Eradication Plan - Reset Password

This playbook is one of the sub-playbooks in the eradication plan. The playbook executes actions to reset the user's passwords, which is a crucial step in the eradication process.

Common Playbooks · 7 tasks · 2 inputs · 0 outputs

Details

ID	`Eradication Plan - Reset Password`
From Version	6.6.0
Tasks	7

README

This playbook is one of the sub-playbooks in the eradication plan.
This playbook handles the resetting of users’ passwords as a crucial step in the containment action.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

SetAndHandleEmpty
CompareLists
IsIntegrationAvailable

Commands

setParentIncidentContext
ad-expire-password

Playbook Inputs

Name	Description	Default Value	Required
UserRemediation	Set to ‘True’ to reset the user’s password.	True	Optional
Username	The username to reset the password for.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Eradication Plan - Reset Password

Inputs

UserRemediation — Set to 'True' to reset the user's password.
Username — The username to reset the password for.

Commands used

ad-expire-password setParentIncidentContext

Flowchart

Source

playbook-Eradication_Plan_-_Reset_Password.yml

Download History Raw

id: Eradication Plan - Reset Password
version: -1
name: Eradication Plan - Reset Password
description: "This playbook is one of the sub-playbooks in the eradication plan. \nThe playbook executes actions to reset the user's passwords, which is a crucial step in the eradication process."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 09c31255-cc27-43a6-81db-fb416e7a41fc
    type: start
    task:
      id: 09c31255-cc27-43a6-81db-fb416e7a41fc
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: c674cf0c-a189-45a8-88d6-6f39d888ced0
    type: regular
    task:
      id: c674cf0c-a189-45a8-88d6-6f39d888ced0
      version: -1
      name: Auto password reset
      description: Invalidates the password of an Active Directory user.
      script: '|||ad-expire-password'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      username:
        complex:
          root: ResetPasswordToUsers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 83bdf4fd-82e0-41c8-801a-7dacf7cc7cb7
    type: title
    task:
      id: 83bdf4fd-82e0-41c8-801a-7dacf7cc7cb7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: ed488801-2746-4d07-8abc-1dfb26c26f70
    type: condition
    task:
      id: ed488801-2746-4d07-8abc-1dfb26c26f70
      version: -1
      name: Is Active Directory Query v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "14"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 948a893e-2686-482c-8662-cde9931f0644
    type: condition
    task:
      id: 948a893e-2686-482c-8662-cde9931f0644
      version: -1
      name: Should reset the user password?
      description: |+
        Whether to reset the user's password based on the input values.


      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UserRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 11182b8c-325c-453c-8d1e-6890e1846610
    type: regular
    task:
      id: 11182b8c-325c-453c-8d1e-6890e1846610
      version: -1
      name: Set the user with a password reset to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: UserPasswordReset
      value:
        complex:
          root: ResetPasswordToUsers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 89912e2c-f160-47d2-8ea0-a03d2e7125eb
    type: regular
    task:
      id: 89912e2c-f160-47d2-8ea0-a03d2e7125eb
      version: -1
      name: Set users to reset password
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: ResetPasswordToUsers
      value:
        complex:
          root: inputs.Username
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: Administrator
              ignorecase: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "8_3_#default#": 0.16,
      "9_3_#default#": 0.14
    },
    "paper": {
      "dimensions": {
        "height": 1215,
        "width": 380,
        "x": 450,
        "y": 150
      }
    }
  }
inputs:
- key: UserRemediation
  value:
    simple: "True"
  required: false
  description: Set to 'True' to reset the user's password.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to reset the password for.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform