Containment Plan - Clear User Sessions

## Containment Plan - Clear User Sessions This playbook is a sub-playbook within the containment plan playbook. The playbook uses the 'Okta v2' and 'MSGraph User' integrations to clear user sessions.
Common Playbooks · 15 tasks · 3 inputs · 0 outputs
Details

ID	`Containment Plan - Clear User Sessions`
From Version	6.6.0
Tasks	15
README

Containment Plan - Clear User Sessions

This playbook is a sub-playbook within the containment plan playbook.
The playbook uses the ‘Okta v2’ and ‘MSGraph User’ integrations to clear user sessions.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

This playbook does not use any integrations.
Scripts

IsIntegrationAvailable
Set
Commands

msgraph-user-get
okta-clear-user-sessions
okta-get-user
setParentIncidentContext
msgraph-user-session-revoke
Playbook Inputs

Name	Description	Default Value	Required
ClearUserSessions	Set to ‘True’ to clear the user active sessions.	True	Optional
Username	The username to disable.		Optional
IAMUserDomain	The Okta IAM users domain. The domain will be appended to the username. E.g., username@IAMUserDomain.		Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Containment Plan - Clear User Sessions
Inputs

ClearUserSessions — Set to 'True' to clear the user active sessions.
Username — The username to disable.
IAMUserDomain — The Okta IAM users domain. The domain will be appended to the username. E.g., username@IAMUserDomain.
Commands used

msgraph-user-get msgraph-user-session-revoke okta-clear-user-sessions okta-get-user setParentIncidentContext
Flowchart

Source

playbook-Containment_Plan_-_Clear_User_Sessions.yml
Download History Raw
id: Containment Plan - Clear User Sessions
version: -1
name: Containment Plan - Clear User Sessions
description: |-
  ## Containment Plan - Clear User Sessions

