Get User Devices - Generic

id: Get User Devices - Generic
version: -1
name: Get User Devices - Generic
description: |-
  This playbook retrieves information on all of the associated user devices.
  In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key:
  - Name
  - Serial Number
  - ID
  - Model
  - MAC Address
  - OS
  - Integration

  Note that not all of the supported integrations will be able to retrieve this information.

  In order to get the full list of supported integrations, read the following sub-playbooks descriptions:
  - Get User Devices by Username - Generic
  - Get User Devices by Email Address - Generic
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 454cb663-ccde-4a62-8b49-30eb544b3bc0
    type: start
    task:
      id: 454cb663-ccde-4a62-8b49-30eb544b3bc0
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 90
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: cf8dc377-5329-470d-844e-791d70e71811
    type: playbook
    task:
      id: cf8dc377-5329-470d-844e-791d70e71811
      version: -1
      name: Get User Devices by Username - Generic
      playbookName: Get User Devices by Username - Generic
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      CustomADAttribute:
        complex:
          root: inputs.CustomADAttribute
      GsuiteCustomerID:
        complex:
          root: inputs.GsuiteCustomerID
      Username:
        complex:
          root: inputs.Username
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 190,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 9c31b9f0-e095-4389-8f58-729f0c4ec788
    type: playbook
    task:
      id: 9c31b9f0-e095-4389-8f58-729f0c4ec788
      version: -1
      name: Get User Devices by Email Address - Generic
      playbookName: Get User Devices by Email Address - Generic
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      CustomADAttribute:
        complex:
          root: inputs.CustomADAttribute
      GsuiteCustomerID:
        complex:
          root: inputs.GsuiteCustomerID
      UserEmail:
        complex:
          root: inputs.UserEmail
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 700,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 31a7a2ae-9ab4-43fd-8ad3-aed6423e566a
    type: regular
    task:
      id: 31a7a2ae-9ab4-43fd-8ad3-aed6423e566a
      version: -1
      name: Set UserDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: UserDevices
      value:
        complex:
          root: UserDevices
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: UserDevices
                iscontext: true
              raw: {}
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 0554518b-dd22-4f68-83d5-7bdf164d2b4d
    type: title
    task:
      id: 0554518b-dd22-4f68-83d5-7bdf164d2b4d
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 640
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 615,
        "width": 890,
        "x": 190,
        "y": 90
      }
    }
  }
inputs:
- key: UserEmail
  value: {}
  required: false
  description: The email address of the user.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username of the user.
- key: GsuiteCustomerID
  value: {}
  required: false
  description: If Google Workspace, a customer ID is needed.
  playbookInputQuery:
- key: CustomADAttribute
  value: {}
  required: false
  description: |-
    A custom Active Directory attribute.
    In case there is a custom attribute in Active Directory which stores the name of the computer assigned to the user in the user object, it would be fetched.
  playbookInputQuery:
outputs:
- contextPath: UserDevices
  description: Devices retrieved by this playbook.
  type: unknown
- contextPath: GSuite.MobileDevices.MobileListObjects
  description: A list of mobile device objects.
- contextPath: GSuite.MobileDevices.MobileListObjects.kind
  description: The type of the API resource.
- contextPath: GSuite.MobileDevices.MobileListObjects.etag
  description: ETag of the resource.
- contextPath: GSuite.MobileDevices.MobileListObjects.resourceId
  description: The unique ID the API service uses to identify the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.deviceId
  description: The serial number for a Google Sync mobile device. For Android and iOS devices, this is a software-generated unique identifier.
- contextPath: GSuite.MobileDevices.MobileListObjects.name
  description: A list of the owner's usernames.
- contextPath: GSuite.MobileDevices.MobileListObjects.email
  description: A list of the owner's email addresses.
- contextPath: GSuite.MobileDevices.MobileListObjects.model
  description: The mobile device's model name.
- contextPath: GSuite.MobileDevices.MobileListObjects.os
  description: The mobile device's operating system.
- contextPath: GSuite.MobileDevices.MobileListObjects.type
  description: The type of mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.status
  description: The mobile device's status.
- contextPath: GSuite.MobileDevices.MobileListObjects.hardwareId
  description: The IMEI/MEID unique identifier for Android hardware.
