Get User Devices by Username - Generic

This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: - Name - Serial Number - ID - Model - MAC Address - OS - Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: - jamf v2 - Microsoft Defender for Endpoint - Cortex XDR IR - ServiceNow v2 - Google Workspace (Gsuite) - Active Directory Query v2.

Pack

CommonPlaybooks

Tasks

58

Inputs

• Username — The username of the user.
• GsuiteCustomerID — If using Google Workspace, a customer ID is needed.
• CustomADAttribute — A custom Active Directory attribute. In case there is a custom attribute in Active Directory which stores the name of the computer assigned to the user in the user object, it would be fetched.

Outputs

• GSuite.MobileDevices — Gsuite mobile devices.
• GSuite.MobileDevices.MobileListObjects — A list of mobile device objects.
• GSuite.MobileDevices.MobileListObjects.kind — The type of the API resource.
• GSuite.MobileDevices.MobileListObjects.etag — ETag of the resource.
• GSuite.MobileDevices.MobileListObjects.resourceId — The unique ID the API service uses to identify the mobile device.
• GSuite.MobileDevices.MobileListObjects.deviceId — The serial number for a Google Sync mobile device. For Android and iOS devices, this is a software-generated unique identifier.
• GSuite.MobileDevices.MobileListObjects.name — A list of the owner's usernames.
• GSuite.MobileDevices.MobileListObjects.email — A list of the owner's email addresses.
• GSuite.MobileDevices.MobileListObjects.model — The mobile device's model name.
• GSuite.MobileDevices.MobileListObjects.os — The mobile device's operating system.
• GSuite.MobileDevices.MobileListObjects.type — The type of mobile device.
• GSuite.MobileDevices.MobileListObjects.status — The mobile device's status.
• GSuite.MobileDevices.MobileListObjects.hardwareId — The IMEI/MEID unique identifier for Android hardware.
• GSuite.MobileDevices.MobileListObjects.firstSync — The date and time the mobile device was initially synchronized with the policy settings in the Admin console.
• GSuite.MobileDevices.MobileListObjects.lastSync — The date and time the mobile device was last synchronized with the policy settings in the Admin console.
• GSuite.MobileDevices.MobileListObjects.userAgent — Information about the mobile device such as the operating system version.
• GSuite.MobileDevices.MobileListObjects.serialNumber — The mobile device's serial number.
• GSuite.MobileDevices.MobileListObjects.imei — The mobile device's IMEI number.
• GSuite.MobileDevices.MobileListObjects.meid — The mobile device's MEID number.
• GSuite.MobileDevices.MobileListObjects.wifiMacAddress — The mobile device's MAC address on Wi-Fi networks.
• GSuite.MobileDevices.MobileListObjects.networkOperator — Mobile device mobile or network operator.
• GSuite.MobileDevices.MobileListObjects.defaultLanguage — The default locale used on the mobile device.
• GSuite.MobileDevices.MobileListObjects.managedAccountIsOnOwnerProfile — Boolean indicating if this account is on the owner/primary profile.
• GSuite.MobileDevices.MobileListObjects.deviceCompromisedStatus — The compromised device status.
• GSuite.MobileDevices.MobileListObjects.buildNumber — The mobile device's operating system build number.
• GSuite.MobileDevices.MobileListObjects.kernelVersion — The mobile device's kernel version.
• GSuite.MobileDevices.MobileListObjects.basebandVersion — The mobile device's baseband version.
• GSuite.MobileDevices.MobileListObjects.unknownSourcesStatus — Unknown sources enabled or disabled on the mobile device.
• GSuite.MobileDevices.MobileListObjects.adbStatus — Whether adb (USB debugging) is enabled on the mobile device.
• GSuite.MobileDevices.MobileListObjects.developerOptionsStatus — Whether developer options are enabled on the mobile device.
• GSuite.MobileDevices.MobileListObjects.otherAccountsInfo — A list of accounts added on the device.
• GSuite.MobileDevices.MobileListObjects.supportsWorkProfile — Work profile supported on the mobile device.
• GSuite.MobileDevices.MobileListObjects.manufacturer — Mobile device manufacturer.
