Envoy IAM

Details

ID	`Envoy IAM`
Provider	BeyondTrust
Category	Authentication & Identity Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Integrate with Envoy Identity Access Management services to execute CRUD operations to employee lifecycle processes.
This integration was integrated and tested with version v2 of Envoy SCIM API.

Configure Envoy IAM in Cortex

Parameter	Description	Required
Base URL		True
API Key		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Allow creating users		False
Allow updating users		False
Allow enabling users		False
Allow disabling users		False
Automatically create user if not found in update command		False
Incoming Mapper		True
Outgoing Mapper	Cortex XSOAR only parameter.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-create-user

Creates a user.

Base Command

iam-create-user

Input

Argument Name	Description	Required
user-profile	User Profile indicator details.	Required
allow-enable	When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true.	Optional

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-create-user user-profile=`{"email": "john.doe@example.com", "givenname": "test", "surname": "test"}`

Human Readable Output

iam-update-user

Updates an existing user with the data passed in the user-profile argument.

Base Command

iam-update-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required
allow-enable	When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true.	Optional

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-update-user user-profile=`{"email": "john.doe@example.com", "givenname": "John"}`

Human Readable Output

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-get-user user-profile=`{"email": "john.doe@example.com"}`

Human Readable Output

iam-disable-user

Disable an active user.

Base Command

iam-disable-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-disable-user user-profile=`{"email": "john.doe@example.com", "givenname": "John"}`

Human Readable Output

Configuration parameters

url — Base URL (required)
api_key — API Key
credentials_api_key —
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
create_user_enabled — Allow creating users
update_user_enabled — Allow updating users
enable_user_enabled — Allow enabling users
disable_user_enabled — Allow disabling users
create_if_not_exists — Automatically create user if not found in update command
mapper_in — Incoming Mapper (required)
mapper_out — Outgoing Mapper

Commands (5)

get-mapping-fields
Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
iam-create-user
Creates a user.
iam-disable-user
Disable an active user.
iam-get-user
Retrieves a single user resource.
iam-update-user
Updates an existing user with the data passed in the user-profile argument.

Source

EnvoyIAM.py EnvoyIAM_test.py EnvoyIAM.yml EnvoyIAM_description.md command_examples.txt

Download History Raw

category: Authentication & Identity Management
provider: BeyondTrust
commonfields:
  id: Envoy IAM
  version: -1
configuration:
- display: Base URL
  name: url
  required: true
  type: 0
- display: API Key
  name: api_key
  type: 4
  hidden: true
  required: false
- displaypassword: API Key
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- defaultvalue: 'true'
  display: Allow creating users
  name: create_user_enabled
  type: 8
  required: false
- defaultvalue: 'true'
  display: Allow updating users
  name: update_user_enabled
  type: 8
  required: false
- defaultvalue: 'true'
  display: Allow enabling users
  name: enable_user_enabled
  type: 8
  required: false
- defaultvalue: 'true'
  display: Allow disabling users
  name: disable_user_enabled
  type: 8
  required: false
- defaultvalue: 'true'
  display: Automatically create user if not found in update command
  name: create_if_not_exists
  type: 8
  required: false
- defaultvalue: User Profile - SCIM (Incoming)
  display: Incoming Mapper
  name: mapper_in
  required: true
  type: 0
- defaultvalue: User Profile - SCIM (Outgoing)
  display: Outgoing Mapper
  name: mapper_out
  required: false
  type: 0
  additionalinfo: Cortex XSOAR only parameter.
  hidden:
  - marketplacev2
  - platform
description: Integrate with Envoy Identity Access Management services to execute CRUD operations to employee lifecycle processes.
display: Envoy IAM
name: Envoy IAM
script:
  commands:
  - arguments:
    - description: User Profile indicator details.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Creates a user.
    execution: true
    name: iam-create-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Updates an existing user with the data passed in the user-profile argument.
    execution: true
    name: iam-update-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Retrieves a single user resource.
    name: iam-get-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Disable an active user.
    execution: true
    name: iam-disable-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - description: Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
    name: get-mapping-fields
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncout: true
tests:
- No tests
fromversion: 6.0.0