Slack IAM

Details

ID	`Slack IAM`
Provider	Slack
Category	Identity and Access Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix Cortex Cloud Cloud Runtime Security Cloud Posture Security XSIAM EDR

README

Note: This integration should be used as part of our Identity Lifecycle Management premium pack. For further details, visit our IAM pack documentation.

Integrate with Slack’s services to execute CRUD operations for employee lifecycle processes.
For more information, please refer to the Identity Lifecycle Management article.

Configure Slack IAM in Cortex

Parameter	Description	Required
Access Token		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Allow creating users	If set to false, iam-create-user command will be skipped, and user will not be created.	False
Allow updating users		False
Allow enabling users		False
Allow disabling users		False
Automatically create user if not found in update command		False
Incoming Mapper		True
Outgoing Mapper	Cortex XSOAR only parameter.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-create-user

Creates a user.

Base Command

iam-create-user

Input

Argument Name	Description	Required
user-profile	User Profile indicator details.	Required
allow-enable	When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true.	Optional

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-create-user user-profile=`{"emails": ["testdemistomock15@paloaltonetworks.com"], "userName": "testuser15"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "emails": [
                "testdemistomock15@paloaltonetworks.com"
            ],
            "userName": "testuser15"
        },
        "Vendor": {
            "action": "create",
            "active": true,
            "brand": "Slack IAM",
            "details": {
                "active": true,
                "displayName": "testuser15",
                "emails": [
                    {
                        "primary": true,
                        "value": "testdemistomock15@paloaltonetworks.com"
                    }
                ],
                "externalId": "",
                "groups": [],
                "id": "U01KGD53152",
                "meta": {
                    "created": "2021-01-20T08:15:37-08:00",
                    "location": "https://api.slack.com/scim/v1/Users/U01KGD53152"
                },
                "name": {
                    "familyName": "",
                    "givenName": "testuser15"
                },
                "nickName": "testuser15",
                "photos": [
                    {
                        "type": "photo",
                        "value": "https://secure.gravatar.com/avatar/17de069a77ac9bf8c47f0c9a4893f598.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0005-192.png"
                    }
                ],
                "profileUrl": "https://panwtest.enterprise.slack.com/team/testuser15",
                "schemas": [
                    "urn:scim:schemas:core:1.0"
                ],
                "timezone": "America/Los_Angeles",
                "title": "",
                "userName": "testuser15"
            },
            "email": null,
            "errorCode": null,
            "errorMessage": "",
            "id": "U01KGD53152",
            "instanceName": "Slack IAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": "testuser15"
        }
    }
}

Human Readable Output

Create User Results (Slack IAM)

brand instanceName success active id username details

Slack IAM Slack IAM_instance_1 true true U01KGD53152 testuser15 schemas: urn:scim:schemas:core:1.0
id: U01KGD53152
externalId:
meta: {“created”: “2021-01-20T08:15:37-08:00”, “location”: “https://api.slack.com/scim/v1/Users/U01KGD53152”}
userName: testuser15
nickName: testuser15
name: {“givenName”: “testuser15”, “familyName”: “”}
displayName: testuser15
profileUrl: https://panwtest.enterprise.slack.com/team/testuser15
title:
timezone: America/Los_Angeles
active: true
emails: {‘value’: ‘testdemistomock15@paloaltonetworks.com’, ‘primary’: True}
photos: {‘value’: ‘https://secure.gravatar.com/avatar/17de069a77ac9bf8c47f0c9a4893f598.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0005-192.png’, ‘type’: ‘photo’}
groups:

brand	instanceName	success	active	id	username	details
Slack IAM	Slack IAM_instance_1	true	true	U01KGD53152	testuser15	schemas: urn:scim:schemas:core:1.0 id: U01KGD53152 externalId: meta: {“created”: “2021-01-20T08:15:37-08:00”, “location”: “https://api.slack.com/scim/v1/Users/U01KGD53152”} userName: testuser15 nickName: testuser15 name: {“givenName”: “testuser15”, “familyName”: “”} displayName: testuser15 profileUrl: https://panwtest.enterprise.slack.com/team/testuser15 title: timezone: America/Los_Angeles active: true emails: {‘value’: ‘testdemistomock15@paloaltonetworks.com’, ‘primary’: True} photos: {‘value’: ‘https://secure.gravatar.com/avatar/17de069a77ac9bf8c47f0c9a4893f598.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0005-192.png’, ‘type’: ‘photo’} groups:

iam-update-user

Updates an existing user with the data passed in the user-profile argument.

