Get User Devices by Email Address - Generic

id: Get User Devices by Email Address - Generic
version: -1
name: Get User Devices by Email Address - Generic
description: |-
  This playbook retrieves information on all of the associated user devices, based on the user email.
  In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key:
  - Name
  - Serial Number
  - ID
  - Model
  - MAC Address
  - OS
  - Integration

  Note that not all of the supported integrations will be able to retrieve this information.

  Supported integrations:
  - jamf v2
  - Google Workspace (Gsuite)
  - ServiceNow v2
  - Active Directory Query v2
  - Microsoft Graph API (In order to get devices details, provide the permissions as mentioned here: https://learn.microsoft.com/en-us/graph/api/user-list-owneddevices?view=graph-rest-1.0&tabs=http )
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: af53b702-bed1-4168-8bf7-b595e9a88ebf
    type: start
    task:
      id: af53b702-bed1-4168-8bf7-b595e9a88ebf
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": -60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: b39dc8a4-1b7b-4cb9-8f38-2eead03f9fa1
    type: condition
    task:
      id: b39dc8a4-1b7b-4cb9-8f38-2eead03f9fa1
      version: -1
      name: UserEmail exists?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "14"
      "yes":
      - "2"
      - "8"
      - "15"
      - "24"
      - "43"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.UserEmail
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 544397f7-475e-4a00-84dd-3ab24d8e4ca3
    type: title
    task:
      id: 544397f7-475e-4a00-84dd-3ab24d8e4ca3
      version: -1
      name: Google Workspace (Gsuite)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 2d755788-43a2-4676-8ae3-143261e765f6
    type: regular
    task:
      id: 2d755788-43a2-4676-8ae3-143261e765f6
      version: -1
      name: Google Workspace - Get device details
      description: Retrieves a paginated list that includes company-owned mobile devices.
      script: '|||gsuite-mobiledevice-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      customer_id:
        complex:
          root: inputs.GsuiteCustomerID
      query:
        simple: email:${inputs.UserEmail}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: a50ab795-1aa7-4e4f-8aa2-f4742985f47e
    type: condition
    task:
      id: a50ab795-1aa7-4e4f-8aa2-f4742985f47e
      version: -1
      name: Customer ID exist?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.GsuiteCustomerID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 37e9ddaf-5126-4655-8379-bea5b950e24a
    type: condition
    task:
      id: 37e9ddaf-5126-4655-8379-bea5b950e24a
      version: -1
      name: GSuiteAdmin enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "13"
      "yes":
      - "4"
    scriptarguments:
      brandname:
        simple: GSuiteAdmin
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 710
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 6f4cf496-6f9c-4136-8cde-165da884b795
    type: title
    task:
      id: 6f4cf496-6f9c-4136-8cde-165da884b795
      version: -1
      name: Done - Jamf
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 4542cda1-c64f-400b-8fca-a1800a9b3bdb
    type: title
    task:
      id: 4542cda1-c64f-400b-8fca-a1800a9b3bdb
      version: -1
      name: Jamf
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 630,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 1ebadc42-526d-4d3d-8c4a-f436142037d3
    type: regular
    task:
      id: 1ebadc42-526d-4d3d-8c4a-f436142037d3
      version: -1
      name: Jamf Pro - Get computer details
      description: Matches computers by specific characteristics and returns general data on each of the computers.
      script: jamf v2|||jamf-get-computer-by-match
      type: regular
      iscommand: true
      brand: jamf v2
    nexttasks:
      '#none#':
      - "30"
    scriptarguments:
      match:
        complex:
          root: inputs.UserEmail
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 4ce06688-5049-4290-871b-1407d8dd7444
    type: condition
    task:
      id: 4ce06688-5049-4290-871b-1407d8dd7444
      version: -1
      name: jamf v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "7"
      "yes":
      - "9"
      - "11"
    scriptarguments:
      brandname:
        simple: jamf v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 630,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 503fdfc8-c837-4070-8e40-57fa280c0d0a
    type: regular
    task:
      id: 503fdfc8-c837-4070-8e40-57fa280c0d0a
      version: -1
      name: Jamf Pro - Get mobile device details
      description: Matches mobile devices by specific characteristics and returns general data on each one of the mobile devices.
      script: '|||jamf-get-mobile-device-by-match'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "31"
    scriptarguments:
      match:
        complex:
          root: inputs.UserEmail
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 670
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: ccdd5243-0807-4790-82a8-4cdd640c292a
    type: title
    task:
      id: ccdd5243-0807-4790-82a8-4cdd640c292a
      version: -1
      name: Done - GSuite
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: ea16bf47-d31a-45d5-83a7-704f585cf793
    type: title
    task:
      id: ea16bf47-d31a-45d5-83a7-704f585cf793
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2220,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 0e57178d-04ec-4385-8a3a-1f862a63e55d
    type: title
    task:
      id: 0e57178d-04ec-4385-8a3a-1f862a63e55d
      version: -1
      name: ServiceNow CMDB
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: cc138021-9029-463e-8771-2d84742a4ef9
    type: condition
    task:
      id: cc138021-9029-463e-8771-2d84742a4ef9
      version: -1
      name: ServiceNow v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "20"
      "yes":
      - "17"
    scriptarguments:
      brandname:
        simple: ServiceNow v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 3682177f-81cc-43db-8688-9e811de26291
    type: regular
    task:
      id: 3682177f-81cc-43db-8688-9e811de26291
      version: -1
      name: Get user ID by email
      description: Queries the sys_user table in ServiceNow.
      script: ServiceNow v2|||servicenow-query-users
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      query:
        simple: email=${inputs.UserEmail}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 02252af0-eba9-4d5c-898e-a53827672bed
    type: condition
    task:
      id: 02252af0-eba9-4d5c-898e-a53827672bed
      version: -1
      name: User found?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "19"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ServiceNow.User
                accessor: ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 5fff1e7b-4ea4-4af8-8be0-ab0618869037
    type: regular
    task:
      id: 5fff1e7b-4ea4-4af8-8be0-ab0618869037
      version: -1
      name: Get computer details by UserID
      description: Queries the cmdb_ci_computer table in ServiceNow.
      script: ServiceNow v2|||servicenow-query-computers
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "39"
    scriptarguments:
      query:
        simple: assigned_to=${ServiceNow.User.ID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 2a2fcf71-a92c-4875-8dd7-f458b06dec5a
    type: title
    task:
      id: 2a2fcf71-a92c-4875-8dd7-f458b06dec5a
      version: -1
      name: Done - SNOW
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: c0ac4f79-8171-469c-88c0-9929e7828c57
    type: condition
    task:
      id: c0ac4f79-8171-469c-88c0-9929e7828c57
      version: -1
      name: Check if any device found
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "23"
      "yes":
      - "22"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: SnowComputers
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: GoogleDevices
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: JamfMobileDevices
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: JamfComputers
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: ADComputer
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: MSGraphDevices
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 1830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 9293016c-3340-4bb2-870d-48ab12bea3fd
    type: regular
    task:
      id: 9293016c-3340-4bb2-870d-48ab12bea3fd
      version: -1
      name: Set UserDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "23"
    scriptarguments:
      key:
        simple: UserDevices
      value:
        complex:
          root: SnowComputers
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: GoogleDevices
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: JamfMobileDevices
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: JamfComputers
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: ADComputer
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: MSGraphDevices
                iscontext: true
              raw: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 2040
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 4bfbaf8f-85a4-44bb-8765-9c175a74df93
    type: title
    task:
      id: 4bfbaf8f-85a4-44bb-8765-9c175a74df93
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 2210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: aa3e9512-8566-4722-8f8b-2a611c60c2fd
    type: title
    task:
      id: aa3e9512-8566-4722-8f8b-2a611c60c2fd
      version: -1
      name: Active Directory
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "25"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: c6eec195-b3ef-46ff-840d-e13e407bdc4c
    type: condition
    task:
      id: c6eec195-b3ef-46ff-840d-e13e407bdc4c
      version: -1
      name: CustomADAttribute exist?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "26"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.CustomADAttribute
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 39851b37-ed87-40cf-8826-e09f468f47fd
    type: condition
    task:
      id: 39851b37-ed87-40cf-8826-e09f468f47fd
      version: -1
      name: Active Directory Query v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "28"
      "yes":
      - "27"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 700
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 29684d8f-17d1-4eb4-8829-78927db140df
    type: regular
    task:
      id: 29684d8f-17d1-4eb4-8829-78927db140df
      version: -1
      name: Get user details
      description: Retrieves detailed information about a user account. The user can be specified by name, email address, or as an Active Directory Distinguished Name (DN). If no filter is specified, all users are returned.
      script: '|||ad-get-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      attributes:
        complex:
          root: inputs.CustomADAttribute
      email:
        complex:
          root: inputs.UserEmail
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: 4f68283f-29ac-49c8-8058-c9bdce1cace8
    type: title
    task:
      id: 4f68283f-29ac-49c8-8058-c9bdce1cace8
      version: -1
      name: Done - AD
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 184f208a-aad3-424c-842f-f295ae708111
    type: regular
    task:
      id: 184f208a-aad3-424c-842f-f295ae708111
      version: -1
      name: Save the custom attribute value
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      key:
        simple: ADComputerName
      value:
        complex:
          root: ActiveDirectory
          accessor: Users
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: inputs.CustomADAttribute
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 8e29f1d1-c9e0-4d5e-87c7-9cb9d5c31aa8
    type: condition
    task:
      id: 8e29f1d1-c9e0-4d5e-87c7-9cb9d5c31aa8
      version: -1
      name: Any results?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: JAMF.Computer
                accessor: id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 718119f3-882d-4126-878f-89e3ce9ca174
    type: condition
    task:
      id: 718119f3-882d-4126-878f-89e3ce9ca174
      version: -1
      name: Any results?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "33"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: JAMF.MobileDevice
                accessor: id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 850
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 3853d860-e3a9-45c7-8462-42c88f1a0587
    type: regular
    task:
      id: 3853d860-e3a9-45c7-8462-42c88f1a0587
      version: -1
      name: Get computer information
      description: 'Returns the "general" subset of a specific computer, e.g.: name, MAC address, IP, serial number, UDID, etc.'
      script: '|||jamf-get-computer-by-id'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      id:
        complex:
          root: JAMF.Computer
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1065
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 910a38ab-dbb4-42b1-8efb-e047703d1c5e
    type: regular
    task:
      id: 910a38ab-dbb4-42b1-8efb-e047703d1c5e
      version: -1
      name: Get mobile device information
      description: 'Returns the "general" subset of a specific mobile device, e.g.: name, MAC address, IP, serial number, UDID. etc.'
      script: '|||jamf-get-mobile-device-by-id'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      id:
        complex:
          root: JAMF.MobileDevice
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1065
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: b9eed896-0f9f-47b1-843b-5ce5749e3288
    type: regular
    task:
      id: b9eed896-0f9f-47b1-843b-5ce5749e3288
      version: -1
      name: set JamfComputers
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "36"
    scriptarguments:
      key:
        simple: JamfComputers
      value:
        simple: '${JAMF.Computer={Name: val[''name''], SerialNumber: val[''serial_number''], ID: val[''id''], Model: val[''platform''], MACAddress: val[''mac_address''], OS: '''', Integration: ''jamf v2''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 20a86189-8aaf-47b3-81ca-36fc70ad4181
    type: regular
    task:
      id: 20a86189-8aaf-47b3-81ca-36fc70ad4181
      version: -1
      name: set JamfMobileDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      key:
        simple: JamfMobileDevices
      value:
        simple: '${JAMF.MobileDevice={Name: val[''name''], SerialNumber: val[''serial_number''], ID: val[''id''], Model: val[''model''], MACAddress: val[''wifi_mac_address''], OS: '''', Integration: ''jamf v2''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1380,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 6ad641e8-da8e-4101-817b-dc24f655ab2f
    type: regular
    task:
      id: 6ad641e8-da8e-4101-817b-dc24f655ab2f
      version: -1
      name: Remove null results
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: JamfComputers
      value:
        complex:
          root: JamfComputers
          filters:
          - - operator: isExists
              left:
                value:
                  simple: JamfComputers.ID
                iscontext: true
              ignorecase: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: b443b306-b64f-459b-8759-47c930ea73f7
    type: condition
    task:
      id: b443b306-b64f-459b-8759-47c930ea73f7
      version: -1
      name: Any results?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: GSuite.MobileDevices.MobileListObjects
                accessor: deviceId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: e0010aad-6fdd-49dd-8a08-c446a014c14f
    type: regular
    task:
      id: e0010aad-6fdd-49dd-8a08-c446a014c14f
      version: -1
      name: Set GoogleDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      key:
        simple: GoogleDevices
      value:
        simple: '${GSuite.MobileDevices.MobileListObjects={Name: val[''name''], SerialNumber: val[''serialNumber''], ID: val[''deviceId''], Model: val[''model''], MACAddress: val[''wifiMacAddress''], OS: val[''os''], Integration: ''GSuiteAdmin''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 40,
          "y": 1250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 383b2b83-ee82-4013-8d3c-42d004722163
    type: condition
    task:
      id: 383b2b83-ee82-4013-8d3c-42d004722163
      version: -1
      name: Any results?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ServiceNow.Computer
                accessor: ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: e30ea76a-0a74-4596-84c6-328438aa6024
    type: regular
    task:
      id: e30ea76a-0a74-4596-84c6-328438aa6024
      version: -1
      name: Set SnowComputers
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      key:
        simple: SnowComputers
      value:
        simple: '${ServiceNow.Computer={Name: val[''Name''], SerialNumber: '''', ID: val[''ID''], Model: '''', MACAddress: '''', OS: val[''OperatingSystem''], Integration: ''ServiceNow v2''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -540,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 96a68565-f28f-4a7d-882f-28c6aa15ab0a
    type: regular
    task:
      id: 96a68565-f28f-4a7d-882f-28c6aa15ab0a
      version: -1
      name: Set ADComputer
      description: Set multiple keys/values to the context.
      scriptName: SetMultipleValues
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "28"
    scriptarguments:
      keys:
        simple: Name,SerialNumber,ID,Model,MACAddress,OS,Integration
      parent:
        simple: ADComputer
      values:
        simple: ${ADComputerName},,,,,,Active Directory Query v2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 1e1a0002-70c4-448b-8c36-faa96e372365
    type: condition
    task:
      id: 1e1a0002-70c4-448b-8c36-faa96e372365
      version: -1
      name: Any results?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "28"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ActiveDirectory
                accessor: Users
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: inputs.CustomADAttribute
                      iscontext: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1120,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 6f42217d-7791-434e-80ce-1b65b0483b85
    type: title
    task:
      id: 6f42217d-7791-434e-80ce-1b65b0483b85
      version: -1
      name: Microsoft Graph API
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1680,
          "y": 340
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: b3ca6346-d3f9-41e6-8085-ed27033345a9
    type: condition
    task:
      id: b3ca6346-d3f9-41e6-8085-ed27033345a9
      version: -1
      name: Microsoft Graph API enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "46"
      "yes":
      - "45"
    scriptarguments:
      brandname:
        simple: Microsoft Graph API
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1680,
          "y": 500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: f0d84075-0543-4c7b-8ee4-b5451507b771
    type: regular
    task:
      id: f0d84075-0543-4c7b-8ee4-b5451507b771
      version: -1
      name: MSGraphAPI - Get user owned devices
      description: Run a Microsoft Graph API query.