• GSuite.MobileDevices.MobileListObjects.releaseVersion — Mobile device release version.
• GSuite.MobileDevices.MobileListObjects.securityPatchLevel — Mobile device security patch level.
• GSuite.MobileDevices.MobileListObjects.brand — Mobile device brand.
• GSuite.MobileDevices.MobileListObjects.bootloaderVersion — Mobile device bootloader version.
• GSuite.MobileDevices.MobileListObjects.hardware — Mobile device hardware.
• GSuite.MobileDevices.MobileListObjects.encryptionStatus — Mobile device encryption status.
• GSuite.MobileDevices.MobileListObjects.devicePasswordStatus — Mobile device password status.
• GSuite.MobileDevices.MobileListObjects.privilege — DM agent permission.
• GSuite.MobileDevices.MobileListObjects.applications — Mobile device applications.
• GSuite.MobileDevices.MobileListObjects.applications.packageName — The application's package name.
• GSuite.MobileDevices.MobileListObjects.applications.displayName — The application's display name.
• GSuite.MobileDevices.MobileListObjects.applications.versionName — The application's version name.
• GSuite.MobileDevices.MobileListObjects.applications.versionCode — The application's version code.
• GSuite.MobileDevices.MobileListObjects.applications.permission — The list of permissions of this application.
• JAMF.Computer — Computer object.
• JAMF.Computer.id — The computer ID.
• JAMF.Computer.name — The computer name.
• JAMF.Computer.udid — The computer UDID.
• JAMF.Computer.serial_number — The computer serial number.
• JAMF.Computer.mac_address — The computer MAC address.
• JAMF.Computer.alt_mac_address — The computer alt MAC address.
• JAMF.Computer.asset_tag — The computer asset tag.
• JAMF.Computer.bar_code_1 — The computer barcode 1.
• JAMF.Computer.bar_code_2 — The computer barcode 2.
• JAMF.Computer.username — The computer username.
• JAMF.Computer.realname — The computer real name.
• JAMF.Computer.email — The computer email address.
• JAMF.Computer.email_address — The computer email address.
• JAMF.Computer.room — The computer room.
• JAMF.Computer.position — The computer position.
• JAMF.Computer.building — The computer building.
• JAMF.Computer.building_name — The computer building name.
• JAMF.Computer.department — The computer department.
• JAMF.Computer.department_name — The computer department name.
• JAMF.MobileDevice — Mobile device object.
• JAMF.MobileDevice.id — The mobile device ID.
• JAMF.MobileDevice.name — The mobile device name.
• JAMF.MobileDevice.udid — The mobile device UDID.
• JAMF.MobileDevice.serial_number — The mobile device serial number.
• JAMF.MobileDevice.mac_address — The mobile device MAC address.
• JAMF.MobileDevice.wifi_mac_address — The mobile device WI-FI MAC address.
• JAMF.MobileDevice.username — The mobile device username.
• JAMF.MobileDevice.realname — The mobile device real name.
• JAMF.MobileDevice.email — The mobile device user email address.
• JAMF.MobileDevice.email_address — The mobile device user email address.
• JAMF.MobileDevice.room — The mobile device room.
• JAMF.MobileDevice.position — The mobile device position.
• JAMF.MobileDevice.building — The mobile device building.
• JAMF.MobileDevice.building_name — The mobile device building name.
• JAMF.MobileDevice.department — The mobile device department.
• JAMF.MobileDevice.department_name — The mobile device department name.
• PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
• PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
• PaloAltoNetworksXDR.Endpoint.endpoint_type — The endpoint type.
• PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
• PaloAltoNetworksXDR.Endpoint.os_type — The endpoint OS type.
• PaloAltoNetworksXDR.Endpoint.ip — A list of IP addresses.
• PaloAltoNetworksXDR.Endpoint.users — A list of users.
• PaloAltoNetworksXDR.Endpoint.domain — The endpoint domain.
• PaloAltoNetworksXDR.Endpoint.alias — The endpoint's aliases.
• PaloAltoNetworksXDR.Endpoint.first_seen — First seen date/time in Epoch (milliseconds).
• PaloAltoNetworksXDR.Endpoint.last_seen — Last seen date/time in Epoch (milliseconds).