Base Command

iam-update-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required
allow-enable	When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true.	Optional

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-update-user user-profile=`{"email": "testtesting@paloaltonetworks.com", "active": "true"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "active": "true",
            "email": "testtesting@paloaltonetworks.com"
        },
        "Vendor": {
            "action": "update",
            "active": true,
            "brand": "Slack IAM",
            "details": {
                "active": true,
                "displayName": "powershelly12",
                "emails": [
                    {
                        "primary": true,
                        "value": "testtesting@paloaltonetworks.com"
                    }
                ],
                "externalId": "",
                "groups": [],
                "id": "U01JYDGBC3Y",
                "meta": {
                    "created": "2021-01-19T07:41:11-08:00",
                    "location": "https://api.slack.com/scim/v1/Users/U01JYDGBC3Y"
                },
                "name": {
                    "familyName": "",
                    "givenName": "powershelly12"
                },
                "nickName": "powershelly12",
                "photos": [
                    {
                        "type": "photo",
                        "value": "https://secure.gravatar.com/avatar/5f359e3923fc928897380e3e90cb980e.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0007-192.png"
                    }
                ],
                "profileUrl": "https://panwtest.enterprise.slack.com/team/powershelly12",
                "schemas": [
                    "urn:scim:schemas:core:1.0"
                ],
                "timezone": "America/Los_Angeles",
                "title": "",
                "userName": "powershelly12"
            },
            "email": "testtesting@paloaltonetworks.com",
            "errorCode": null,
            "errorMessage": "",
            "id": "U01JYDGBC3Y",
            "instanceName": "Slack IAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": "powershelly12"
        }
    }
}

Human Readable Output

Update User Results (Slack IAM)

brand instanceName success active id username email details

Slack IAM Slack IAM_instance_1 true true U01JYDGBC3Y powershelly12 testtesting@paloaltonetworks.com schemas: urn:scim:schemas:core:1.0
id: U01JYDGBC3Y
externalId:
meta: {“created”: “2021-01-19T07:41:11-08:00”, “location”: “https://api.slack.com/scim/v1/Users/U01JYDGBC3Y”}
userName: powershelly12
nickName: powershelly12
name: {“givenName”: “powershelly12”, “familyName”: “”}
displayName: powershelly12
profileUrl: https://panwtest.enterprise.slack.com/team/powershelly12
title:
timezone: America/Los_Angeles
active: true
emails: {‘value’: ‘testtesting@paloaltonetworks.com’, ‘primary’: True}
photos: {‘value’: ‘https://secure.gravatar.com/avatar/5f359e3923fc928897380e3e90cb980e.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0007-192.png’, ‘type’: ‘photo’}
groups:

brand	instanceName	success	active	id	username	email	details
Slack IAM	Slack IAM_instance_1	true	true	U01JYDGBC3Y	powershelly12	testtesting@paloaltonetworks.com	schemas: urn:scim:schemas:core:1.0 id: U01JYDGBC3Y externalId: meta: {“created”: “2021-01-19T07:41:11-08:00”, “location”: “https://api.slack.com/scim/v1/Users/U01JYDGBC3Y”} userName: powershelly12 nickName: powershelly12 name: {“givenName”: “powershelly12”, “familyName”: “”} displayName: powershelly12 profileUrl: https://panwtest.enterprise.slack.com/team/powershelly12 title: timezone: America/Los_Angeles active: true emails: {‘value’: ‘testtesting@paloaltonetworks.com’, ‘primary’: True} photos: {‘value’: ‘https://secure.gravatar.com/avatar/5f359e3923fc928897380e3e90cb980e.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0007-192.png’, ‘type’: ‘photo’} groups:

