Demisto Self-Defense - Account policy monitoring playbook Deprecated Hidden

Deprecated. Get list of Demisto users through the REST API, and alert if any non-SAML user accounts are found.

Deprecated Content (Deprecated) · 8 tasks · 0 inputs · 0 outputs

Commands used

TwilioSendSMS demisto-api-get setIncident slack-send

Flowchart

yes Start Start List Demisto users - demisto-api-get List Demisto users demisto-api-get Any non-SSO users? Any non-SSO users? Alert and Escalate Alert and Escalate Escalate to Critical - setIncident Escalate to Critical setIncident Send alert to Slack channel - slack-send Send alert to Slack channel slack-send Send SMS alert - TwilioSendSMS Send SMS alert TwilioSendSMS Close - CloseInvestigation Close CloseInvestigation