      script: Microsoft Graph API|||msgraph-api-request
      type: regular
      iscommand: true
      brand: Microsoft Graph API
    nexttasks:
      '#error#':
      - "46"
      '#none#':
      - "47"
    scriptarguments:
      resource:
        simple: /users/${inputs.UserEmail}/ownedDevices
    separatecontext: false
    continueonerror: true
    continueonerrortype: errorPath
    view: |-
      {
        "position": {
          "x": -1680,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 0d576358-3344-45c0-85ed-735ace5ffb99
    type: title
    task:
      id: 0d576358-3344-45c0-85ed-735ace5ffb99
      version: -1
      name: MSGraph API - Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "21"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1680,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 60e068dd-b484-40eb-8432-8f729d3e6391
    type: condition
    task:
      id: 60e068dd-b484-40eb-8432-8f729d3e6391
      version: -1
      name: Any results?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "46"
      "yes":
      - "48"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MicrosoftGraph
                accessor: deviceId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1680,
          "y": 880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: 9c9a33be-a077-4903-8a1e-0bc8a6c7983c
    type: regular
    task:
      id: 9c9a33be-a077-4903-8a1e-0bc8a6c7983c
      version: -1
      name: Set MSGraphDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      key:
        simple: MSGraphDevices
      value:
        simple: '${MicrosoftGraph={Name: val[''displayName''], SerialNumber: '''', ID: val[''deviceId''], Model: '''', MACAddress: '''', OS: val[''operatingSystem''], Integration: ''Microsoft Graph API''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1680,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "10_7_no": 0.29,
      "16_17_yes": 0.36,
      "16_20_no": 0.13,
      "18_19_yes": 0.46,
      "18_20_#default#": 0.1,
      "1_15_yes": 0.46,
      "25_26_yes": 0.38,
      "25_28_#default#": 0.1,
      "26_28_no": 0.12,
      "30_32_yes": 0.39,
      "30_7_#default#": 0.18,
      "31_33_yes": 0.51,
      "31_7_#default#": 0.2,
      "37_13_#default#": 0.13,
      "39_20_#default#": 0.33,
      "42_28_#default#": 0.11,
      "42_29_yes": 0.43,
      "44_46_no": 0.15,
      "45_46_#error#": 0.18,
      "47_46_#default#": 0.12,
      "5_13_#default#": 0.1,
      "5_6_yes": 0.52,
      "6_13_no": 0.15,
      "6_4_yes": 0.49
    },
    "paper": {
      "dimensions": {
        "height": 2335,
        "width": 3980,
        "x": -2220,
        "y": -60
      }
    }
  }
inputs:
- key: UserEmail
  value: {}
  required: false
  description: The email address of the user.
  playbookInputQuery:
- key: GsuiteCustomerID
  value: {}
  required: false
  description: If using Google Workspace, a customer ID is needed.
  playbookInputQuery:
- key: CustomADAttribute
  value: {}
  required: false
  description: |-
    A custom Active Directory attribute.
    In case there is a custom attribute in Active Directory which stores the name of the computer assigned to the user in the user object, it would be fetched.
  playbookInputQuery:
outputs:
- contextPath: GSuite.MobileDevices
  description: Gsuite mobile devices.
  type: unknown
- contextPath: GSuite.MobileDevices.MobileListObjects
  description: A list of mobile device objects.
- contextPath: GSuite.MobileDevices.MobileListObjects.kind
  description: The type of the API resource.
- contextPath: GSuite.MobileDevices.MobileListObjects.etag
  description: ETag of the resource.
- contextPath: GSuite.MobileDevices.MobileListObjects.resourceId
  description: The unique ID the API service uses to identify the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.deviceId
  description: The serial number for a Google Sync mobile device. For Android and iOS devices, this is a software-generated unique identifier.
- contextPath: GSuite.MobileDevices.MobileListObjects.name
  description: A list of the owner's usernames.
- contextPath: GSuite.MobileDevices.MobileListObjects.email
  description: A list of the owner's email addresses.
- contextPath: GSuite.MobileDevices.MobileListObjects.model
  description: The mobile device's model name.
- contextPath: GSuite.MobileDevices.MobileListObjects.os
  description: The mobile device's operating system.
- contextPath: GSuite.MobileDevices.MobileListObjects.type
  description: The type of mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.status
  description: The mobile device's status.
- contextPath: GSuite.MobileDevices.MobileListObjects.hardwareId
  description: The IMEI/MEID unique identifier for Android hardware.
- contextPath: GSuite.MobileDevices.MobileListObjects.firstSync
  description: The date and time the mobile device was initially synchronized with the policy settings in the Admin console.
- contextPath: GSuite.MobileDevices.MobileListObjects.lastSync
  description: The date and time the mobile device was last synchronized with the policy settings in the Admin console.