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-get-user user-profile=`{"email": "testdemistomock@paloaltonetworks.com", "userName": "powershelly10"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "active": false,
            "displayName": "powershelly10",
            "emails": [
                {
                    "primary": true,
                    "value": "testdemistomock@paloaltonetworks.com"
                }
            ],
            "externalId": "",
            "groups": [],
            "id": "U01KHS7J7U1",
            "meta": {
                "created": "2021-01-19T07:46:20-08:00",
                "location": "https://api.slack.com/scim/v1/Users/U01KHS7J7U1"
            },
            "name": {
                "familyName": "",
                "givenName": "powershelly10"
            },
            "nickName": "powershelly10",
            "photos": [
                {
                    "type": "photo",
                    "value": "https://secure.gravatar.com/avatar/e14bda84be03871922c78d0d03caa901.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0006-192.png"
                }
            ],
            "profileUrl": "https://panwtest.enterprise.slack.com/team/powershelly10",
            "schemas": [
                "urn:scim:schemas:core:1.0"
            ],
            "timezone": "America/Los_Angeles",
            "title": "",
            "userName": "powershelly10"
        },
        "Vendor": {
            "action": "get",
            "active": false,
            "brand": "Slack IAM",
            "details": {
                "active": false,
                "displayName": "powershelly10",
                "emails": [
                    {
                        "primary": true,
                        "value": "testdemistomock@paloaltonetworks.com"
                    }
                ],
                "externalId": "",
                "groups": [],
                "id": "U01KHS7J7U1",
                "meta": {
                    "created": "2021-01-19T07:46:20-08:00",
                    "location": "https://api.slack.com/scim/v1/Users/U01KHS7J7U1"
                },
                "name": {
                    "familyName": "",
                    "givenName": "powershelly10"
                },
                "nickName": "powershelly10",
                "photos": [
                    {
                        "type": "photo",
                        "value": "https://secure.gravatar.com/avatar/e14bda84be03871922c78d0d03caa901.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0006-192.png"
                    }
                ],
                "profileUrl": "https://panwtest.enterprise.slack.com/team/powershelly10",
                "schemas": [
                    "urn:scim:schemas:core:1.0"
                ],
                "timezone": "America/Los_Angeles",
                "title": "",
                "userName": "powershelly10"
            },
            "email": "testdemistomock@paloaltonetworks.com",
            "errorCode": null,
            "errorMessage": "",
            "id": "U01KHS7J7U1",
            "instanceName": "Slack IAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": "powershelly10"
        }
    }
}

Human Readable Output

Get User Results (Slack IAM)

brand instanceName success active id username email details

Slack IAM Slack IAM_instance_1 true false U01KHS7J7U1 powershelly10 testdemistomock@paloaltonetworks.com schemas: urn:scim:schemas:core:1.0
id: U01KHS7J7U1
externalId:
meta: {“created”: “2021-01-19T07:46:20-08:00”, “location”: “https://api.slack.com/scim/v1/Users/U01KHS7J7U1”}
userName: powershelly10
nickName: powershelly10
name: {“givenName”: “powershelly10”, “familyName”: “”}
displayName: powershelly10
profileUrl: https://panwtest.enterprise.slack.com/team/powershelly10
title:
timezone: America/Los_Angeles
active: false
emails: {‘value’: ‘testdemistomock@paloaltonetworks.com’, ‘primary’: True}
photos: {‘value’: ‘https://secure.gravatar.com/avatar/e14bda84be03871922c78d0d03caa901.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0006-192.png’, ‘type’: ‘photo’}
groups:

iam-disable-user

Disable an active user.

