Zoom_IAM

An Identity and Access Management integration template.

Identity and Access Management · Zoom

Details

IDZoom_IAM
ProviderZoom
CategoryIdentity and Access Management
From Version6.0.0
Docker Imagedemisto/auth-utils:1.0.0.5476008
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

An Identity and Access Management integration template.
This integration was integrated and tested with version 2.0.0 of Zoom_IAM.

Configure Zoom_IAM in Cortex

Parameter Description Required
Server URL (e.g., ‘https://api.zoom.us/v2/’)   False
Account ID (OAuth)   False
Client ID (OAuth)   False
Client Secret (OAuth)   False
API Key (JWT-Deprecated) This authentication method is deprecated. False
API Secret (JWT-Deprecated) This authentication method is deprecated. False
Use system proxy settings   False
Trust any certificate (not secure)   False
Allow disabling users   False
Allow enabling users   False
Incoming Mapper   False
Outgoing Mapper Cortex XSOAR only parameter. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

iam-disable-user

Disable an active user.

Base Command

iam-disable-user

Input

Argument Name Description Required
user-profile A User Profile indicator.
For example: {"email": "john.doe@example.com"}
.		 Required

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command example

!iam-disable-user user-profile=`{"email": "example@example.com", "givenname": "Example"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "email": "example@example.com",
            "givenname": "Example"
        },
        "Vendor": [
            {
                "action": "disable",
                "active": false,
                "brand": "Zoom_IAM",
                "details": {
                    "email": "example@example.com",
                    "givenname": "Example"
                },
                "email": "example@example.com",
                "errorCode": null,
                "errorMessage": "",
                "id": "6mIygOyeTT61Wzw_PAo5jw",
                "instanceName": "Zoom_IAM_instance_1 JWT",
                "reason": "",
                "skipped": false,
                "success": true,
                "username": ""
            },
            {
                "action": "disable",
                "active": null,
                "brand": "Zoom_IAM",
                "details": {
                    "account_id": "aeKD2BFJRASt1QVURWo9CA",
                    "account_number": 1114287,
                    "cluster": "us06",
                    "cms_user_id": "",
                    "created_at": "2020-06-16T06:57:23Z",
                    "dept": "",
                    "email": "example@example.com",
                    "first_name": "Example",
                    "group_ids": [],
                    "id": "6mIygOyeTT61Wzw_PAo5jw",
                    "im_group_ids": [],
                    "jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
                    "job_title": "",
                    "language": "en-US",
                    "last_client_version": "5.8.7.2058(win)",
                    "last_login_time": "2022-08-24T07:25:49Z",
                    "last_name": "Example",
                    "location": "",
                    "login_types": [
                        1
                    ],
                    "personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
                    "phone_country": "",
                    "phone_number": "",
                    "pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
                    "pmi": 3269259758,
                    "role_id": "2",
                    "role_name": "Member",
                    "status": "inactive",
                    "timezone": "Asia/Jerusalem",
                    "type": 1,
                    "use_pmi": false,
                    "user_created_at": "2020-06-16T06:57:23Z",
                    "verified": 0
                },
                "email": "example@example.com",
                "errorCode": null,
                "errorMessage": "",
                "id": null,
                "instanceName": "Zoom_IAM_instance_2 OAuth",
                "reason": "User is already disabled.",
                "skipped": true,
                "success": true,
                "username": null
            }
        ]
    }
}

Human Readable Output

Disable User Results (Zoom_IAM)

brand instanceName success active id email details
Zoom_IAM Zoom_IAM_instance_1 JWT true false 6mIygOyeTT61Wzw_PAo5jw example@example.com email: example@example.com
givenname: Example

iam-enable-user

Enable a deactivated user.

Base Command

iam-enable-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

Path Type Description
IAM.Vendor.active Boolean When true, indicates that the employee’s status is active in the 3rd-party integration.
IAM.Vendor.brand String Name of the integration.
IAM.Vendor.details string Provides the raw data from the 3rd-party integration.
IAM.Vendor.email String The employee’s email address.
IAM.Vendor.errorCode Number HTTP error response code.
IAM.Vendor.errorMessage String Reason why the API failed.
IAM.Vendor.id String The employee’s user ID in the app.
IAM.Vendor.instanceName string Name of the integration instance.
IAM.Vendor.success Boolean When true, indicates that the command was executed successfully.
IAM.Vendor.username String The employee’s username in the app.