- contextPath: GSuite.MobileDevices.MobileListObjects.userAgent
  description: Information about the mobile device such as the operating system version.
- contextPath: GSuite.MobileDevices.MobileListObjects.serialNumber
  description: The mobile device's serial number.
- contextPath: GSuite.MobileDevices.MobileListObjects.imei
  description: The mobile device's IMEI number.
- contextPath: GSuite.MobileDevices.MobileListObjects.meid
  description: The mobile device's MEID number.
- contextPath: GSuite.MobileDevices.MobileListObjects.wifiMacAddress
  description: The mobile device's MAC address on Wi-Fi networks.
- contextPath: GSuite.MobileDevices.MobileListObjects.networkOperator
  description: Mobile device mobile or network operator.
- contextPath: GSuite.MobileDevices.MobileListObjects.defaultLanguage
  description: The default locale used on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.managedAccountIsOnOwnerProfile
  description: Boolean indicating if this account is on the owner/primary profile.
- contextPath: GSuite.MobileDevices.MobileListObjects.deviceCompromisedStatus
  description: The compromised device status.
- contextPath: GSuite.MobileDevices.MobileListObjects.buildNumber
  description: The mobile device's operating system build number.
- contextPath: GSuite.MobileDevices.MobileListObjects.kernelVersion
  description: The mobile device's kernel version.
- contextPath: GSuite.MobileDevices.MobileListObjects.basebandVersion
  description: The mobile device's baseband version.
- contextPath: GSuite.MobileDevices.MobileListObjects.unknownSourcesStatus
  description: Unknown sources enabled or disabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.adbStatus
  description: Whether adb (USB debugging) is enabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.developerOptionsStatus
  description: Whether developer options are enabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.otherAccountsInfo
  description: A list of accounts added on the device.
- contextPath: GSuite.MobileDevices.MobileListObjects.supportsWorkProfile
  description: Work profile supported on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.manufacturer
  description: Mobile device manufacturer.
- contextPath: GSuite.MobileDevices.MobileListObjects.releaseVersion
  description: Mobile device release version.
- contextPath: GSuite.MobileDevices.MobileListObjects.securityPatchLevel
  description: Mobile device security patch level.
- contextPath: GSuite.MobileDevices.MobileListObjects.brand
  description: Mobile device brand.
- contextPath: GSuite.MobileDevices.MobileListObjects.bootloaderVersion
  description: Mobile device bootloader version.
- contextPath: GSuite.MobileDevices.MobileListObjects.hardware
  description: Mobile device hardware.
- contextPath: GSuite.MobileDevices.MobileListObjects.encryptionStatus
  description: Mobile device encryption status.
- contextPath: GSuite.MobileDevices.MobileListObjects.devicePasswordStatus
  description: Mobile device password status.
- contextPath: GSuite.MobileDevices.MobileListObjects.privilege
  description: DM agent permission.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications
  description: GSuite mobile device applications.
  type: unknown
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.packageName
  description: The application's package name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.displayName
  description: The application's display name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionName
  description: The application's version name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionCode
  description: The application's version code.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.permission
  description: The list of permissions of this application.
- contextPath: JAMF.Computer
  description: Jamf computer object.
  type: unknown
- contextPath: JAMF.Computer.id
  description: The computer ID.
- contextPath: JAMF.Computer.name
  description: The computer name.
- contextPath: JAMF.Computer.udid
  description: The computer UDID.
- contextPath: JAMF.Computer.serial_number
  description: The computer serial number.
- contextPath: JAMF.Computer.mac_address
  description: The computer MAC address.
- contextPath: JAMF.Computer.alt_mac_address
  description: The computer alt MAC address.
- contextPath: JAMF.Computer.asset_tag
  description: The computer asset tag.
- contextPath: JAMF.Computer.bar_code_1
  description: The computer barcode 1.
- contextPath: JAMF.Computer.bar_code_2
  description: The computer barcode 2.
- contextPath: JAMF.Computer.username
  description: The computer username.
- contextPath: JAMF.Computer.realname
  description: The computer real name.
