Block Account - Generic v2

This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: * Active Directory * PAN-OS - This requires PAN-OS 9.1 or higher. * SailPoint * PingOne * AWS IAM * Clarizen IAM * Envoy IAM * ExceedLMS IAM * Okta * Microsoft Graph User (Entra ID Users) * Google Workspace Admin * Slack IAM * ServiceNow IAM * Prisma Cloud IAM * Zoom IAM * Atlassian IAM * GitHub IAM.

Common Playbooks · 64 tasks · 4 inputs · 1 output

Inputs

  • Username — Array of malicious usernames to block.
  • Tag — PAN-OS Tag name to apply to the username that you want to block.
  • NamingConvention — In case you are using naming convention in your IDP, please specify a prefix for special/service accounts (use comma separated)
  • UserVerification — Possible values:True/False. Default:True. Specify if User Verification is Requrired

Outputs

  • Blocklist.Final — Blocked accounts.

Commands used

ad-disable-account ad-get-user gsuite-user-update iam-disable-user identityiq-disable-account identityiq-get-accounts msgraph-user-account-disable msgraph-user-get pan-os-register-user-tag pingone-deactivate-user

Flowchart

yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes yes Start Start Done Done Block accounts Block accounts Is there a username to block? Is there a username to bl... PAN-OS - Register Tag to User - pan-os-register-user-tag PAN-OS - Register Tag to ... pan-os-register-user-tag Is there a Tag name to register? Is there a Tag name to re... OKTA OKTA SailPoint SailPoint AWS IAM AWS IAM PingOne PingOne Clarizen IAM Clarizen IAM Envoy IAM Envoy IAM ExceedLMS IAM ExceedLMS IAM PAN-OS PAN-OS Microsoft Active Directory Microsoft Active Directory Is OKTA Integration Enabled? - IsIntegrationAvailable Is OKTA Integration Enabled? IsIntegrationAvailable Is SailPoint Integration Enabled? - IsIntegrationAvailable Is SailPoint Integration ... IsIntegrationAvailable Is AWS IAM Integration Enabled? - IsIntegrationAvailable Is AWS IAM Integration En... IsIntegrationAvailable Is PingOne Integration Enabled - IsIntegrationAvailable Is PingOne Integration En... IsIntegrationAvailable Is ClarizenIAM Integration Enabled? - IsIntegrationAvailable Is ClarizenIAM Integratio... IsIntegrationAvailable Is Envoy IAM Integration Enabled? - IsIntegrationAvailable Is Envoy IAM Integration ... IsIntegrationAvailable Is ExceedLMS IAM Integration Enabled? - IsIntegrationAvailable Is ExceedLMS IAM Integrat... IsIntegrationAvailable IAM Disable User - iam-disable-user IAM Disable User iam-disable-user PingOne - Deactivate user - pingone-deactivate-user PingOne - Deactivate user pingone-deactivate-user SailPoint-Disable account - identityiq-disable-account SailPoint-Disable account identityiq-disable-account Is PAN-OS/Panorama Integration Enabled? - IsIntegrationAvailable Is PAN-OS/Panorama Integr... IsIntegrationAvailable Is Active Directory Integration Enabled? - IsIntegrationAvailable Is Active Directory Integ... IsIntegrationAvailable Is User Verification Required? Is User Verification Requ... No User to be blocked No User to be blocked Set Naming Convention to a key - SetAndHandleEmpty Set Naming Convention to ... SetAndHandleEmpty Identify Potential Sensitive Users - SetAndHandleEmpty Identify Potential Sensit... SetAndHandleEmpty Set User to a potential block list - SetAndHandleEmpty Set User to a potential b... SetAndHandleEmpty Check if there are any sensitive users to block Check if there are any se... Ask the user for verification [Sensitive Users] Ask the user for verifica... Ask the user for verification [without Sensitive Users] Ask the user for verifica... Set the final accounts list to be blocked - SetAndHandleEmpty Set the final accounts li... SetAndHandleEmpty Set the final accounts list to be blocked - SetAndHandleEmpty Set the final accounts li... SetAndHandleEmpty Active Directory - Disable Account - ad-disable-account Active Directory - Disabl... ad-disable-account Is Username selected? Is Username selected? Is Slack IAM Integration Enabled? - IsIntegrationAvailable Is Slack IAM Integration ... IsIntegrationAvailable Slack IAM Slack IAM Is ServiceNow IAM Integration Enabled? - IsIntegrationAvailable Is ServiceNow IAM Integra... IsIntegrationAvailable ServiceNow IAM ServiceNow IAM Is Salesforce IAM Integration Enabled? - IsIntegrationAvailable Is Salesforce IAM Integra... IsIntegrationAvailable Salesforce IAM Salesforce IAM Is PrismaCloud IAM Integration Enabled? - IsIntegrationAvailable Is PrismaCloud IAM Integr... IsIntegrationAvailable PrismaCloud IAM PrismaCloud IAM Is Microsoft Graph User Integration Enabled? - IsIntegrationAvailable Is Microsoft Graph User I... IsIntegrationAvailable Microsoft Graph User Microsoft Graph User Is Zoom IAM Integration Enabled? - IsIntegrationAvailable Is Zoom IAM Integration E... IsIntegrationAvailable Zoom IAM Zoom IAM Is Atlassian IAM Integration Enabled? - IsIntegrationAvailable Is Atlassian IAM Integrat... IsIntegrationAvailable Atlassian IAM Atlassian IAM Microsoft Graph User - Disable Account - msgraph-user-account-disable Microsoft Graph User - Di... msgraph-user-account-disable Is GitHub IAM Integration Enabled? - IsIntegrationAvailable Is GitHub IAM Integration... IsIntegrationAvailable GitHub IAM GitHub IAM Is Google Workspace Admin Integration Enabled? - IsIntegrationAvailable Is Google Workspace Admin... IsIntegrationAvailable Google Workspace Admin Google Workspace Admin Google Workspace Admin - Disable Account - gsuite-user-update Google Workspace Admin - ... gsuite-user-update Get Account IDs From SailPoint - identityiq-get-accounts Get Account IDs From Sail... identityiq-get-accounts Active Directory - Get User - ad-get-user Active Directory - Get User ad-get-user Does the username exist? Does the username exist? Microsoft Graph User - Get User - msgraph-user-get Microsoft Graph User - Ge... msgraph-user-get Does the username exist? Does the username exist?