• PaloAltoNetworksXDR.Endpoint.content_version — Content version.
• PaloAltoNetworksXDR.Endpoint.installation_package — Installation package.
• PaloAltoNetworksXDR.Endpoint.active_directory — Active directory.
• PaloAltoNetworksXDR.Endpoint.install_date — Install date in Epoch (milliseconds).
• PaloAltoNetworksXDR.Endpoint.endpoint_version — Endpoint version.
• PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
• PaloAltoNetworksXDR.Endpoint.group_name — The name of the group to which the endpoint belongs.
• PaloAltoNetworksXDR.Endpoint.count — Number of endpoints returned.
• Endpoint.Hostname — The hostname that is mapped to this endpoint.
• Endpoint.ID — The unique ID within the tool retrieving the endpoint.
• Endpoint.IPAddress — The IP address of the endpoint.
• Endpoint.Domain — The domain of the endpoint.
• Endpoint.OS — The endpoint's operation system.
• Endpoint.Status — The endpoint's status.
• Endpoint.IsIsolated — The endpoint's isolation status.
• Endpoint.MACAddress — The endpoint's MAC address.
• Endpoint.Vendor — The integration name of the endpoint vendor.
• MicrosoftATP.UserMachine.Username — The username.
• MicrosoftATP.UserMachine.Machines.ID — The machine ID.
• MicrosoftATP.UserMachine.Machines.ComputerDNSName — The machine DNS name.
• MicrosoftATP.UserMachine.Machines.FirstSeen — The first date and time the machine was observed by Microsoft Defender ATP.
• MicrosoftATP.UserMachine.Machines.LastSeen — The last date and time the machine was observed by Microsoft Defender ATP.
• MicrosoftATP.UserMachine.Machines.OSPlatform — The operating system platform.
• MicrosoftATP.UserMachine.Machines.OSVersion — The operating system version.
• MicrosoftATP.UserMachine.Machines.OSProcessor — The operating system processor.
• MicrosoftATP.UserMachine.Machines.LastExternalIPAddress — The last IP through which the machine accessed the internet.
• MicrosoftATP.UserMachine.Machines.OSBuild — The operating system build number.
• MicrosoftATP.UserMachine.Machines.HealthStatus — The machine health status.
• MicrosoftATP.UserMachine.Machines.RBACGroupID — The machine RBAC group ID.
• MicrosoftATP.UserMachine.Machines.RBACGroupName — The machine RBAC group name.
• MicrosoftATP.UserMachine.Machines.RiskScore — The machine risk score.
• MicrosoftATP.UserMachine.Machines.ExposureLevel — The machine exposure level.
• MicrosoftATP.UserMachine.Machines.IsAADJoined — True if machine is AAD joined, False otherwise.
• MicrosoftATP.UserMachine.Machines.AADDeviceID — The AAD device ID.
• MicrosoftATP.UserMachine.Machines.MachineTags — Set of machine tags.
• MicrosoftATP.v.Machines.LastIPAddress — The last IP on the machine.
• ServiceNow.Computer.ID — Computer system ID.
• ServiceNow.Computer.AssetTag — Computer asset tag.
• ServiceNow.Computer.Name — Computer name.
• ServiceNow.Computer.DisplayName — Computer display name.
• ServiceNow.Computer.SupportGroup — Computer support group.
• ServiceNow.Computer.OperatingSystem — Computer operating system.
• ServiceNow.Computer.Company — Computer company system ID.
• ServiceNow.Computer.AssignedTo — Computer assigned to user system ID.
• ServiceNow.Computer.State — Computer state.
• ServiceNow.Computer.Cost — Computer cost.
• ServiceNow.Computer.Comments — Computer comments.
• UserDevices — Devices retrieved by this playbook.
• UserDevices.Name — Devices names retrieved by this playbook.
• UserDevices.SerialNumber — Devices serial numbers retrieved by this playbook.
• UserDevices.ID — Devices IDs retrieved by this playbook.
• UserDevices.Model — Devices models retrieved by this playbook.
• UserDevices.OS — Devices operating systems retrieved by this playbook.
• UserDevices.Integration — The integration which retrieved the devices.
• UserDevices.MACAddress — Devices MAC Address retrieved by this playbook.

Commands used

• ad-get-user
• core-get-endpoints
• gsuite-mobiledevice-list
• jamf-get-computer-by-id
• jamf-get-computer-by-match
• jamf-get-mobile-device-by-id
• jamf-get-mobile-device-by-match
• microsoft-atp-get-user-machines
• servicenow-query-computers
• servicenow-query-users
• xdr-get-endpoints