      name: page
    description: Gets all the Freeze messages that are configured for the account by the given message_id. If message_id is not given all the messages will be returned.
    name: absolute-device-freeze-message-list
    outputs:
    - contextPath: Absolute.FreezeMessage.ID
      description: The system-defined, unique identifier of the Freeze message.
      type: String
    - contextPath: Absolute.FreezeMessage.Name
      description: The user-defined name for the Freeze message.
      type: String
    - contextPath: Absolute.FreezeMessage.Content
      description: The user-defined, HTML coded message that shows on a device when a Freeze is applied.
      type: String
    - contextPath: Absolute.FreezeMessage.CreatedBy
      description: The username of the entity that created the Freeze message.
      type: String
    - contextPath: Absolute.FreezeMessage.ChangedBy
      description: The username of the entity that last updated the Freeze message.
      type: String
    - contextPath: Absolute.FreezeMessage.CreatedUTC
      description: The date and time when the Freeze message was created.
      type: String
    - contextPath: Absolute.FreezeMessage.ChangedUTC
      description: The date and time when the Freeze message was last modified.
      type: String
  - arguments:
    - description: The user-defined, HTML coded message that shows on a device when a Device Freeze is applied. Should be in HTML format with 1-4000 characters.
      name: html_message
      required: true
    - description: The user-defined name for the Device Freeze message. The name should be a string with 1-255 characters.
      name: message_name
      required: true
    description: Creates a new Freeze message for the account.
    name: absolute-device-freeze-message-create
    outputs:
    - contextPath: Absolute.FreezeMessage.ID
      description: The system-defined, unique identifier of the Freeze message.
      type: String
  - arguments:
    - description: The user-defined, HTML coded message that shows on a device when a Device Freeze is applied. Should be in HTML format with 1-4000 characters.
      name: html_message
      required: true
    - description: The user-defined name for the Device Freeze message. The name should be a string with 1-255 characters.
      name: message_name
      required: true
    - description: The system-defined, unique identifier of the Freeze message.
      name: message_id
      required: true
    description: Updates the content of an existing Freeze message. Use absolute-device-freeze-message-list in order to get the message_id.
    name: absolute-device-freeze-message-update
  - arguments:
    - description: The system-defined, unique identifier of the Freeze message.
      name: message_id
      required: true
    description: Deletes an existing Freeze message for the account. Use absolute-device-freeze-message-list in order to get the message_id.
    name: absolute-device-freeze-message-delete
  - arguments:
    - description: A comma-separated list of device UIDs that should be unenrolled.
      isArray: true
      name: device_ids
      required: true
    - auto: PREDEFINED
      description: Whether to exclude missing devices or not.
      name: exclude_missing_devices
      predefined:
      - 'true'
      - 'false'
    description: Initiates an unenroll request on a list of eligible devices.
    name: absolute-device-unenroll
    outputs:
    - contextPath: Absolute.DeviceUnenroll.TotalDevices
      description: The total number of devices in the request.
      type: String
    - contextPath: Absolute.DeviceUnenroll.Pending
      description: The number of pending devices.
      type: Number
    - contextPath: Absolute.DeviceUnenroll.Processing
      description: The number of processing devices.
      type: Number
    - contextPath: Absolute.DeviceUnenroll.Completed
      description: 'The number of completed device unenroll.'
      type: Number
    - contextPath: Absolute.DeviceUnenroll.Canceled
      description: The number of canceled device unenroll.
      type: Number
    - contextPath: Absolute.DeviceUnenroll.Failed
      description: The number of failed device unenroll.
      type: Number
    - contextPath: Absolute.DeviceUnenroll.RequestId
      description: The unique ID identifier of the request.
      type: String
    - contextPath: Absolute.DeviceUnenroll.RequestUid
      description: The unique GUID identifier of the request.
      type: String
    - contextPath: Absolute.DeviceUnenroll.RequestStatus
      description: The status of the request.
      type: String
    - contextPath: Absolute.DeviceUnenroll.UpdatedDateTimeUtc
      description: The time (in Unix epoch) when the request was last updated.
      type: Date
    - contextPath: Absolute.DeviceUnenroll.CreatedDateTimeUtc
      description: The time (in Unix epoch) when the request was created.
      type: Date
    - contextPath: Absolute.DeviceUnenroll.Requester
      description: The requester of the request.
      type: String
    - contextPath: Absolute.DeviceUnenroll.ExcludeMissingDevices
      description: Whether the request includes missing devices or not.
      type: Boolean
    - contextPath: Absolute.DeviceUnenroll.Devices.DeviceUid
      description: The unique GUID identifier of the device.
      type: String
    - contextPath: Absolute.DeviceUnenroll.Devices.ActionUid
      description: The unique GUID identifier of the action.
      type: String
    - contextPath: Absolute.DeviceUnenroll.Devices.RequestUid
      description: The unique GUID identifier of the request.
      type: String
    - contextPath: Absolute.DeviceUnenroll.Devices.DeviceName
      description: The unique device name of the device.
      type: String
    - contextPath: Absolute.DeviceUnenroll.Devices.ActionStatus
      description: The status of the action.
      type: String
    - contextPath: Absolute.DeviceUnenroll.Devices.ESN
      description: The unique Electronic SerialNumber (ESN) that is assigned to the agent installed on the device.
      type: String
    - contextPath: Absolute.DeviceUnenroll.Devices.UpdatedDateTimeUtc
      description: The time (in Unix epoch) when the request was last updated.
      type: Date
    - contextPath: Absolute.DeviceUnenroll.Devices.CreatedDateTimeUtc
      description: The time (in Unix epoch) when the request was created.
      type: Date
  - arguments:
    - description: The query by which to filter the device applications. If this argument is set, it overrides the others. For example, appName eq 'someName' or availableVirtualMemoryBytes lt 1073741824.
      name: filter
    - description: A comma-separated list of all specific values to return. If not set, all possible values will be returned.
      isArray: true
      name: return_fields
    - description: A comma-separated list of the system-defined unique identifier of the devices.
      isArray: true
      name: device_ids
    - description: A comma-separated list of the devices names.
      isArray: true
      name: device_names
    - description: A comma-separated list of the application names.
      isArray: true
      name: app_names
    - description: A comma-separated list of the name of the software publishers of the application.
      isArray: true
      name: app_publishers
    - description: A comma-separated list of the user names of the users logged in to the device.
      isArray: true
      name: user_names
    - description: A comma-separated list of the operating systems that are installed on the device.
      isArray: true
      name: os
    - description: A comma-separated list of the system-defined unique Electronic Serial Numbers (ESN) assigned to the Absolute agent installed on the device.
      isArray: true
      name: esn
    - description: Maximum number of results to return.
      name: limit
      defaultValue: '50'
    - defaultValue: '0'
      description: The page number of the results to retrieve. Minimum value is 0.
      name: page
    description: Gets a list of device records and the corresponding software application data for each device on the account that you have access to or that meets the given filter.
    name: absolute-device-application-list
    outputs:
    - contextPath: Absolute.DeviceApplication.DeviceAppId
      description: The unique ID of the application.
      type: String
    - contextPath: Absolute.DeviceApplication.DeviceUid
      description: The system-defined unique identifier of the device.
      type: String
    - contextPath: Absolute.DeviceApplication.AppId
      description: The identifier of the application.
      type: String
    - contextPath: Absolute.DeviceApplication.AppName
      description: The name of the application.
      type: String
    - contextPath: Absolute.DeviceApplication.AppPublisher
      description: The name of the software publisher of the application.
      type: String
    - contextPath: Absolute.DeviceApplication.AppOriginalPublisher
      description: The original name of the software publisher of the application.
      type: String
    - contextPath: Absolute.DeviceApplication.AppVersion
      description: The version of the application.
      type: String
    - contextPath: Absolute.DeviceApplication.Ens
      description: The system-defined unique Electronic Serial Number (ESN) assigned to the Absolute agent installed on the device.
      type: String
    - contextPath: Absolute.DeviceApplication.DeviceName
      description: The name of the device.
      type: String
    - contextPath: Absolute.DeviceApplication.DeviceSerialNumber
      description: The identification number that is assigned to the device by the device manufacturer.
      type: String
    - contextPath: Absolute.DeviceApplication.UserName
      description: Includes the device name and the username of the user logged in to the device at the time of the agent call.
      type: String
    - contextPath: Absolute.DeviceApplication.InstallPath
      description: The location where the application is installed.
      type: String
    - contextPath: Absolute.DeviceApplication.InstallDate
      description: The date (in UNIX epoch time) when the application was installed.
      type: Date
    - contextPath: Absolute.DeviceApplication.FirstDetectUtc
      description: The date and time (in Unix epoch time) when the indicated version of the application was first detected on the device.
      type: Date
    - contextPath: Absolute.DeviceApplication.OsName
      description: The operating system that is installed on the device.
      type: String
    - contextPath: Absolute.DeviceApplication.LastScanTimeUtc
      description: The date and time (in Unix epoch time) of the most recent installed software (SNG) scan.
      type: Date
  - arguments:
    - description: The query by which to filter all the devices managed by the account. If this argument is set, it overrides the others. For example, agentStatus eq 'A' or lastConnectedUtc lt datetime'2021-01-01T00:00:00Z'.
      name: filter
    - auto: PREDEFINED
      description: The status of the Absolute agent on the device.