Base Command

iam-disable-user

Input

Argument Name	Description	Required
user-profile	A User Profile indicator.	Required

Context Output

Path	Type	Description
IAM.Vendor.active	Boolean	When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand	String	Name of the integration.
IAM.Vendor.details	string	Provides the raw data from the 3rd-party integration.
IAM.Vendor.email	String	The employee’s email address.
IAM.Vendor.errorCode	Number	HTTP error response code.
IAM.Vendor.errorMessage	String	Reason why the API failed.
IAM.Vendor.id	String	The employee’s user ID in the app.
IAM.Vendor.instanceName	string	Name of the integration instance.
IAM.Vendor.success	Boolean	When true, indicates that the command was executed successfully.
IAM.Vendor.username	String	The employee’s username in the app.

Command Example

!iam-disable-user user-profile=`{"email": "testdemistomock@paloaltonetworks.com", "userName": "powershelly10"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "email": "testdemistomock@paloaltonetworks.com",
            "userName": "powershelly10"
        },
        "Vendor": {
            "action": "disable",
            "active": false,
            "brand": "Slack IAM",
            "details": {
                "active": false,
                "displayName": "powershelly10",
                "emails": [
                    {
                        "primary": true,
                        "value": "testdemistomock@paloaltonetworks.com"
                    }
                ],
                "externalId": "",
                "groups": [],
                "id": "U01KHS7J7U1",
                "meta": {
                    "created": "2021-01-19T07:46:20-08:00",
                    "location": "https://api.slack.com/scim/v1/Users/U01KHS7J7U1"
                },
                "name": {
                    "familyName": "",
                    "givenName": "powershelly10"
                },
                "nickName": "powershelly10",
                "photos": [
                    {
                        "type": "photo",
                        "value": "https://secure.gravatar.com/avatar/e14bda84be03871922c78d0d03caa901.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0006-192.png"
                    }
                ],
                "profileUrl": "https://panwtest.enterprise.slack.com/team/powershelly10",
                "schemas": [
                    "urn:scim:schemas:core:1.0"
                ],
                "timezone": "America/Los_Angeles",
                "title": "",
                "userName": "powershelly10"
            },
            "email": "testdemistomock@paloaltonetworks.com",
            "errorCode": null,
            "errorMessage": "",
            "id": "U01KHS7J7U1",
            "instanceName": "Slack IAM_instance_1",
            "reason": "",
            "skipped": false,
            "success": true,
            "username": "powershelly10"
        }
    }
}

Human Readable Output

Disable User Results (Slack IAM)

brand	instanceName	success	active	id	username	email	details
Slack IAM	Slack IAM_instance_1	true	false	U01KHS7J7U1	powershelly10	testdemistomock@paloaltonetworks.com	schemas: urn:scim:schemas:core:1.0 id: U01KHS7J7U1 externalId: meta: {“created”: “2021-01-19T07:46:20-08:00”, “location”: “https://api.slack.com/scim/v1/Users/U01KHS7J7U1”} userName: powershelly10 nickName: powershelly10 name: {“givenName”: “powershelly10”, “familyName”: “”} displayName: powershelly10 profileUrl: https://panwtest.enterprise.slack.com/team/powershelly10 title: timezone: America/Los_Angeles active: false emails: {‘value’: ‘testdemistomock@paloaltonetworks.com’, ‘primary’: True} photos: {‘value’: ‘https://secure.gravatar.com/avatar/e14bda84be03871922c78d0d03caa901.jpg?s=192&d=https%3A%2F%2Fa.slack-edge.com%2Fdf10d%2Fimg%2Favatars%2Fava_0006-192.png’, ‘type’: ‘photo’} groups:

iam-create-group

Creates an empty group

Base Command

iam-create-group

Input

Argument Name	Description	Required
scim	Group SCIM data with displayName.	Required

Context Output

Path	Type	Description
CreateGroup.id	String	ID of the group.
CreateGroup.displayName	String	The display name of the group.
CreateGroup.success	Boolean	Indicates whether the command succeeded.
CreateGroup.errorCode	Number	HTTP error response code.
CreateGroup.errorMessage	String	Reason why the API failed.

