GitHub IAM

Integrate with GitHub services to perform Identity Lifecycle Management operations.

Identity and Access Management · GitHub

Details

IDGitHub IAM
ProviderMicrosoft
CategoryIdentity and Access Management
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Note: This integration should be used as part of our IAM premium pack. For further details, visit our IAM pack documentation.
GitHub Integration consists of a set of API endpoints that enable you to automate provisioning of GitHub organization membership.
This integration was integrated and tested with version v2 of GitHub IT Admin.
For more information, please refer to the Identity Lifecycle Management article.

Configure GitHub IT Admin on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for GitHub IT Admin.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
GitHub URL https://<domain>.github.com/   True
Token   False
Organization name   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Allow creating users   False
Allow updating users   False
Allow disabling users   False
Automatically create user if not found in update and enable commands   False
Incoming Mapper   True
Outgoing Mapper Cortex XSOAR only parameter. False
  • To allow the integration to access the mapper from within the code, as required by the ILM pack, both mappers have to be configured in their proper respective fields and not in the “Mapper (outgoing)” dropdown list selector.
  1. Click Test to check that you are able to connect to the integration.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-create-user

Creates a user.

Base Command

iam-create-user

Input

Argument Name Description Required
user-profile User Profile indicator details. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean If true, the employee’s status is active, otherwise false.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Indicates if the API was successful or provides error information.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean If true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-create-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\", \"lastname\":\"Test\",\"firstname\":\"Demisto\"}

Human Readable Output

Create User Results (GitHub IT Admin)

brand instanceName success active id username email details
GitHub IT Admin GitHub IT Admin_instance_1 true true 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:54:30.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto44@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“suspend”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/suspend”, “method”: “POST”}, “schema”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/schemas/user/osc8zfz6plq7b0r830h7”}, “resetPassword”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reset_password”, “method”: “POST”}, “reactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reactivate”, “method”: “POST”}, “self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}, “type”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/types/user/oty8zfz6plq7b0r830h7”}, “deactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/deactivate”, “method”: “POST”}}

iam-update-user

Updates an existing user with the data passed in the user-profile argument.

Base Command

iam-update-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required
create-if-not-exists When true, the user will be created when the passed User Profile doesn’t exist in Active Directory. Default is ‘true’. Optional

Context Output

Path Type Description
IAM.Vendor.active Boolean If true, indicates that the employee’s status is active.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Indicates if the API was successful or provides error information.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean If true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-update-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\", \"firstname\":\"Demisto-Test\"}

Human Readable Output

Update User Results (GitHub IT Admin)

brand instanceName success active id username email details
GitHub IT Admin GitHub IT Admin_instance_1 true true 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:56:53.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto-Test”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto2@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“suspend”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/suspend”, “method”: “POST”}, “schema”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/schemas/user/osc8zfz6plq7b0r830h7”}, “resetPassword”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reset_password”, “method”: “POST”}, “reactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reactivate”, “method”: “POST”}, “self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}, “type”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/types/user/oty8zfz6plq7b0r830h7”}, “deactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/deactivate”, “method”: “POST”}}

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean If true, indicates that the employee’s status is active.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Indicates if the API was successful or provides error information.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean If true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-get-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\"}

Human Readable Output

Get User Results (GitHub IT Admin)

brand instanceName success active id username email details
GitHub IT Admin GitHub IT Admin_instance_1 true true 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:56:53.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto-Test”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto2@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“suspend”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/suspend”, “method”: “POST”}, “schema”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/schemas/user/osc8zfz6plq7b0r830h7”}, “resetPassword”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reset_password”, “method”: “POST”}, “reactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/reactivate”, “method”: “POST”}, “self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}, “type”: {“href”: “https://panw-test.oktapreview.com/api/v1/meta/types/user/oty8zfz6plq7b0r830h7”}, “deactivate”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7/lifecycle/deactivate”, “method”: “POST”}}

iam-disable-user

Deletes an active user.

Base Command

iam-disable-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean If true, indicates that the employee’s status is active.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Indicates if the API was successful or provides error information.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean If true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-disable-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\"}

Human Readable Output

Disable User Results (GitHub IT Admin)

brand instanceName success active id username email details
GitHub IT Admin GitHub IT Admin_instance_1 true false 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: PROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:56:53.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto-Test”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto2@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}}

iam-enable-user

Create a deprovisioned user.