      name: agent_status
      predefined:
      - 'Active'
      - 'Disabled'
      - 'Inactive'
    - description: Short description of the operating system expressed as a one-line string that includes the version of the operating system.
      name: os_name
    - description: The version of the operating system.
      name: os_version
    - description: The manufacturer of the device.
      name: manufacturer
    - description: The product name from the manufacturer.
      name: model
    - description: A comma-separated list of the usernames of the users who were logged in to the device at the time of the most recent agent call. If no user was logged in during the last agent call, the last detected username is used.
      isArray: true
      name: user_names
    - defaultValue: '50'
      description: Maximum number of results to return.
      name: limit
    - defaultValue: '0'
      description: The page number of the results to retrieve. Minimum value is 0.
      name: page
    description: Gets a list of device records and their corresponding data that meets the required filter for all devices in your account, based on your authorization token.
    name: absolute-device-list
    outputs:
    - contextPath: Absolute.Device.Id
      description: The unique identifier assigned to the device.
      type: String
    - contextPath: Absolute.Device.Esn
      description: The unique ESN (Absolute Identifier) assigned to the agent installed on the device.
      type: String
    - contextPath: Absolute.Device.LastConnectedUtc
      description: The date and time (in Unix epoch) when the device last connected to the Absolute Monitoring Center.
      type: Number
    - contextPath: Absolute.Device.SystemName
      description: The name assigned to the device.
      type: String
    - contextPath: Absolute.Device.FullSystemName
      description: The full name assigned to the device consisting of the system name and the domain name.
      type: String
    - contextPath: Absolute.Device.AgentStatus
      description: The status of the Absolute agent on the device.
      type: String
    - contextPath: Absolute.Device.osName
      description: Short description of the operating system expressed as a one-line string that includes the version of the operating system.
      type: String
    - contextPath: Absolute.Device.SystemManufacturer
      description: The manufacturer of the device.
      type: String
    - contextPath: Absolute.Device.SystemModel
      description: The product name from the manufacturer.
      type: String
    - contextPath: Absolute.Device.SystemType
      description: The system running on the Windows-based computer.
      type: String
    - contextPath: Absolute.Device.Serial
      description: The manufacturer-defined unique identifier assigned to the device. May correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.
      type: String
    - contextPath: Absolute.Device.LocalIp
      description: Last known local IP address of this device.
      type: String
    - contextPath: Absolute.Device.PublicIp
      description: Last known public IP address of this device.
      type: String
    - contextPath: Absolute.Device.EncryptionStatus
      description: The summarized encryption status of the device.
      type: String
  - arguments:
    - description: A comma-separated list of all specific values to return.
      isArray: true
      name: fields
    - description: A comma-separated list of the system-defined unique identifier of the devices.
      isArray: true
      name: device_ids
    - description: A comma-separated list of the devices names.
      isArray: true
      name: device_names
    - description: A comma-separated list of the last known local IP addresses of a device.
      isArray: true
      name: local_ips
    - description: A comma-separated list of the last known public IP addresses of a device.
      isArray: true
      name: public_ips
    description: Gets a list of device records and their corresponding data that meets the required fields for all devices in your account. Note that the command supports returning a maximum of 500 distinct devices.
    name: absolute-device-get
    outputs:
    - contextPath: Absolute.Device.Id
      description: The unique identifier assigned to the device.
      type: String
    - contextPath: Absolute.Device.Esn
      description: The unique ESN (Absolute Identifier) assigned to the agent installed on the device.
      type: String
    - contextPath: Absolute.Device.Domain
      description: The name of the Windows domain to which this device belongs.
      type: String
    - contextPath: Absolute.Device.LastConnectedUtc
      description: The date and time (in Unix epoch) when the device last connected to the Absolute Monitoring Center.
      type: Number
    - contextPath: Absolute.Device.SystemName
      description: The name assigned to the device.
      type: String
    - contextPath: Absolute.Device.FullSystemName
      description: The full name assigned to the device consisting of the system name and the domain name.
      type: String
    - contextPath: Absolute.Device.AgentStatus
      description: The status of the Absolute agent on the device.
      type: String
    - contextPath: Absolute.Device.Os.name
      description: Short description of the operating system expressed as a one-line string that includes the version of the operating system.
      type: String
    - contextPath: Absolute.Device.Os.version
      description: The version of the operating system.
      type: String
    - contextPath: Absolute.Device.Os.currentBuild
      description: The current build number of the operating system.
      type: String
    - contextPath: Absolute.Device.Os.architecture
      description: The architecture of the operating system.
      type: String
    - contextPath: Absolute.Device.Os.installDate
      description: The date and time (in Unix epoch) when the operating system was installed.