iam-get-group

Retrieves the group information including members

Base Command

iam-get-group

Input

Argument Name	Description	Required
scim	Group SCIM Data.	Required
includeMembers	Wheather to include group’s members. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
GetGroup.id	String	ID of the group.
GetGroup.displayName	String	The display name of the group.
GetGroup.members.display	String	The display name of the group member.
GetGroup.members.value	String	ID of the group member.
GetGroup.success	Boolean	Indicates whether the command succeeded.
GetGroup.errorCode	Number	HTTP error response code.
GetGroup.errorMessage	String	Reason why the API failed.

iam-delete-group

Permanently removes a group.

Base Command

iam-delete-group

Input

Argument Name	Description	Required
scim	Group SCIM with id in it.	Required

Context Output

Path	Type	Description
DeleteGroup.id	String	ID of the group.
DeleteGroup.displayName	String	The display name of the group.
DeleteGroup.success	Boolean	Indicates whether the command succeeded.
DeleteGroup.errorCode	Number	HTTP error response code.
DeleteGroup.errorMessage	String	Reason why the API failed.

iam-update-group

Updates an existing group resource. This command allows individual (or groups of) users to be added or removed from the group with a single operation. A max of 15,000 users can be modified in 1 call

Base Command

iam-update-group

Input

Argument Name	Description	Required
scim	Group SCIM data.	Required
memberIdsToAdd	List of members ids to add. A maximum of 15,000 users per call can be modified using this command.	Optional
memberIdsToDelete	List of members ids to be deleted from the group. A maximum of 15,000 users per call can be modified using this command.	Optional

Context Output

Path	Type	Description
UpdateGroup.id	String	ID of the group.
UpdateGroup.displayName	String	The display name of the group.
UpdateGroup.success	Boolean	Indicates whether the command succeeded.
UpdateGroup.errorCode	Number	HTTP error response code.
UpdateGroup.errorMessage	String	Reason why the API failed.

Configuration parameters

credentials —
access_token — Access Token
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
create_user_enabled — Allow creating users
update_user_enabled — Allow updating users
enable_user_enabled — Allow enabling users
disable_user_enabled — Allow disabling users
create_if_not_exists — Automatically create user if not found in update command
mapper_in — Incoming Mapper (required)
mapper_out — Outgoing Mapper

Commands (9)

get-mapping-fields
Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
iam-create-group
Creates an empty group.
iam-create-user
Creates a user.
iam-delete-group
Permanently removes a group.
iam-disable-user
Disable an active user.
iam-get-group
Retrieves the group information including members.
iam-get-user
Retrieves a single user resource.
iam-update-group
Updates an existing group resource. This command allows individual (or groups of) users to be added or removed from the group with a single operation. A max of 15,000 users can be modified in 1 call.
iam-update-user
Updates an existing user with the data passed in the user-profile argument.

Source

Slack_IAM.py Slack_IAM_test.py Slack_IAM.yml Slack_IAM_description.md command_examples.txt