Base Command

iam-enable-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required
create-if-not-exists When true, the user will be created when the passed User Profile doesn’t exist in AD. Default is ‘true’. Optional

Context Output

Path Type Description
IAM.Vendor.active Boolean If true, indicates that the employee’s status is active.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Indicates if the API was successful or provides error information.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean If true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command Example

!iam-enable-user user-profile={\"email\":\"testdemisto2@paloaltonetworks.com\"}

Human Readable Output

Enable User Results (GitHub IT Admin)

brand instanceName success active id username email details
GitHub IT Admin GitHub IT Admin_instance_1 true true 00uujxnbh3uJw4tWA0h7 testdemisto2@paloaltonetworks.com testdemisto2@paloaltonetworks.com id: 00uujxnbh3uJw4tWA0h7
status: DEPROVISIONED
created: 2020-10-18T17:54:30.000Z
activated: 2020-10-18T17:54:30.000Z
statusChanged: 2020-10-18T17:54:30.000Z
lastLogin: null
lastUpdated: 2020-10-18T17:56:53.000Z
passwordChanged: null
type: {“id”: “oty8zfz6plq7b0r830h7”}
profile: {“firstName”: “Demisto-Test”, “lastName”: “Test”, “mobilePhone”: null, “secondEmail”: null, “login”: “testdemisto2@paloaltonetworks.com”, “email”: “testdemisto2@paloaltonetworks.com”}
credentials: {“provider”: {“type”: “OKTA”, “name”: “OKTA”}}
_links: {“self”: {“href”: “https://panw-test.oktapreview.com/api/v1/users/00uujxnbh3uJw4tWA0h7”}}

Configuration parameters

  • url — GitHub URL https://<domain>.github.com/ (required)
  • creds_token —
  • token — Token
  • org — Organization name (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • create-user-enabled — Allow creating users
  • update-user-enabled — Allow updating users
  • disable-user-enabled — Allow disabling users
  • create-if-not-exists — Automatically create user if not found in update and enable commands
  • mapper_in — Incoming Mapper (required)
  • mapper_out — Outgoing Mapper

Commands (5)

  • get-mapping-fields

    Retrieves a User Profile schema which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.

  • iam-create-user

    Creates a user.

  • iam-disable-user

    Disable an active user.

  • iam-get-user

    Retrieves a single user resource.

  • iam-update-user

    Updates an existing user with the data passed in the user-profile argument.

Source

GitHub_IAM.py GitHub_IAM_test.py GitHub_IAM.yml GitHub_IAM_description.md command_examples.txt
Download History Raw 
category: Identity and Access Management
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: GitHub IAM
  version: -1
configuration:
- display: GitHub URL https://<domain>.github.com/
  name: url
  required: true
  type: 0
  section: Connect
- name: creds_token
  type: 9
  displaypassword: Token
  hiddenusername: true
  section: Connect
  required: false
- display: Token
  name: token
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: Organization name
  name: org
  required: true
  type: 0
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow creating users
  name: create-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow updating users
  name: update-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow disabling users
  name: disable-user-enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Automatically create user if not found in update and enable commands
  name: create-if-not-exists
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: User Profile - SCIM (Incoming)
  display: Incoming Mapper
  name: mapper_in
  required: true
  type: 0
  section: Connect
- defaultvalue: User Profile - SCIM (Outgoing)
  display: Outgoing Mapper
  name: mapper_out
  required: false
  type: 0
  section: Connect
  hidden:
  - marketplacev2
  - platform
  additionalinfo: Cortex XSOAR only parameter.
description: Integrate with GitHub services to perform Identity Lifecycle Management operations.
display: GitHub IAM
name: GitHub IAM
script:
  commands:
  - arguments:
    - description: User Profile indicator details.
      name: user-profile
      required: true
    description: Creates a user.
    execution: true
    name: iam-create-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: If true, the employee's status is active, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Indicates if the API was successful or provides error information.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: If true, the command was executed successfully, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Updates an existing user with the data passed in the user-profile argument.
    execution: true
    name: iam-update-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: If true, the employee's status is active, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Indicates if the API was successful or provides error information.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: If true, the command was executed successfully, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Retrieves a single user resource.
    name: iam-get-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: If true, the employee's status is active, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Indicates if the API was successful or provides error information.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: If true, the command was executed successfully, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Disable an active user.
    execution: true
    name: iam-disable-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: If true, the employee's status is active, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Indicates if the API was successful or provides error information.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: If true, the command was executed successfully, otherwise false.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - description: Retrieves a User Profile schema which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
    name: get-mapping-fields
  dockerimage: demisto/python3:3.12.13.10116658
  ismappable: true
  isremotesyncout: true
  script: '-'
  subtype: python3
  type: python
tests:
- Github IAM - Test Playbook
fromversion: 6.0.0