      type: Number
    - contextPath: Absolute.Device.Os.productKey
      description: The product key of the operating system.
      type: String
    - contextPath: Absolute.Device.Os.serialNumber
      description: The serial identification number of the operating system.
      type: String
    - contextPath: Absolute.Device.Os.lastBootTime
      description: The date and time (in Unix epoch) when the operating system was last restarted.
      type: Number
    - contextPath: Absolute.Device.Bios.id
      description: The unique identifier of this BIOS given by the manufacturer.
      type: String
    - contextPath: Absolute.Device.Bios.serialNumber
      description: The serial number assigned to the BIOS.
      type: String
    - contextPath: Absolute.Device.Bios.smBiosVersion
      description: The major version number of the BIOS, as reported by SMBIOS.
      type: String
    - contextPath: Absolute.Device.Bios.version
      description: The version of the BIOS, as reported by SMBIOS.
      type: String
    - contextPath: Absolute.Device.Bios.versionDate
      description: A substring of the manufacturer of the BIOS + the version of the BIOS version, as reported by SMBIOS + the release date of the Window BIOS.
      type: String
    - contextPath: Absolute.Device.SystemManufacturer
      description: The manufacturer of the device.
      type: String
    - contextPath: Absolute.Device.SystemModel
      description: The product name from the manufacturer.
      type: String
    - contextPath: Absolute.Device.SystemType
      description: The system running on the Windows-based computer.
      type: String
    - contextPath: Absolute.Device.Serial
      description: The manufacturer-defined unique identifier assigned to the device. May correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.
      type: String
    - contextPath: Absolute.Device.LocalIp
      description: Last known local IP address of this device.
      type: String
    - contextPath: Absolute.Device.PublicIp
      description: Last known public IP address of this device.
      type: String
    - contextPath: Absolute.Device.EncryptionStatus
      description: The summarized encryption status of the device.
      type: String
    - contextPath: Absolute.Device.Username
      description: The unique username of the user that was logged in to the device at the time of the most recent agent call.
      type: String
    - contextPath: Absolute.Device.PolicyGroupUid
      description: The unique identifier of the policy group that the device belongs to.
      type: String
    - contextPath: Absolute.Device.PolicyGroupName
      description: The name of the policy group that the device belongs to.
      type: String
    - contextPath: Absolute.Device.IsStolen
      description: Indicates whether this device was reported as stolen.
      type: String
    - contextPath: Absolute.Device.DeviceStatus.type
      description: The status of the device. Possible values are STOLEN or MISSING.
      type: String
    - contextPath: Absolute.Device.DeviceStatus.reported
      description: The data and time (in Unix epoch) when the device was reported missing or stolen.
      type: Number
    - contextPath: Absolute.Device.NetworkAdapters.networkSSID
      description: The Service Set Identifier (SSID) of the connected Wi-Fi adapter.
      type: String
  - arguments:
    - description: A comma-separated list of the system-defined unique identifier of the devices.
      isArray: true
      name: device_ids
      required: true
    description: Gets a list of devices geo location records and their corresponding data that meets the required devices IDs.
    name: absolute-device-location-get
    outputs:
    - contextPath: Absolute.LocationReport.Coordinates
      description: A comma-separated list where the first number is the estimated latitude and the second number is the estimated longitude (in degrees) where the device is located.
      type: Unknown
    - contextPath: Absolute.LocationReport.ID
      description: The system-defined unique identifier of the device.
      type: String
    - contextPath: Absolute.LocationReport.City
      description: The city where the device is located.
      type: String
    - contextPath: Absolute.LocationReport.State
      description: The state or province where the device is located.
      type: String
    - contextPath: Absolute.LocationReport.CountryCode
      description: The country code for the country where the device is located.
      type: String
    - contextPath: Absolute.LocationReport.Country
      description: The country where the device is located.
      type: String
    - contextPath: Absolute.LocationReport.LocationTechnology
      description: The technology used to get the location.
      type: String
    - contextPath: Absolute.LocationReport.Accuracy
      description: The estimated accuracy (in meters) of the technology used to locate the device.
      type: Number
    - contextPath: Absolute.LocationReport.LastUpdate
      description: The date and time (in Unix epoch) when the device last changed its location.
      type: Number
  - arguments:
    - name: should_push_events
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
    - name: start_date
      description: Filters the results to the records on or after the start date.
    - name: end_date
      description: Filters the results to the records until the end date.
    - name: limit
      description: The maximum number of records to return per page. Note, this may be restricted by fixed system limits.
    name: absolute-device-get-events
    description: Retrieves a list of events from the Absolute instance.
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/auth-utils:1.0.0.10133006
  isfetchevents: true
  isfetchevents:xsoar: false
fromversion: 6.0.0
tests:
- Absolute_TestPlaybook