- contextPath: GSuite.MobileDevices.MobileListObjects.firstSync
  description: The date and time the mobile device was initially synchronized with the policy settings in the Admin console.
- contextPath: GSuite.MobileDevices.MobileListObjects.lastSync
  description: The date and time the mobile device was last synchronized with the policy settings in the Admin console.
- contextPath: GSuite.MobileDevices.MobileListObjects.userAgent
  description: Information about the mobile device such as the operating system version.
- contextPath: GSuite.MobileDevices.MobileListObjects.serialNumber
  description: The mobile device's serial number.
- contextPath: GSuite.MobileDevices.MobileListObjects.imei
  description: The mobile device's IMEI number.
- contextPath: GSuite.MobileDevices.MobileListObjects.meid
  description: The mobile device's MEID number.
- contextPath: GSuite.MobileDevices.MobileListObjects.wifiMacAddress
  description: The mobile device's MAC address on Wi-Fi networks.
- contextPath: GSuite.MobileDevices.MobileListObjects.networkOperator
  description: Mobile device mobile or network operator.
- contextPath: GSuite.MobileDevices.MobileListObjects.defaultLanguage
  description: The default locale used on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.managedAccountIsOnOwnerProfile
  description: Boolean indicating if this account is on the owner/primary profile.
- contextPath: GSuite.MobileDevices.MobileListObjects.deviceCompromisedStatus
  description: The compromised device status.
- contextPath: GSuite.MobileDevices.MobileListObjects.buildNumber
  description: The mobile device's operating system build number.
- contextPath: GSuite.MobileDevices.MobileListObjects.kernelVersion
  description: The mobile device's kernel version.
- contextPath: GSuite.MobileDevices.MobileListObjects.basebandVersion
  description: The mobile device's baseband version.
- contextPath: GSuite.MobileDevices.MobileListObjects.unknownSourcesStatus
  description: Unknown sources enabled or disabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.adbStatus
  description: Whether adb (USB debugging) is enabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.developerOptionsStatus
  description: Whether developer options are enabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.otherAccountsInfo
  description: A list of accounts added on the device.
- contextPath: GSuite.MobileDevices.MobileListObjects.supportsWorkProfile
  description: Work profile supported on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.manufacturer
  description: Mobile device manufacturer.
- contextPath: GSuite.MobileDevices.MobileListObjects.releaseVersion
  description: Mobile device release version.
- contextPath: GSuite.MobileDevices.MobileListObjects.securityPatchLevel
  description: Mobile device security patch level.
- contextPath: GSuite.MobileDevices.MobileListObjects.brand
  description: Mobile device brand.
- contextPath: GSuite.MobileDevices.MobileListObjects.bootloaderVersion
  description: Mobile device bootloader version.
- contextPath: GSuite.MobileDevices.MobileListObjects.hardware
  description: Mobile device hardware.
- contextPath: GSuite.MobileDevices.MobileListObjects.encryptionStatus
  description: Mobile device encryption status.
- contextPath: GSuite.MobileDevices.MobileListObjects.devicePasswordStatus
  description: Mobile device password status.
- contextPath: GSuite.MobileDevices.MobileListObjects.privilege
  description: DM agent permission.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.packageName
  description: The application's package name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.displayName
  description: The application's display name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionName
  description: The application's version name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionCode
  description: The application's version code.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.permission
  description: The list of permissions of this application.
- contextPath: JAMF.Computer
  description: Jamf computer object.
  type: unknown
- contextPath: JAMF.MobileDevice
  description: Jamf mobile device object.
  type: unknown
- contextPath: JAMF.Computer.id
  description: The computer ID.
- contextPath: JAMF.Computer.name
  description: The computer name.
- contextPath: JAMF.Computer.udid
  description: The computer UDID.
- contextPath: JAMF.Computer.serial_number
  description: The computer serial number.
- contextPath: JAMF.Computer.mac_address
  description: The computer MAC address.
- contextPath: JAMF.Computer.alt_mac_address
  description: The computer alt MAC address.
- contextPath: JAMF.Computer.asset_tag
  description: The computer asset tag.
- contextPath: JAMF.Computer.bar_code_1
  description: The computer barcode 1.
- contextPath: JAMF.Computer.bar_code_2
  description: The computer barcode 2.
- contextPath: JAMF.Computer.username
  description: The computer username.
- contextPath: JAMF.Computer.realname
  description: The computer real name.
- contextPath: JAMF.Computer.email
  description: The computer email address.
- contextPath: JAMF.Computer.email_address
  description: The computer email address.
- contextPath: JAMF.Computer.room
  description: The computer room.
- contextPath: JAMF.Computer.position
  description: The computer position.
- contextPath: JAMF.Computer.building
  description: The computer building.
- contextPath: JAMF.Computer.building_name
  description: The computer building name.
- contextPath: JAMF.Computer.department
  description: The computer department.
- contextPath: JAMF.Computer.department_name
  description: The computer department name.
- contextPath: JAMF.MobileDevice.id
  description: The mobile device ID.
- contextPath: JAMF.MobileDevice.name
  description: The mobile device name.
- contextPath: JAMF.MobileDevice.udid
  description: The mobile device UDID.
- contextPath: JAMF.MobileDevice.serial_number
  description: The mobile device serial number.
- contextPath: JAMF.MobileDevice.mac_address
  description: The mobile device MAC address.
- contextPath: JAMF.MobileDevice.wifi_mac_address
  description: The mobile device WI-FI MAC address.
- contextPath: JAMF.MobileDevice.username
  description: The mobile device username.
- contextPath: JAMF.MobileDevice.realname
  description: The mobile device real name.
- contextPath: JAMF.MobileDevice.email
  description: The mobile device user email address.
- contextPath: JAMF.MobileDevice.email_address
  description: The mobile device user email address.
- contextPath: JAMF.MobileDevice.room
  description: The mobile device room.
- contextPath: JAMF.MobileDevice.position
  description: The mobile device position.
- contextPath: JAMF.MobileDevice.building
  description: The mobile device building.
- contextPath: JAMF.MobileDevice.building_name
  description: The mobile device building name.
- contextPath: JAMF.MobileDevice.department
  description: The mobile device department.
- contextPath: JAMF.MobileDevice.department_name
  description: The mobile device department name.
- contextPath: PaloAltoNetworksXDR.Endpoint
  description: Endpoint object.
  type: unknown
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
  description: The endpoint ID.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
  description: The endpoint name.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type
  description: The endpoint type.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
  description: The status of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.os_type
  description: The endpoint OS type.
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
  description: A list of IP addresses.
- contextPath: PaloAltoNetworksXDR.Endpoint.users
  description: A list of users.
- contextPath: PaloAltoNetworksXDR.Endpoint.domain
  description: The endpoint domain.
- contextPath: PaloAltoNetworksXDR.Endpoint.alias
  description: The endpoint's aliases.
- contextPath: PaloAltoNetworksXDR.Endpoint.first_seen
  description: First seen date/time in Epoch (milliseconds).
- contextPath: PaloAltoNetworksXDR.Endpoint.last_seen
  description: Last seen date/time in Epoch (milliseconds).
- contextPath: PaloAltoNetworksXDR.Endpoint.content_version
  description: Content version.
- contextPath: PaloAltoNetworksXDR.Endpoint.installation_package
  description: Installation package.
- contextPath: PaloAltoNetworksXDR.Endpoint.active_directory
  description: Active directory.
- contextPath: PaloAltoNetworksXDR.Endpoint.install_date
  description: Install date in Epoch (milliseconds).
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version
  description: Endpoint version.
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
- contextPath: PaloAltoNetworksXDR.Endpoint.group_name
  description: The name of the group to which the endpoint belongs.
- contextPath: PaloAltoNetworksXDR.Endpoint.count
  description: Number of endpoints returned.
- contextPath: Endpoint.Hostname
  description: The hostname that is mapped to this endpoint.
- contextPath: Endpoint.ID
  description: The unique ID within the tool retrieving the endpoint.
- contextPath: Endpoint.IPAddress
  description: The IP address of the endpoint.
- contextPath: Endpoint.Domain
  description: The domain of the endpoint.
- contextPath: Endpoint.OS
  description: The endpoint's operation system.
- contextPath: Endpoint.Status
  description: The endpoint's status.
- contextPath: Endpoint.IsIsolated
  description: The endpoint's isolation status.
- contextPath: Endpoint.MACAddress
  description: The endpoint's MAC address.
- contextPath: Endpoint.Vendor
  description: The integration name of the endpoint vendor.
- contextPath: MicrosoftATP.UserMachine.Username
  description: The username.
- contextPath: MicrosoftATP.UserMachine.Machines
  description: User machines.
  type: unknown
- contextPath: MicrosoftATP.UserMachine.Machines.ID
  description: The machine ID.
- contextPath: MicrosoftATP.UserMachine.Machines.ComputerDNSName
  description: The machine DNS name.
- contextPath: MicrosoftATP.UserMachine.Machines.FirstSeen
  description: The first date and time the machine was observed by Microsoft Defender ATP.
- contextPath: MicrosoftATP.UserMachine.Machines.OSPlatform
  description: The operating system platform.
- contextPath: MicrosoftATP.UserMachine.Machines.OSVersion
  description: The operating system version.
- contextPath: MicrosoftATP.UserMachine.Machines.OSProcessor
  description: The operating system processor.
- contextPath: MicrosoftATP.UserMachine.Machines.LastExternalIPAddress
  description: The last IP through which the machine accessed the internet.
- contextPath: MicrosoftATP.UserMachine.Machines.OSBuild
  description: The operating system build number.
- contextPath: MicrosoftATP.UserMachine.Machines.HealthStatus
  description: The machine health status.
- contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupID
  description: The machine RBAC group ID.
- contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupName
  description: The machine RBAC group name.
- contextPath: MicrosoftATP.UserMachine.Machines.RiskScore
  description: The machine risk score.
- contextPath: MicrosoftATP.UserMachine.Machines.ExposureLevel
  description: The machine exposure level.
- contextPath: MicrosoftATP.UserMachine.Machines.IsAADJoined
  description: True if machine is AAD joined, False otherwise.
- contextPath: MicrosoftATP.UserMachine.Machines.AADDeviceID
  description: The AAD device ID.
- contextPath: MicrosoftATP.UserMachine.Machines.MachineTags
  description: Set of machine tags.
- contextPath: MicrosoftATP.v.Machines.LastIPAddress
  description: The last IP on the machine.
- contextPath: ServiceNow.Computer
  description: Computer object.
  type: unknown
- contextPath: ServiceNow.Computer.ID
  description: Computer system ID.
- contextPath: ServiceNow.Computer.AssetTag
  description: Computer asset tag.
- contextPath: ServiceNow.Computer.Name
  description: Computer name.
- contextPath: ServiceNow.Computer.DisplayName
  description: Computer display name.
- contextPath: ServiceNow.Computer.SupportGroup
  description: Computer support group.
- contextPath: ServiceNow.Computer.OperatingSystem
  description: Computer operating system.
- contextPath: ServiceNow.Computer.Company
  description: Computer company system ID.
- contextPath: ServiceNow.Computer.AssignedTo
  description: Computer assigned to user system ID.
- contextPath: ServiceNow.Computer.State
  description: Computer state.
- contextPath: ServiceNow.Computer.Cost
  description: Computer cost.
- contextPath: ServiceNow.Computer.Comments
  description: Computer comments.
- contextPath: UserDevices.Name
  description: Devices names retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.SerialNumber
  description: Devices serial numbers retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.ID
  description: Devices IDs retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Model
  description: Devices models retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.OS
  description: Devices operating systems retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Integration
  description: The integration which retrieved the devices.
  type: unknown
- contextPath: UserDevices.MACAddress
  description: Devices MAC Address retrieved by this playbook.
  type: unknown
- contextPath: MicrosoftGraph.profileType
  description: Device profile type.
  type: unknown
- contextPath: MicrosoftGraph.operatingSystemVersion
  description: Device OS version.
  type: unknown
- contextPath: MicrosoftGraph.displayName
  description: Device display name.
  type: unknown
- contextPath: MicrosoftGraph.operatingSystem
  description: Device OS.
  type: unknown
- contextPath: MicrosoftGraph.deviceId
  description: Device ID.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.8.0
marketplaces:
- xsoar
- marketplacev2
- platform