- contextPath: JAMF.Computer.email
  description: The computer email address.
- contextPath: JAMF.Computer.email_address
  description: The computer email address.
- contextPath: JAMF.Computer.room
  description: The computer room.
- contextPath: JAMF.Computer.position
  description: The computer position.
- contextPath: JAMF.Computer.building
  description: The computer building.
- contextPath: JAMF.Computer.building_name
  description: The computer building name.
- contextPath: JAMF.Computer.department
  description: The computer department.
- contextPath: JAMF.Computer.department_name
  description: The computer department name.
- contextPath: JAMF.MobileDevice
  description: Jamf mobile device object.
  type: unknown
- contextPath: JAMF.MobileDevice.id
  description: The mobile device ID.
- contextPath: JAMF.MobileDevice.name
  description: The mobile device name.
- contextPath: JAMF.MobileDevice.udid
  description: The mobile device UDID.
- contextPath: JAMF.MobileDevice.serial_number
  description: The mobile device serial number.
- contextPath: JAMF.MobileDevice.mac_address
  description: The mobile device MAC address.
- contextPath: JAMF.MobileDevice.wifi_mac_address
  description: The mobile device WI-FI MAC address.
- contextPath: JAMF.MobileDevice.username
  description: The mobile device username.
- contextPath: JAMF.MobileDevice.realname
  description: The mobile device real name.
- contextPath: JAMF.MobileDevice.email
  description: The mobile device user email address.
- contextPath: JAMF.MobileDevice.email_address
  description: The mobile device user email address.
- contextPath: JAMF.MobileDevice.room
  description: The mobile device room.
- contextPath: JAMF.MobileDevice.position
  description: The mobile device position.
- contextPath: JAMF.MobileDevice.building
  description: The mobile device building.
- contextPath: JAMF.MobileDevice.building_name
  description: The mobile device building name.
- contextPath: JAMF.MobileDevice.department
  description: The mobile device department.
- contextPath: JAMF.MobileDevice.department_name
  description: The mobile device department name.
- contextPath: ServiceNow.Computer
  description: ServiceNow computer object.
  type: unknown
- contextPath: ServiceNow.Computer.ID
  description: Computer system ID.
- contextPath: ServiceNow.Computer.AssetTag
  description: Computer asset tag.
- contextPath: ServiceNow.Computer.Name
  description: Computer name.
- contextPath: ServiceNow.Computer.DisplayName
  description: Computer display name.
- contextPath: ServiceNow.Computer.SupportGroup
  description: Computer support group.
- contextPath: ServiceNow.Computer.OperatingSystem
  description: Computer operating system.
- contextPath: ServiceNow.Computer.Company
  description: Computer company system ID.
- contextPath: ServiceNow.Computer.AssignedTo
  description: Computer assigned to user system ID.
- contextPath: ServiceNow.Computer.State
  description: Computer state.
- contextPath: ServiceNow.Computer.Cost
  description: Computer cost.
- contextPath: ServiceNow.Computer.Comments
  description: Computer comments.
- contextPath: UserDevices
  description: Devices retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Name
  description: Devices names retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.SerialNumber
  description: Devices serial numbers retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.ID
  description: Devices IDs retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Model
  description: Devices models retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.OS
  description: Devices operating systems retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Integration
  description: The integration which retrieved the devices.
  type: unknown
- contextPath: UserDevices.MACAddress
  description: Devices MAC Address retrieved by this playbook.
  type: unknown
- contextPath: MicrosoftGraph
  description: MicrosoftGraph results.
  type: unknown
- contextPath: MicrosoftGraph.profileType
  description: Device profile type.
  type: unknown
- contextPath: MicrosoftGraph.operatingSystemVersion
  description: Device OS version.
  type: unknown
- contextPath: MicrosoftGraph.displayName
  description: Device display name.
  type: unknown
- contextPath: MicrosoftGraph.operatingSystem
  description: Device OS.
  type: unknown
- contextPath: MicrosoftGraph.deviceId
  description: Device ID.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.8.0
marketplaces:
- xsoar
- marketplacev2
- platform