  This playbook is a sub-playbook within the containment plan playbook.
  The playbook uses the 'Okta v2' and 'MSGraph User' integrations to clear user sessions.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f2a578bb-7b26-4477-8391-2e40e77fb9d5
    type: start
    task:
      id: f2a578bb-7b26-4477-8391-2e40e77fb9d5
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": -150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 965b6bb7-8584-4ee9-86be-705ca7951fba
    type: regular
    task:
      id: 965b6bb7-8584-4ee9-86be-705ca7951fba
      version: -1
      name: Okta clear user sessions
      description: |-
        Removes all active identity provider sessions. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user.
        For more information and examples:
        https://developer.okta.com/docs/reference/api/users/#user-sessions
      script: '|||okta-clear-user-sessions'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      userId:
        complex:
          root: Account
          accessor: ID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 581b7da6-4c88-41a6-8175-a2116add396c
    type: title
    task:
      id: 581b7da6-4c88-41a6-8175-a2116add396c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: ea29c7c0-e180-4c2e-8593-3948400c532e
    type: regular
    task:
      id: ea29c7c0-e180-4c2e-8593-3948400c532e
      version: -1
      name: Get Okta user ID
      description: Fetches information for a single user. You must enter one or more parameters for the command to run.
      script: '|||okta-get-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      username:
        simple: ${OktaUsersSessionToClear}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: bda090c7-6749-46e5-8453-31f56d8b778c
    type: regular
    task:
      id: bda090c7-6749-46e5-8453-31f56d8b778c
      version: -1
      name: Set the username to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: UsersSessionCleared
      value:
        complex:
          root: Account
          accessor: Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 1145
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: cceb9ed8-97d2-4b2a-8688-c02b46be05a6
    type: regular
    task:
      id: cceb9ed8-97d2-4b2a-8688-c02b46be05a6
      version: -1
      name: Set users to clear the session with Okta
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      key:
        simple: OktaUsersSessionToClear
      value:
        complex:
          root: inputs.Username
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: administrator
              ignorecase: true
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: system
              ignorecase: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 4025c083-2630-4171-889e-5f05b1fc51eb
    type: condition
    task:
      id: 4025c083-2630-4171-889e-5f05b1fc51eb
      version: -1
      name: Is Okta enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "11"
    scriptarguments:
      brandname:
        simple: Okta v2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: f1d3409f-55f4-4804-8a48-354971cae04e
    type: condition
    task:
      id: f1d3409f-55f4-4804-8a48-354971cae04e
      version: -1
      name: Should clear the user sessions?
      description: Whether to clear the user sessions based on the input values.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "15"
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.ClearUserSessions
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 770,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 64c30075-eba8-4222-8251-cf075b841898
    type: condition
    task:
      id: 64c30075-eba8-4222-8251-cf075b841898
      version: -1
      name: Is MsGraphUser enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "27"
    scriptarguments:
      brandname:
        simple: Microsoft Graph User
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: f0ed1f31-5552-423b-8d43-44a4e3b69879
    type: regular
    task:
      id: f0ed1f31-5552-423b-8d43-44a4e3b69879
      version: -1
      name: Get MsGraph user ID
      description: |-
        Retrieves the properties and relationships of a user object. For more information, visit: https://docs.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0).
        Permissions: - User.Read (Delegated) - User.Read.All (Application).
      script: '|||msgraph-user-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      user:
        simple: ${MsGraphUsersSessionToClear}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: c82fc95c-577d-407a-8e4c-127b17c05843
    type: regular
    task:
      id: c82fc95c-577d-407a-8e4c-127b17c05843
      version: -1
      name: MSGraph clear user sessions
      description: |-
        Revoke a user session - Invalidates all the refresh tokens issued to applications for a user.
        Permission: Directory.AccessAsUser.All(Delegated).
      script: '|||msgraph-user-session-revoke'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "22"
    scriptarguments:
      user:
        simple: ${MSGraphUser.ID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 985
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: aaafcc54-e334-42a5-8a5c-f4dea1d0c158
    type: regular
    task:
      id: aaafcc54-e334-42a5-8a5c-f4dea1d0c158
      version: -1
      name: Set the username to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      key:
        simple: UsersSessionCleared
      value:
        simple: ${MSGraphUser.UserPrincipalName}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 1145
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 4655db74-8104-4510-88b0-d9a081911b34
    type: condition
    task:
      id: 4655db74-8104-4510-88b0-d9a081911b34
      version: -1
      name: Does the username exist?
      description: Verify that the user exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "21"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: MSGraphUser.ID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: c1ba5bf5-e37f-41ee-8392-7709acc40e8f
    type: condition
    task:
      id: c1ba5bf5-e37f-41ee-8392-7709acc40e8f
      version: -1
      name: Does the username exist?
      description: Verify that the user exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Account
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: Account.Type
                      iscontext: true
                    right:
                      value:
                        simple: Okta
                    ignorecase: true
                accessor: ID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 530,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 2fd929ed-f77b-49d3-8ec5-9ac7e37a2a47
    type: regular
    task:
      id: 2fd929ed-f77b-49d3-8ec5-9ac7e37a2a47
      version: -1
      name: Set users to clear the session with MsGraph
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      key:
        simple: MsGraphUsersSessionToClear
      value:
        complex:
          root: inputs.Username
          filters:
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: administrator
              ignorecase: true
          - - operator: notContainsGeneral
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: system
              ignorecase: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1010,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "15_2_#default#": 0.15,
      "17_15_yes": 0.48,
      "17_2_#default#": 0.11,
      "18_2_#default#": 0.16,
      "23_2_#default#": 0.25,
      "25_1_yes": 0.45,
      "25_2_#default#": 0.33
    },
    "paper": {
      "dimensions": {
        "height": 1535,
        "width": 860,
        "x": 530,
        "y": -150
      }
    }
  }
inputs:
- key: ClearUserSessions
  value:
    simple: "True"
  required: false
  description: Set to 'True' to clear the user active sessions.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to disable.
  playbookInputQuery:
- key: IAMUserDomain
  value: {}
  required: false
  description: The Okta IAM users domain. The domain will be appended to the username. E.g., username@IAMUserDomain.
  playbookInputQuery:
inputSections:
- inputs:
  - ClearUserSessions
  - Username
  - IAMUserDomain
  name: General (Inputs group)
  description: Generic group for inputs.
outputSections:
- outputs: []
  name: General (Outputs group)
  description: Generic group for outputs
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform