Get User Devices by Username - Generic

This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: - Name - Serial Number - ID - Model - MAC Address - OS - Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: - jamf v2 - Microsoft Defender for Endpoint - Cortex XDR IR - ServiceNow v2 - Google Workspace (Gsuite) - Active Directory Query v2.

Common Playbooks · 58 tasks · 3 inputs · 150 outputs

Inputs

  • Username — The username of the user.
  • GsuiteCustomerID — If using Google Workspace, a customer ID is needed.
  • CustomADAttribute — A custom Active Directory attribute. In case there is a custom attribute in Active Directory which stores the name of the computer assigned to the user in the user object, it would be fetched.

Outputs

  • GSuite.MobileDevices — Gsuite mobile devices.
  • GSuite.MobileDevices.MobileListObjects — A list of mobile device objects.
  • GSuite.MobileDevices.MobileListObjects.kind — The type of the API resource.
  • GSuite.MobileDevices.MobileListObjects.etag — ETag of the resource.
  • GSuite.MobileDevices.MobileListObjects.resourceId — The unique ID the API service uses to identify the mobile device.
  • GSuite.MobileDevices.MobileListObjects.deviceId — The serial number for a Google Sync mobile device. For Android and iOS devices, this is a software-generated unique identifier.
  • GSuite.MobileDevices.MobileListObjects.name — A list of the owner's usernames.
  • GSuite.MobileDevices.MobileListObjects.email — A list of the owner's email addresses.
  • GSuite.MobileDevices.MobileListObjects.model — The mobile device's model name.
  • GSuite.MobileDevices.MobileListObjects.os — The mobile device's operating system.
  • GSuite.MobileDevices.MobileListObjects.type — The type of mobile device.
  • GSuite.MobileDevices.MobileListObjects.status — The mobile device's status.
  • GSuite.MobileDevices.MobileListObjects.hardwareId — The IMEI/MEID unique identifier for Android hardware.
  • GSuite.MobileDevices.MobileListObjects.firstSync — The date and time the mobile device was initially synchronized with the policy settings in the Admin console.
  • GSuite.MobileDevices.MobileListObjects.lastSync — The date and time the mobile device was last synchronized with the policy settings in the Admin console.
  • GSuite.MobileDevices.MobileListObjects.userAgent — Information about the mobile device such as the operating system version.
  • GSuite.MobileDevices.MobileListObjects.serialNumber — The mobile device's serial number.
  • GSuite.MobileDevices.MobileListObjects.imei — The mobile device's IMEI number.
  • GSuite.MobileDevices.MobileListObjects.meid — The mobile device's MEID number.
  • GSuite.MobileDevices.MobileListObjects.wifiMacAddress — The mobile device's MAC address on Wi-Fi networks.
  • GSuite.MobileDevices.MobileListObjects.networkOperator — Mobile device mobile or network operator.
  • GSuite.MobileDevices.MobileListObjects.defaultLanguage — The default locale used on the mobile device.
  • GSuite.MobileDevices.MobileListObjects.managedAccountIsOnOwnerProfile — Boolean indicating if this account is on the owner/primary profile.
  • GSuite.MobileDevices.MobileListObjects.deviceCompromisedStatus — The compromised device status.
  • GSuite.MobileDevices.MobileListObjects.buildNumber — The mobile device's operating system build number.
  • GSuite.MobileDevices.MobileListObjects.kernelVersion — The mobile device's kernel version.
  • GSuite.MobileDevices.MobileListObjects.basebandVersion — The mobile device's baseband version.
  • GSuite.MobileDevices.MobileListObjects.unknownSourcesStatus — Unknown sources enabled or disabled on the mobile device.
  • GSuite.MobileDevices.MobileListObjects.adbStatus — Whether adb (USB debugging) is enabled on the mobile device.
  • GSuite.MobileDevices.MobileListObjects.developerOptionsStatus — Whether developer options are enabled on the mobile device.
  • GSuite.MobileDevices.MobileListObjects.otherAccountsInfo — A list of accounts added on the device.
  • GSuite.MobileDevices.MobileListObjects.supportsWorkProfile — Work profile supported on the mobile device.
  • GSuite.MobileDevices.MobileListObjects.manufacturer — Mobile device manufacturer.
  • GSuite.MobileDevices.MobileListObjects.releaseVersion — Mobile device release version.
  • GSuite.MobileDevices.MobileListObjects.securityPatchLevel — Mobile device security patch level.
  • GSuite.MobileDevices.MobileListObjects.brand — Mobile device brand.
  • GSuite.MobileDevices.MobileListObjects.bootloaderVersion — Mobile device bootloader version.
  • GSuite.MobileDevices.MobileListObjects.hardware — Mobile device hardware.
  • GSuite.MobileDevices.MobileListObjects.encryptionStatus — Mobile device encryption status.
  • GSuite.MobileDevices.MobileListObjects.devicePasswordStatus — Mobile device password status.
  • GSuite.MobileDevices.MobileListObjects.privilege — DM agent permission.
  • GSuite.MobileDevices.MobileListObjects.applications — Mobile device applications.
  • GSuite.MobileDevices.MobileListObjects.applications.packageName — The application's package name.
  • GSuite.MobileDevices.MobileListObjects.applications.displayName — The application's display name.
  • GSuite.MobileDevices.MobileListObjects.applications.versionName — The application's version name.
  • GSuite.MobileDevices.MobileListObjects.applications.versionCode — The application's version code.
  • GSuite.MobileDevices.MobileListObjects.applications.permission — The list of permissions of this application.
  • JAMF.Computer — Computer object.
  • JAMF.Computer.id — The computer ID.
  • JAMF.Computer.name — The computer name.
  • JAMF.Computer.udid — The computer UDID.
  • JAMF.Computer.serial_number — The computer serial number.
  • JAMF.Computer.mac_address — The computer MAC address.
  • JAMF.Computer.alt_mac_address — The computer alt MAC address.
  • JAMF.Computer.asset_tag — The computer asset tag.
  • JAMF.Computer.bar_code_1 — The computer barcode 1.
  • JAMF.Computer.bar_code_2 — The computer barcode 2.
  • JAMF.Computer.username — The computer username.
  • JAMF.Computer.realname — The computer real name.
  • JAMF.Computer.email — The computer email address.
  • JAMF.Computer.email_address — The computer email address.
  • JAMF.Computer.room — The computer room.
  • JAMF.Computer.position — The computer position.
  • JAMF.Computer.building — The computer building.
  • JAMF.Computer.building_name — The computer building name.
  • JAMF.Computer.department — The computer department.
  • JAMF.Computer.department_name — The computer department name.
  • JAMF.MobileDevice — Mobile device object.
  • JAMF.MobileDevice.id — The mobile device ID.
  • JAMF.MobileDevice.name — The mobile device name.
  • JAMF.MobileDevice.udid — The mobile device UDID.
  • JAMF.MobileDevice.serial_number — The mobile device serial number.
  • JAMF.MobileDevice.mac_address — The mobile device MAC address.
  • JAMF.MobileDevice.wifi_mac_address — The mobile device WI-FI MAC address.
  • JAMF.MobileDevice.username — The mobile device username.
  • JAMF.MobileDevice.realname — The mobile device real name.
  • JAMF.MobileDevice.email — The mobile device user email address.
  • JAMF.MobileDevice.email_address — The mobile device user email address.
  • JAMF.MobileDevice.room — The mobile device room.
  • JAMF.MobileDevice.position — The mobile device position.
  • JAMF.MobileDevice.building — The mobile device building.
  • JAMF.MobileDevice.building_name — The mobile device building name.
  • JAMF.MobileDevice.department — The mobile device department.
  • JAMF.MobileDevice.department_name — The mobile device department name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_id — The endpoint ID.
  • PaloAltoNetworksXDR.Endpoint.endpoint_name — The endpoint name.
  • PaloAltoNetworksXDR.Endpoint.endpoint_type — The endpoint type.
  • PaloAltoNetworksXDR.Endpoint.endpoint_status — The status of the endpoint.
  • PaloAltoNetworksXDR.Endpoint.os_type — The endpoint OS type.
  • PaloAltoNetworksXDR.Endpoint.ip — A list of IP addresses.
  • PaloAltoNetworksXDR.Endpoint.users — A list of users.
  • PaloAltoNetworksXDR.Endpoint.domain — The endpoint domain.
  • PaloAltoNetworksXDR.Endpoint.alias — The endpoint's aliases.
  • PaloAltoNetworksXDR.Endpoint.first_seen — First seen date/time in Epoch (milliseconds).
  • PaloAltoNetworksXDR.Endpoint.last_seen — Last seen date/time in Epoch (milliseconds).
  • PaloAltoNetworksXDR.Endpoint.content_version — Content version.
  • PaloAltoNetworksXDR.Endpoint.installation_package — Installation package.
  • PaloAltoNetworksXDR.Endpoint.active_directory — Active directory.
  • PaloAltoNetworksXDR.Endpoint.install_date — Install date in Epoch (milliseconds).
  • PaloAltoNetworksXDR.Endpoint.endpoint_version — Endpoint version.
  • PaloAltoNetworksXDR.Endpoint.is_isolated — Whether the endpoint is isolated.
  • PaloAltoNetworksXDR.Endpoint.group_name — The name of the group to which the endpoint belongs.
  • PaloAltoNetworksXDR.Endpoint.count — Number of endpoints returned.
  • Endpoint.Hostname — The hostname that is mapped to this endpoint.
  • Endpoint.ID — The unique ID within the tool retrieving the endpoint.
  • Endpoint.IPAddress — The IP address of the endpoint.
  • Endpoint.Domain — The domain of the endpoint.
  • Endpoint.OS — The endpoint's operation system.
  • Endpoint.Status — The endpoint's status.
  • Endpoint.IsIsolated — The endpoint's isolation status.
  • Endpoint.MACAddress — The endpoint's MAC address.
  • Endpoint.Vendor — The integration name of the endpoint vendor.
  • MicrosoftATP.UserMachine.Username — The username.
  • MicrosoftATP.UserMachine.Machines.ID — The machine ID.
  • MicrosoftATP.UserMachine.Machines.ComputerDNSName — The machine DNS name.
  • MicrosoftATP.UserMachine.Machines.FirstSeen — The first date and time the machine was observed by Microsoft Defender ATP.
  • MicrosoftATP.UserMachine.Machines.LastSeen — The last date and time the machine was observed by Microsoft Defender ATP.
  • MicrosoftATP.UserMachine.Machines.OSPlatform — The operating system platform.
  • MicrosoftATP.UserMachine.Machines.OSVersion — The operating system version.
  • MicrosoftATP.UserMachine.Machines.OSProcessor — The operating system processor.
  • MicrosoftATP.UserMachine.Machines.LastExternalIPAddress — The last IP through which the machine accessed the internet.
  • MicrosoftATP.UserMachine.Machines.OSBuild — The operating system build number.
  • MicrosoftATP.UserMachine.Machines.HealthStatus — The machine health status.
  • MicrosoftATP.UserMachine.Machines.RBACGroupID — The machine RBAC group ID.
  • MicrosoftATP.UserMachine.Machines.RBACGroupName — The machine RBAC group name.
  • MicrosoftATP.UserMachine.Machines.RiskScore — The machine risk score.
  • MicrosoftATP.UserMachine.Machines.ExposureLevel — The machine exposure level.
  • MicrosoftATP.UserMachine.Machines.IsAADJoined — True if machine is AAD joined, False otherwise.
  • MicrosoftATP.UserMachine.Machines.AADDeviceID — The AAD device ID.
  • MicrosoftATP.UserMachine.Machines.MachineTags — Set of machine tags.
  • MicrosoftATP.v.Machines.LastIPAddress — The last IP on the machine.
  • ServiceNow.Computer.ID — Computer system ID.
  • ServiceNow.Computer.AssetTag — Computer asset tag.
  • ServiceNow.Computer.Name — Computer name.
  • ServiceNow.Computer.DisplayName — Computer display name.
  • ServiceNow.Computer.SupportGroup — Computer support group.
  • ServiceNow.Computer.OperatingSystem — Computer operating system.
  • ServiceNow.Computer.Company — Computer company system ID.
  • ServiceNow.Computer.AssignedTo — Computer assigned to user system ID.
  • ServiceNow.Computer.State — Computer state.
  • ServiceNow.Computer.Cost — Computer cost.
  • ServiceNow.Computer.Comments — Computer comments.
  • UserDevices — Devices retrieved by this playbook.
  • UserDevices.Name — Devices names retrieved by this playbook.
  • UserDevices.SerialNumber — Devices serial numbers retrieved by this playbook.
  • UserDevices.ID — Devices IDs retrieved by this playbook.
  • UserDevices.Model — Devices models retrieved by this playbook.
  • UserDevices.OS — Devices operating systems retrieved by this playbook.
  • UserDevices.Integration — The integration which retrieved the devices.
  • UserDevices.MACAddress — Devices MAC Address retrieved by this playbook.

