Get User Devices by Username - Generic

id: Get User Devices by Username - Generic
version: -1
name: Get User Devices by Username - Generic
description: |-
  This playbook retrieves information on all of the associated user devices, based on the user's username.
  In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key:
  - Name
  - Serial Number
  - ID
  - Model
  - MAC Address
  - OS
  - Integration

  Note that not all of the supported integrations will be able to retrieve this information.

  Supported integrations:
  - jamf v2
  - Microsoft Defender for Endpoint
  - Cortex XDR IR
  - ServiceNow v2
  - Google Workspace (Gsuite)
  - Active Directory Query v2.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 7f91d06d-7f39-42b3-8fc9-c053b9711389
    type: start
    task:
      id: 7f91d06d-7f39-42b3-8fc9-c053b9711389
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 92420939-e8b5-4eca-8e8a-ca4a185b06fb
    type: condition
    task:
      id: 92420939-e8b5-4eca-8e8a-ca4a185b06fb
      version: -1
      name: Username exists?
      description: Checks if the username input is not empty.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "12"
      "yes":
      - "7"
      - "17"
      - "13"
      - "21"
      - "2"
      - "30"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 98d3f19b-42e7-4129-8271-9b3b12ae0ebb
    type: title
    task:
      id: 98d3f19b-42e7-4129-8271-9b3b12ae0ebb
      version: -1
      name: Google Workspace (Gsuite)
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: b2d45d85-574f-4005-8bd4-94faafb71264
    type: regular
    task:
      id: b2d45d85-574f-4005-8bd4-94faafb71264
      version: -1
      name: Google Workspace - Get device details
      description: Retrieves a paginated list that includes company-owned mobile devices.
      script: '|||gsuite-mobiledevice-list'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "46"
    scriptarguments:
      customer_id:
        complex:
          root: inputs.GsuiteCustomerID
      query:
        simple: name:${inputs.Username}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 642325ab-a47b-466b-8ceb-5f6b870645dc
    type: condition
    task:
      id: 642325ab-a47b-466b-8ceb-5f6b870645dc
      version: -1
      name: Customer ID exist?
      description: Checks if the customer ID input is not empty.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.GsuiteCustomerID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: 7f8b6c8c-f41b-4dcb-8b8b-7aca28f4a929
    type: condition
    task:
      id: 7f8b6c8c-f41b-4dcb-8b8b-7aca28f4a929
      version: -1
      name: GSuiteAdmin enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "11"
      "yes":
      - "3"
    scriptarguments:
      brandname:
        simple: GSuiteAdmin
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 4ef40554-cf34-49cb-899f-08d60acdb09c
    type: title
    task:
      id: 4ef40554-cf34-49cb-899f-08d60acdb09c
      version: -1
      name: Done - Jamf
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1980,
          "y": 1830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 9f903855-b87e-49e4-89b6-4b8e936f155f
    type: title
    task:
      id: 9f903855-b87e-49e4-89b6-4b8e936f155f
      version: -1
      name: Jamf
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1980,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 43cebc52-17a9-417a-8b2f-9b4f9aba01b9
    type: regular
    task:
      id: 43cebc52-17a9-417a-8b2f-9b4f9aba01b9
      version: -1
      name: Jamf Pro - Get computer details
      description: Matches computers by specific characteristics and returns general data on each of the computers.
      script: jamf v2|||jamf-get-computer-by-match
      type: regular
      iscommand: true
      brand: jamf v2
    nexttasks:
      '#none#':
      - "37"
    scriptarguments:
      match:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: e7ef5ffc-3774-47a7-8703-65b270b9c86d
    type: condition
    task:
      id: e7ef5ffc-3774-47a7-8703-65b270b9c86d
      version: -1
      name: jamf v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "6"
      "yes":
      - "8"
      - "10"
    scriptarguments:
      brandname:
        simple: jamf v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1980,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 7810b5de-6dcc-4003-8d47-66daf1804f68
    type: regular
    task:
      id: 7810b5de-6dcc-4003-8d47-66daf1804f68
      version: -1
      name: Jamf Pro - Get mobile device details
      description: Matches mobile devices by specific characteristics and returns general data on each one of the mobile devices.
      script: '|||jamf-get-mobile-device-by-match'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "38"
    scriptarguments:
      match:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2650,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: bb7d7602-53db-41d3-892d-1f67433977cd
    type: title
    task:
      id: bb7d7602-53db-41d3-892d-1f67433977cd
      version: -1
      name: Done - GSuite
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 9d63ac27-9180-446e-8368-6618eddb2c5f
    type: title
    task:
      id: 9d63ac27-9180-446e-8368-6618eddb2c5f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2500,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 169c5e7e-5e78-4951-8ccf-b4124b0390ed
    type: title
    task:
      id: 169c5e7e-5e78-4951-8ccf-b4124b0390ed
      version: -1
      name: Cortex XDR / Core
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
      - "54"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 31e75795-67a1-413d-8c95-e82a2d24c709
    type: condition
    task:
      id: 31e75795-67a1-413d-8c95-e82a2d24c709
      version: -1
      name: Cortex XDR IR enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "16"
      "yes":
      - "15"
    scriptarguments:
      brandname:
        simple: Cortex XDR - IR
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 65bab14c-a758-4bfc-83a4-6147f0a3cf3a
    type: regular
    task:
      id: 65bab14c-a758-4bfc-83a4-6147f0a3cf3a
      version: -1
      name: Cortex XDR - Get device details
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
      script: Cortex XDR - IR|||xdr-get-endpoints
      type: regular
      iscommand: true
      brand: Cortex XDR - IR
    nexttasks:
      '#none#':
      - "52"
    scriptarguments:
      username:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: fe65ba2d-93e9-4c59-8496-3006d7164738
    type: title
    task:
      id: fe65ba2d-93e9-4c59-8496-3006d7164738
      version: -1
      name: Done - Cortex XDR
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 6bc58f17-e345-4a64-87c9-ddda3d6a20f4
    type: title
    task:
      id: 6bc58f17-e345-4a64-87c9-ddda3d6a20f4
      version: -1
      name: Microsoft Defender for Endpoint
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 03a8ebf7-df74-4c8e-8230-cfc2c463d7d6
    type: condition
    task:
      id: 03a8ebf7-df74-4c8e-8230-cfc2c463d7d6
      version: -1
      name: Microsoft Defender Advanced Threat Protection enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "20"
      "yes":
      - "19"
    scriptarguments:
      brandname:
        simple: Microsoft Defender Advanced Threat Protection
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 51b7ad17-cc11-41e4-861a-49d64130c5b3
    type: regular
    task:
      id: 51b7ad17-cc11-41e4-861a-49d64130c5b3
      version: -1
      name: MS ATP - get user machines
      description: Retrieves a collection of machines related to a given user ID.
      script: Microsoft Defender Advanced Threat Protection|||microsoft-atp-get-user-machines
      type: regular
      iscommand: true
      brand: Microsoft Defender Advanced Threat Protection
    nexttasks:
      '#none#':
      - "50"
    scriptarguments:
      username:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 96d6a3fa-d31e-4a75-8ae9-4fff83d6d792
    type: title
    task:
      id: 96d6a3fa-d31e-4a75-8ae9-4fff83d6d792
      version: -1
      name: Done - MS Defender
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1460,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 94a1a4b2-10d0-4f39-8f22-ca766e57a227
    type: title
    task:
      id: 94a1a4b2-10d0-4f39-8f22-ca766e57a227
      version: -1
      name: ServiceNow CMDB
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "22"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 279c5cef-b588-4af1-8454-a121c3615b6f
    type: condition
    task:
      id: 279c5cef-b588-4af1-8454-a121c3615b6f
      version: -1
      name: ServiceNow v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "26"
      "yes":
      - "23"
    scriptarguments:
      brandname:
        simple: ServiceNow v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: f3b72eb2-8f8d-4ab0-8830-ae6d86cb4a6d
    type: regular
    task:
      id: f3b72eb2-8f8d-4ab0-8830-ae6d86cb4a6d
      version: -1
      name: SNOW - Get user ID by username
      description: Queries the sys_user table in ServiceNow.