Download History Raw

category: Identity and Access Management
provider: Slack
sectionorder:
- Connect
- Collect
commonfields:
  id: Slack IAM
  version: -1
configuration:
- name: credentials
  type: 9
  displaypassword: Access Token
  hiddenusername: true
  required: false
- display: Access Token
  name: access_token
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: If set to false, iam-create-user command will be skipped, and user will not be created.
  defaultvalue: 'true'
  display: Allow creating users
  name: create_user_enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow updating users
  name: update_user_enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow enabling users
  name: enable_user_enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Allow disabling users
  name: disable_user_enabled
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Automatically create user if not found in update command
  name: create_if_not_exists
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: User Profile - SCIM (Incoming)
  display: Incoming Mapper
  name: mapper_in
  required: true
  type: 0
  section: Connect
- defaultvalue: User Profile - SCIM (Outgoing)
  display: Outgoing Mapper
  name: mapper_out
  required: false
  type: 0
  section: Connect
  additionalinfo: Cortex XSOAR only parameter.
  hidden:
  - marketplacev2
  - platform
description: Integrate with Slack's services to execute CRUD operations for employee lifecycle processes.
display: Slack IAM
name: Slack IAM
script:
  commands:
  - arguments:
    - description: User Profile indicator details.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Creates a user.
    execution: true
    name: iam-create-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    - auto: PREDEFINED
      defaultValue: 'true'
      description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active.
      name: allow-enable
      predefined:
      - 'true'
      - 'false'
    description: Updates an existing user with the data passed in the user-profile argument.
    execution: true
    name: iam-update-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Retrieves a single user resource.
    name: iam-get-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - arguments:
    - description: A User Profile indicator.
      name: user-profile
      required: true
    description: Disable an active user.
    execution: true
    name: iam-disable-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - description: Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
    name: get-mapping-fields
  - arguments:
    - description: Group SCIM data with displayName.
      name: scim
      required: true
    description: Creates an empty group.
    name: iam-create-group
    outputs:
    - contextPath: CreateGroup.id
      description: ID of the group.
      type: String
    - contextPath: CreateGroup.displayName
      description: The display name of the group.
      type: String
    - contextPath: CreateGroup.success
      description: Indicates whether the command succeeded.
      type: Boolean
    - contextPath: CreateGroup.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: CreateGroup.errorMessage
      description: Reason why the API failed.
      type: String
  - arguments:
    - description: Group SCIM Data.
      name: scim
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Wheather to include group's members.
      name: includeMembers
      predefined:
      - 'true'
      - 'false'
    description: Retrieves the group information including members.
    name: iam-get-group
    outputs:
    - contextPath: GetGroup.id
      description: ID of the group.
      type: String
    - contextPath: GetGroup.displayName
      description: The display name of the group.
      type: String
    - contextPath: GetGroup.members.display
      description: The display name of the group member.
      type: String
    - contextPath: GetGroup.members.value
      description: ID of the group member.
      type: String
    - contextPath: GetGroup.success
      description: Indicates whether the command succeeded.
      type: Boolean
    - contextPath: GetGroup.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: GetGroup.errorMessage
      description: Reason why the API failed.
      type: String
  - arguments:
    - description: Group SCIM with id in it.
      name: scim
      required: true
    description: Permanently removes a group.
    name: iam-delete-group
    outputs:
    - contextPath: DeleteGroup.id
      description: ID of the group.
      type: String
    - contextPath: DeleteGroup.displayName
      description: The display name of the group.
      type: String
    - contextPath: DeleteGroup.success
      description: Indicates whether the command succeeded.
      type: Boolean
    - contextPath: DeleteGroup.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: DeleteGroup.errorMessage
      description: Reason why the API failed.
      type: String
  - arguments:
    - description: Group SCIM data.
      name: scim
      required: true
    - description: List of members ids to add. A maximum of 15,000 users per call can be modified using this command.
      isArray: true
      name: memberIdsToAdd
    - description: List of members ids to be deleted from the group. A maximum of 15,000 users per call can be modified using this command.
      isArray: true
      name: memberIdsToDelete
    description: Updates an existing group resource. This command allows individual (or groups of) users to be added or removed from the group with a single operation. A max of 15,000 users can be modified in 1 call.
    name: iam-update-group
    outputs:
    - contextPath: UpdateGroup.id
      description: ID of the group.
      type: String
    - contextPath: UpdateGroup.displayName
      description: The display name of the group.
      type: String
    - contextPath: UpdateGroup.success
      description: Indicates whether the command succeeded.
      type: Boolean
    - contextPath: UpdateGroup.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: UpdateGroup.errorMessage
      description: Reason why the API failed.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncout: true
tests:
- No tests
fromversion: 6.0.0
supportedModules:
- xsiam
- agentix
- edr
- cloud
- cloud_runtime_security