Commands used

ad-get-user core-get-endpoints gsuite-mobiledevice-list jamf-get-computer-by-id jamf-get-computer-by-match jamf-get-mobile-device-by-id jamf-get-mobile-device-by-match microsoft-atp-get-user-machines servicenow-query-computers servicenow-query-users xdr-get-endpoints

Flowchart

yes yes yes yes yes yes yes no yes no yes yes no yes no yes no yes yes yes yes no yes yes yes yes yes yes yes yes no yes yes Start Start Username exists? Username exists? Google Workspace (Gsuite) Google Workspace (Gsuite) Google Workspace - Get device details - gsuite-mobiledevice-list Google Workspace - Get de... gsuite-mobiledevice-list Customer ID exist? Customer ID exist? GSuiteAdmin enabled? - IsIntegrationAvailable GSuiteAdmin enabled? IsIntegrationAvailable Done - Jamf Done - Jamf Jamf Jamf Jamf Pro - Get computer details - jamf-get-computer-by-match Jamf Pro - Get computer d... jamf-get-computer-by-match jamf v2 enabled? - IsIntegrationAvailable jamf v2 enabled? IsIntegrationAvailable Jamf Pro - Get mobile device details - jamf-get-mobile-device-by-match Jamf Pro - Get mobile dev... jamf-get-mobile-device-by-match Done - GSuite Done - GSuite Done Done Cortex XDR / Core Cortex XDR / Core Cortex XDR IR enabled? - IsIntegrationAvailable Cortex XDR IR enabled? IsIntegrationAvailable Cortex XDR - Get device details - xdr-get-endpoints Cortex XDR - Get device d... xdr-get-endpoints Done - Cortex XDR Done - Cortex XDR Microsoft Defender for Endpoint Microsoft Defender for En... Microsoft Defender Advanced Threat Protection enabled? - IsIntegrationAvailable Microsoft Defender Advanc... IsIntegrationAvailable MS ATP - get user machines - microsoft-atp-get-user-machines MS ATP - get user machines microsoft-atp-get-user-machines Done - MS Defender Done - MS Defender ServiceNow CMDB ServiceNow CMDB ServiceNow v2 enabled? - IsIntegrationAvailable ServiceNow v2 enabled? IsIntegrationAvailable SNOW - Get user ID by username - servicenow-query-users SNOW - Get user ID by use... servicenow-query-users User found? User found? SNOW - Get computer details by UserID - servicenow-query-computers SNOW - Get computer detai... servicenow-query-computers Done - SNOW Done - SNOW Check if any device found Check if any device found Set UserDevices - SetAndHandleEmpty Set UserDevices SetAndHandleEmpty Done Done Active Directory Active Directory CustomADAttribute exist? CustomADAttribute exist? Active Directory Query v2 enabled? - IsIntegrationAvailable Active Directory Query v2... IsIntegrationAvailable AD - Get user details - ad-get-user AD - Get user details ad-get-user Done - AD Done - AD Save the custom attribute value - SetAndHandleEmpty Save the custom attribute... SetAndHandleEmpty Any results? Any results? Any results? Any results? Get computer information - jamf-get-computer-by-id Get computer information jamf-get-computer-by-id Get mobile device information - jamf-get-mobile-device-by-id Get mobile device informa... jamf-get-mobile-device-by-id set JamfComputers - SetAndHandleEmpty set JamfComputers SetAndHandleEmpty set JamfMobileDevices - SetAndHandleEmpty set JamfMobileDevices SetAndHandleEmpty Remove null results - SetAndHandleEmpty Remove null results SetAndHandleEmpty Any results? Any results? Set SnowComputers - SetAndHandleEmpty Set SnowComputers SetAndHandleEmpty Any results? Any results? Set GoogleDevices - SetAndHandleEmpty Set GoogleDevices SetAndHandleEmpty Set ADComputer - SetMultipleValues Set ADComputer SetMultipleValues Any results? Any results? Any results? Any results? Set MSDefenderDevices - SetAndHandleEmpty Set MSDefenderDevices SetAndHandleEmpty Any results? Any results? Set XDREndpoints - SetAndHandleEmpty Set XDREndpoints SetAndHandleEmpty Cortex Core IR enabled? - IsIntegrationAvailable Cortex Core IR enabled? IsIntegrationAvailable Done - Cortex Core Done - Cortex Core Cortex Core - Get device details - core-get-endpoints Cortex Core - Get device ... core-get-endpoints Any results? Any results? Set XDREndpoints - SetAndHandleEmpty Set XDREndpoints SetAndHandleEmpty