      script: ServiceNow v2|||servicenow-query-users
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      user_name:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: 35f1249e-457e-4e2a-8357-d9fa3044431b
    type: condition
    task:
      id: 35f1249e-457e-4e2a-8357-d9fa3044431b
      version: -1
      name: User found?
      description: Checks if a username was found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "25"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ServiceNow.User
                accessor: ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 385e4bce-8feb-4a3d-8110-526a7d560ab7
    type: regular
    task:
      id: 385e4bce-8feb-4a3d-8110-526a7d560ab7
      version: -1
      name: SNOW - Get computer details by UserID
      description: Queries the cmdb_ci_computer table in ServiceNow.
      script: ServiceNow v2|||servicenow-query-computers
      type: regular
      iscommand: true
      brand: ServiceNow v2
    nexttasks:
      '#none#':
      - "44"
    scriptarguments:
      query:
        simple: assigned_by=${ServiceNow.User.ID}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 1240
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: 973a28e2-18df-4f15-8093-2955093cad2c
    type: title
    task:
      id: 973a28e2-18df-4f15-8093-2955093cad2c
      version: -1
      name: Done - SNOW
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 76c960de-4232-407e-88d3-3a2b4d1e54e1
    type: condition
    task:
      id: 76c960de-4232-407e-88d3-3a2b4d1e54e1
      version: -1
      name: Check if any device found
      description: Checks if any user device was found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "29"
      "yes":
      - "28"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: SnowComputers
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: GoogleDevices
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: JamfMobileDevices
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: JamfComputers
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: MSDefenderDevices
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: XDREndpoints
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              complex:
                root: ADComputer
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 2020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: c7f91ab4-017e-4c32-8e3e-23220e1c84fc
    type: regular
    task:
      id: c7f91ab4-017e-4c32-8e3e-23220e1c84fc
      version: -1
      name: Set UserDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "29"
    scriptarguments:
      key:
        simple: UserDevices
      value:
        complex:
          root: SnowComputers
          transformers:
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: GoogleDevices
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: JamfMobileDevices
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: JamfComputers
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: ADComputer
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: MSDefenderDevices
                iscontext: true
              raw: {}
          - operator: AppendIfNotEmpty
            args:
              item:
                value:
                  simple: XDREndpoints
                iscontext: true
              raw: {}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 2220
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: b3a51b55-5793-4767-8b11-66fe0b941298
    type: title
    task:
      id: b3a51b55-5793-4767-8b11-66fe0b941298
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 2400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 9c39a8e6-c7c4-49ba-8c35-a263f08206a6
    type: title
    task:
      id: 9c39a8e6-c7c4-49ba-8c35-a263f08206a6
      version: -1
      name: Active Directory
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: 0ad9d77f-b679-45ee-894e-7830b1502627
    type: condition
    task:
      id: 0ad9d77f-b679-45ee-894e-7830b1502627
      version: -1
      name: CustomADAttribute exist?
      description: Checks if a custom AD attribute was provided in the playbook input.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.CustomADAttribute
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: d292e8d7-86db-428f-8513-e5035a1a6947
    type: condition
    task:
      id: d292e8d7-86db-428f-8513-e5035a1a6947
      version: -1
      name: Active Directory Query v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "34"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 5970a949-ae5e-44dc-8057-f44414377bb1
    type: regular
    task:
      id: 5970a949-ae5e-44dc-8057-f44414377bb1
      version: -1
      name: AD - Get user details
      description: Retrieves detailed information about a user account. The user can be specified by name, email address, or as an Active Directory Distinguished Name (DN). If no filter is specified, all users are returned.
