Departing Employee Clean-Up

Queries the Departing Employee watchlist in Code42 Incydr and passes relevant employee data to the Remove Employees from Departing Employee Watchlist playbook. Intended to be run as a scheduled job.
Code42 · 11 tasks · 0 inputs · 0 outputs
Details

ID	`Departing Employee Clean-Up`
From Version	6.8.0
Tasks	11
Tags	Code42 Incydr
README

Queries the Departing Employee watchlist in Code42 Incydr and passes relevant employee data to the Remove Employees from Departing Employee Watchlist playbook.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

Remove Employees from Departing Employee Watchlist
Integrations

Code42
Scripts

Set
Print
DeleteContext
Commands

code42-watchlists-list-included-users
Playbook Inputs

There are no inputs for this playbook.
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Departing Employee Clean-Up
Commands used

code42-watchlists-list-included-users
Flowchart

Source

playbook-Code42_Departing_Employee_Clean-Up.yml
Download History Raw
id: Departing Employee Clean-Up
version: -1
fromversion: "6.8.0"
name: Departing Employee Clean-Up
description: Queries the Departing Employee watchlist in Code42 Incydr and passes
  relevant employee data to the Remove Employees from Departing Employee Watchlist
  playbook. Intended to be run as a scheduled job.
tags:
- Code42 Incydr
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: def1d2ad-0b7e-42ba-84be-4287c015f905
    type: start
    task:
      id: def1d2ad-0b7e-42ba-84be-4287c015f905
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "19"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -490
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 38aef565-dce7-41db-890c-8543651af11b
    type: title
    task:
      id: 38aef565-dce7-41db-890c-8543651af11b
      version: -1
      name: Playbook Complete
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 1025
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 2d9d6f44-d058-4132-8b98-0a44f2190ddc
    type: condition
    task:
      id: 2d9d6f44-d058-4132-8b98-0a44f2190ddc
      version: -1
      name: Are There Watchlist Entries?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "Yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Code42.WatchlistUsers
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": 0
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 8c181bd8-d130-4eac-8ba9-2b5fde044b2c
    type: regular
    task:
      id: 8c181bd8-d130-4eac-8ba9-2b5fde044b2c
      version: -1
      name: Set "No Entries" Log Message
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Log
      value:
        simple: No employees on Departing Employee watchlist.
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 261ab108-97c8-4079-83a5-7344d75edfaa
    type: regular
    task:
      id: 261ab108-97c8-4079-83a5-7344d75edfaa
      version: -1
      name: Delete All Context Except Log
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      all:
        simple: "no"
      key:
        simple: Code42,watchlist_count
      keysToKeep:
        simple: Log
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: c701e761-c699-4fa6-86fb-db34a4656cc0
    type: regular
    task:
      id: c701e761-c699-4fa6-86fb-db34a4656cc0
      version: -1
      name: Write Log to Incident War Room
      description: Prints text to war room (Markdown supported)
      scriptName: Print
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      value:
        simple: ${Log}
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: c470fad1-3555-40f4-8ea2-74b55df0c269
    type: regular
    task:
      id: c470fad1-3555-40f4-8ea2-74b55df0c269
      version: -1
      name: Set "Job Complete" Log Message
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Log
      value:
        simple: Finished Departing Employee Clean-Up Job.
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 300,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 13ab2a72-4a7f-4c50-8a19-3a829d6ed006
    type: regular
    task:
      id: 13ab2a72-4a7f-4c50-8a19-3a829d6ed006
      version: -1
      name: Set "Retrieved Employee(s)" Log Message
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Log
      value:
        simple: Retrieved employee(s) from Departing Employee watchlist.
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -170,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: d4d50bae-a662-48d3-8fb0-1c8af133fc86
    type: playbook
    task:
      id: d4d50bae-a662-48d3-8fb0-1c8af133fc86
      version: -1
      name: Remove Employees from Departing Employee Watchlist
      description: Loops through Departing Employee watchlist entries from Code42
        Incydr and removes employees based on specified criteria.
      playbookName: Remove Employees from Departing Employee Watchlist
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      incydr_departure_date:
        simple: ${Code42.DepartingEmployee.DepartureDate}
      incydr_uid:
        simple: ${Code42.DepartingEmployee.UserID}
      incydr_username:
        simple: ${Code42.WatchlistUsers.Username}
      look_back:
        simple: "30"
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
      forEach: true
    view: |-
      {
        "position": {
          "x": -170,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: cdd9d82a-58d3-4f7e-8ab8-a034f7b6497f
    type: regular
    task:
      id: cdd9d82a-58d3-4f7e-8ab8-a034f7b6497f
      version: -1
      name: Set "Job Starting" Log Message
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Log
      value:
        simple: Beginning Departing Employee Clean-Up Job.
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 7df2bbf4-8186-4edd-833e-9596df9cba5d
    type: regular
    task:
      id: 7df2bbf4-8186-4edd-833e-9596df9cba5d
      version: -1
      name: Query Departing Employee Watchlist
      description: List all users who have been explicitly added to a given watchlist.
      script: Code42|||code42-watchlists-list-included-users
      type: regular
      iscommand: true
      brand: Code42
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      ignore-outputs:
        simple: "false"
      watchlist:
        simple: DEPARTING_EMPLOYEE
    separatecontext: false
    continueonerror: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": -340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1580,
        "width": 850,
        "x": -170,
        "y": -490
      }
    }
  }
inputs: []
outputs: []
tests:
- No tests