Command example

!iam-enable-user user-profile=`{"email": "example@example.com", "givenname": "Example"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "email": "example@example.com",
            "givenname": "Example"
        },
        "Vendor": [
            {
                "action": "enable",
                "active": true,
                "brand": "Zoom_IAM",
                "details": {
                    "email": "example@example.com",
                    "givenname": "Example"
                },
                "email": "example@example.com",
                "errorCode": null,
                "errorMessage": "",
                "id": "6mIygOyeTT61Wzw_PAo5jw",
                "instanceName": "Zoom_IAM_instance_2 OAuth",
                "reason": "",
                "skipped": false,
                "success": true,
                "username": ""
            },
            {
                "action": "enable",
                "active": true,
                "brand": "Zoom_IAM",
                "details": {
                    "email": "example@example.com",
                    "givenname": "Example"
                },
                "email": "example@example.com",
                "errorCode": null,
                "errorMessage": "",
                "id": "6mIygOyeTT61Wzw_PAo5jw",
                "instanceName": "Zoom_IAM_instance_1 JWT",
                "reason": "",
                "skipped": false,
                "success": true,
                "username": ""
            }
        ]
    }
}

Human Readable Output

Enable User Results (Zoom_IAM)

brand instanceName success active id email details
Zoom_IAM Zoom_IAM_instance_2 OAuth true true 6mIygOyeTT61Wzw_PAo5jw example@example.com email: example@example.com
givenname: Example

iam-get-user

Retrieves a single user resource.

Base Command

iam-get-user

Input

Argument Name Description Required
user-profile A User Profile indicator. Required

Context Output

There is no context output for this command.

Command example

!iam-get-user user-profile=`{"email": "example@example.com", "givenname": "Example"}`

Context Example

{
    "IAM": {
        "UserProfile": {
            "account_id": "aeKD2BFJRASt1QVURWo9CA",
            "account_number": 1114287,
            "cluster": "us06",
            "cms_user_id": "",
            "created_at": "2020-06-16T06:57:23Z",
            "dept": "",
            "email": "example@example.com",
            "first_name": "Example",
            "group_ids": [],
            "id": "6mIygOyeTT61Wzw_PAo5jw",
            "im_group_ids": [],
            "jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
            "job_title": "",
            "language": "en-US",
            "last_client_version": "5.8.7.2058(win)",
            "last_login_time": "2022-08-24T07:25:49Z",
            "last_name": "Example",
            "location": "",
            "login_types": [
                1
            ],
            "personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
            "phone_country": "",
            "phone_number": "",
            "pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
            "pmi": 3269259758,
            "role_id": "2",
            "role_name": "Member",
            "status": "active",
            "timezone": "Asia/Jerusalem",
            "type": 1,
            "use_pmi": false,
            "user_created_at": "2020-06-16T06:57:23Z",
            "verified": 0
        },
        "Vendor": [
            {
                "action": "get",
                "active": true,
                "brand": "Zoom_IAM",
                "details": {
                    "account_id": "aeKD2BFJRASt1QVURWo9CA",
                    "account_number": 1114287,
                    "cluster": "us06",
                    "cms_user_id": "",
                    "created_at": "2020-06-16T06:57:23Z",
                    "dept": "",
                    "email": "example@example.com",
                    "first_name": "Example",
                    "group_ids": [],
                    "id": "6mIygOyeTT61Wzw_PAo5jw",
                    "im_group_ids": [],
                    "jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
                    "job_title": "",
                    "language": "en-US",
                    "last_client_version": "5.8.7.2058(win)",
                    "last_login_time": "2022-08-24T07:25:49Z",
                    "last_name": "Example",
                    "location": "",
                    "login_types": [
                        1
                    ],
                    "personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
                    "phone_country": "",
                    "phone_number": "",
                    "pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
                    "pmi": 3269259758,
                    "role_id": "2",
                    "role_name": "Member",
                    "status": "active",
                    "timezone": "Asia/Jerusalem",
                    "type": 1,
                    "use_pmi": false,
                    "user_created_at": "2020-06-16T06:57:23Z",
                    "verified": 0
                },
                "email": "example@example.com",
                "errorCode": null,
                "errorMessage": "",
                "id": "6mIygOyeTT61Wzw_PAo5jw",
                "instanceName": "Zoom_IAM_instance_2 OAuth",
                "reason": "",
                "skipped": false,
                "success": true,
                "username": ""
            },
            {
                "action": "get",
                "active": true,
                "brand": "Zoom_IAM",
                "details": {
                    "account_id": "aeKD2BFJRASt1QVURWo9CA",
                    "account_number": 1114287,
                    "cluster": "us06",
                    "cms_user_id": "",
                    "created_at": "2020-06-16T06:57:23Z",
                    "dept": "",
                    "email": "example@example.com",
                    "first_name": "Example",
                    "group_ids": [],
                    "id": "6mIygOyeTT61Wzw_PAo5jw",
                    "im_group_ids": [],
                    "jid": "6miygoyett61wzw_pao5jw@xmpp.zoom.us",
                    "job_title": "",
                    "language": "en-US",
                    "last_client_version": "5.8.7.2058(win)",
                    "last_login_time": "2022-08-24T07:25:49Z",
                    "last_name": "Example",
                    "location": "",
                    "login_types": [
                        1
                    ],
                    "personal_meeting_url": "https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09",
                    "phone_country": "",
                    "phone_number": "",
                    "pic_url": "https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c",
                    "pmi": 3269259758,
                    "role_id": "2",
                    "role_name": "Member",
                    "status": "active",
                    "timezone": "Asia/Jerusalem",
                    "type": 1,
                    "use_pmi": false,
                    "user_created_at": "2020-06-16T06:57:23Z",
                    "verified": 0
                },
                "email": "example@example.com",
                "errorCode": null,
                "errorMessage": "",
                "id": "6mIygOyeTT61Wzw_PAo5jw",
                "instanceName": "Zoom_IAM_instance_1 JWT",
                "reason": "",
                "skipped": false,
                "success": true,
                "username": ""
            }
        ]
    }
}

Human Readable Output

Get User Results (Zoom_IAM)

brand instanceName success active id email details
Zoom_IAM Zoom_IAM_instance_1 JWT true true 6mIygOyeTT61Wzw_PAo5jw example@example.com id: 6mIygOyeTT61Wzw_PAo5jw
first_name: Example
last_name: Example
email: example@example.com
type: 1
role_name: Member
pmi: 3269259758
use_pmi: false
personal_meeting_url: https://us06web.zoom.us/j/3269259758?pwd=Q2VTN1JsM2J2OCtmS1hWaHBTUmV6QT09
timezone: Asia/Jerusalem
verified: 0
dept:
created_at: 2020-06-16T06:57:23Z
last_login_time: 2022-08-24T07:25:49Z
last_client_version: 5.8.7.2058(win)
pic_url: https://lh3.googleusercontent.com/a/AItbvmn0GJLCTIkOIatpkUy-PuEf-tFQEnBVOUxcT2oB=s96-c
cms_user_id:
jid: 6miygoyett61wzw_pao5jw@xmpp.zoom.us
group_ids:
im_group_ids:
account_id: aeKD2BFJRASt1QVURWo9CA
language: en-US
phone_country:
phone_number:
status: active
job_title:
location:
login_types: 1
role_id: 2
account_number: 1114287
cluster: us06
user_created_at: 2020-06-16T06:57:23Z

get-mapping-fields

Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.

Base Command

get-mapping-fields

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Zoom_IAM corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:
Enable Fetching incidents in your instance configuration.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Zoom_IAM.

Configuration parameters

  • url — Server URL (e.g., 'https://api.zoom.us/v2/')
  • account_id — Account ID (OAuth)
  • credentials — Client ID (OAuth)
  • creds_api_key —
  • creds_api_secret —
  • api_key — API Key (JWT-Deprecated)
  • api_secret — API Secret (JWT-Deprecated)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • disable-user-enabled — Allow disabling users
  • enable-user-enabled — Allow enabling users
  • mapper_in — Incoming Mapper
  • mapper_out — Outgoing Mapper

Commands (4)

  • get-mapping-fields

    Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.

  • iam-disable-user

    Disable an active user.

  • iam-enable-user

    Enable a deactivated user.

  • iam-get-user

    Retrieves a single user resource.

Source

Zoom_IAM.py Zoom_IAM_test.py Zoom_IAM.yml Zoom_IAM_description.md command_examples.txt
Download History Raw 
category: Identity and Access Management
provider: Zoom
sectionorder:
- Connect
- Collect
commonfields:
  id: Zoom_IAM
  version: -1
configuration:
- display: Server URL (e.g., 'https://api.zoom.us/v2/')
  name: url
  type: 0
  defaultvalue: "https://api.zoom.us/v2/"
  required: false
  section: Connect
- display: Account ID (OAuth)
  name: account_id
  type: 0
  required: false
  section: Connect
- display: Client ID (OAuth)
  name: credentials
  type: 9
  displaypassword: Client Secret (OAuth)
  required: false
  section: Connect
- name: creds_api_key
  displaypassword: API Key (JWT-Deprecated)
  type: 9
  additionalinfo: This authentication method is deprecated.
  hiddenusername: true
  required: false
  section: Connect
- name: creds_api_secret
  displaypassword: API Secret (JWT-Deprecated)
  type: 9
  additionalinfo: This authentication method is deprecated.
  hiddenusername: true
  required: false
  section: Connect
- display: API Key (JWT-Deprecated)
  name: api_key
  type: 4
  additionalinfo: This authentication method is deprecated.
  hidden: true
  required: false
  section: Connect
- display: API Secret (JWT-Deprecated)
  name: api_secret
  type: 4
  additionalinfo: This authentication method is deprecated.
  hidden: true
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Allow disabling users
  name: disable-user-enabled
  type: 8
  required: false
  section: Connect
- display: Allow enabling users
  name: enable-user-enabled
  type: 8
  required: false
  section: Connect
- defaultvalue: User Profile - SCIM (Incoming)
  display: Incoming Mapper
  name: mapper_in
  required: false
  type: 0
  section: Collect
- defaultvalue: User Profile - SCIM (Outgoing)
  display: Outgoing Mapper
  name: mapper_out
  required: false
  type: 0
  section: Collect
  additionalinfo: Cortex XSOAR only parameter.
  hidden:
  - marketplacev2
  - platform
description: An Identity and Access Management integration template.
display: Zoom_IAM
name: Zoom_IAM
script:
  commands:
  - arguments:
    - description: >-
        A User Profile indicator. For example: `{"email": "john.doe@example.com"}`.
      name: user-profile
      required: true
    description: Disable an active user.
    execution: true
    name: iam-disable-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
    compliantpolicies:
    - User Hard Remediation
  - arguments:
    - description: >-
        A User Profile indicator.

        For example: `{"email": "john.doe@example.com"}`.
      name: user-profile
      required: true
    description: Enable a deactivated user.
    execution: true
    name: iam-enable-user
    outputs:
    - contextPath: IAM.Vendor.active
      description: When true, indicates that the employee's status is active in the 3rd-party integration.
      type: Boolean
    - contextPath: IAM.Vendor.brand
      description: Name of the integration.
      type: String
    - contextPath: IAM.Vendor.details
      description: Provides the raw data from the 3rd-party integration.
      type: string
    - contextPath: IAM.Vendor.email
      description: The employee's email address.
      type: String
    - contextPath: IAM.Vendor.errorCode
      description: HTTP error response code.
      type: Number
    - contextPath: IAM.Vendor.errorMessage
      description: Reason why the API failed.
      type: String
    - contextPath: IAM.Vendor.id
      description: The employee's user ID in the app.
      type: String
    - contextPath: IAM.Vendor.instanceName
      description: Name of the integration instance.
      type: string
    - contextPath: IAM.Vendor.success
      description: When true, indicates that the command was executed successfully.
      type: Boolean
    - contextPath: IAM.Vendor.username
      description: The employee's username in the app.
      type: String
  - description: Retrieves a single user resource.
    name: iam-get-user
    arguments:
    - description: >-
        A User Profile indicator.

        For example: `{"email": "john.doe@example.com"}`.
      name: user-profile
      required: true
  - description: Retrieves a User Profile schema, which holds all of the user fields within the application. Used for outgoing-mapping through the Get Schema option.
    name: get-mapping-fields
  dockerimage: demisto/auth-utils:1.0.0.5476008
  ismappable: true
  isremotesyncout: true
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 6.0.0