      script: '|||ad-get-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "49"
    scriptarguments:
      attributes:
        complex:
          root: inputs.CustomADAttribute
      username:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 29853db3-1746-4cc0-8174-545ff4db7b45
    type: title
    task:
      id: 29853db3-1746-4cc0-8174-545ff4db7b45
      version: -1
      name: Done - AD
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 1820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 0ab095b0-5fe3-465f-8b47-81cba6b3b83d
    type: regular
    task:
      id: 0ab095b0-5fe3-465f-8b47-81cba6b3b83d
      version: -1
      name: Save the custom attribute value
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "48"
    scriptarguments:
      key:
        simple: ADComputerName
      value:
        complex:
          root: ActiveDirectory
          accessor: Users
          transformers:
          - operator: getField
            args:
              field:
                value:
                  simple: inputs.CustomADAttribute
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: 54307288-b5f0-4a11-83ed-3744b5fe18ee
    type: condition
    task:
      id: 54307288-b5f0-4a11-83ed-3744b5fe18ee
      version: -1
      name: Any results?
      description: Checks if any result was found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "39"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: JAMF.Computer
                accessor: id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 1075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: aeec665b-9c0d-4fe6-8150-d1a37cf235ba
    type: condition
    task:
      id: aeec665b-9c0d-4fe6-8150-d1a37cf235ba
      version: -1
      name: Any results?
      description: Checks if any result was found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: JAMF.MobileDevice
                accessor: id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2650,
          "y": 1075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: 4088218f-acad-42fa-82e0-e05649ecac4a
    type: regular
    task:
      id: 4088218f-acad-42fa-82e0-e05649ecac4a
      version: -1
      name: Get computer information
      description: 'Returns the "general" subset of a specific computer, e.g.: name, MAC address, IP, serial number, UDID, etc.'
      script: '|||jamf-get-computer-by-id'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      id:
        complex:
          root: JAMF.Computer
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 1275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: b380fc9d-1597-4148-88d0-ba38680246cc
    type: regular
    task:
      id: b380fc9d-1597-4148-88d0-ba38680246cc
      version: -1
      name: Get mobile device information
      description: 'Returns the "general" subset of a specific mobile device, e.g.: name, MAC address, IP, serial number, UDID. etc.'
      script: '|||jamf-get-mobile-device-by-id'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      id:
        complex:
          root: JAMF.MobileDevice
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2650,
          "y": 1275
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 235add7f-9018-41f9-89f9-6820218625f1
    type: regular
    task:
      id: 235add7f-9018-41f9-89f9-6820218625f1
      version: -1
      name: set JamfComputers
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "43"
    scriptarguments:
      key:
        simple: JamfComputers
      value:
        simple: '${JAMF.Computer={Name: val[''name''], SerialNumber: val[''serial_number''], ID: val[''id''], Model: val[''platform''], MACAddress: val[''mac_address''], OS: '''', Integration: ''jamf v2''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 485be541-d9d5-4d75-8b3e-c135a36eccbf
    type: regular
    task:
      id: 485be541-d9d5-4d75-8b3e-c135a36eccbf
      version: -1
      name: set JamfMobileDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      key:
        simple: JamfMobileDevices
      value:
        simple: '${JAMF.MobileDevice={Name: val[''name''], SerialNumber: val[''serial_number''], ID: val[''id''], Model: val[''model''], MACAddress: val[''wifi_mac_address''], OS: '''', Integration: ''jamf v2''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2650,
          "y": 1460
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 304fe0fd-2226-4556-84d8-7fd4d20d9e6c
    type: regular
    task:
      id: 304fe0fd-2226-4556-84d8-7fd4d20d9e6c
      version: -1
      name: Remove null results
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: JamfComputers
      value:
        complex:
          root: JamfComputers
          filters:
          - - operator: isExists
              left:
                value:
                  simple: JamfComputers.ID
                iscontext: true
              ignorecase: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2200,
          "y": 1630
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 10f93f62-40f7-467d-89d6-1ef8c5954712
    type: condition
    task:
      id: 10f93f62-40f7-467d-89d6-1ef8c5954712
      version: -1
      name: Any results?
      description: Checks if there is any result.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "26"
      "yes":
      - "45"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ServiceNow.Computer
                accessor: ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 7f978671-30dd-40df-8483-7a6e0eade9a6
    type: regular
    task:
      id: 7f978671-30dd-40df-8483-7a6e0eade9a6
      version: -1
      name: Set SnowComputers
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      key:
        simple: SnowComputers
      value:
        simple: '${ServiceNow.Computer={Name: val[''Name''], SerialNumber: '''', ID: val[''ID''], Model: '''', MACAddress: '''', OS: val[''OperatingSystem''], Integration: ''ServiceNow v2''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -120,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: edc77b8c-9115-4658-879a-fc7d39e1c36e
    type: condition
    task:
      id: edc77b8c-9115-4658-879a-fc7d39e1c36e
      version: -1
      name: Any results?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "47"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: GSuite.MobileDevices.MobileListObjects
                accessor: deviceId
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 1280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: 84d39418-6b26-48d3-8785-3c06575be545
    type: regular
    task:
      id: 84d39418-6b26-48d3-8785-3c06575be545
      version: -1
      name: Set GoogleDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      key:
        simple: GoogleDevices
      value:
        simple: '${GSuite.MobileDevices.MobileListObjects={Name: val[''name''], SerialNumber: val[''serialNumber''], ID: val[''deviceId''], Model: val[''model''], MACAddress: val[''wifiMacAddress''], OS: val[''os''], Integration: ''GSuiteAdmin''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: e6b260f6-b77b-4281-89e4-caa634c1c01c
    type: regular
    task:
      id: e6b260f6-b77b-4281-89e4-caa634c1c01c
      version: -1
      name: Set ADComputer
      description: Set multiple keys/values to the context.
      scriptName: SetMultipleValues
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    scriptarguments:
      keys:
        simple: Name,SerialNumber,ID,Model,MACAddress,OS,Integration
      parent:
        simple: ADComputer
      values:
        simple: ${ADComputerName},,,,,,Active Directory Query v2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "49":
    id: "49"
    taskid: b256ed98-732f-4165-88a1-86d94773c72d
    type: condition
    task:
      id: b256ed98-732f-4165-88a1-86d94773c72d
      version: -1
      name: Any results?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "34"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: ActiveDirectory
                accessor: Users
                transformers:
                - operator: getField
                  args:
                    field:
                      value:
                        simple: inputs.CustomADAttribute
                      iscontext: true
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1160,
          "y": 1265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "50":
    id: "50"
    taskid: ff18c78e-c128-42de-8cc2-5929bd1ec9ad
    type: condition
    task:
      id: ff18c78e-c128-42de-8cc2-5929bd1ec9ad
      version: -1
      name: Any results?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "51"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MicrosoftATP.UserMachine.Machines
                accessor: ID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1450,
          "y": 1075
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "51":
    id: "51"
    taskid: 1e76e6a4-41e7-4a77-85aa-59e5a41f8e2d
    type: regular
    task:
      id: 1e76e6a4-41e7-4a77-85aa-59e5a41f8e2d
      version: -1
      name: Set MSDefenderDevices
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      key:
        simple: MSDefenderDevices
      value:
        simple: '${MicrosoftATP.UserMachine.Machines={Name: val[''ComputerDNSName''], SerialNumber: '''', ID: val[''AADDeviceID''], Model: '''', MACAddress: '''', OS: val[''OSPlatform''], Integration: ''Microsoft Defender Advanced Threat Protection''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1460,
          "y": 1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 360e2e81-7171-42c4-8063-6d45e7dbc441
    type: condition
    task:
      id: 360e2e81-7171-42c4-8063-6d45e7dbc441
      version: -1
      name: Any results?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "53"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR.Endpoint
                accessor: endpoint_id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 69282860-ecd4-45b7-8ba3-7ff339cfe7e1
    type: regular
    task:
      id: 69282860-ecd4-45b7-8ba3-7ff339cfe7e1
      version: -1
      name: Set XDREndpoints
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      key:
        simple: XDREndpoints
      value:
        simple: '${PaloAltoNetworksXDR.Endpoint={Name: val[''endpoint_name''], SerialNumber: '''', ID: val[''endpoint_id''], Model: val[''endpoint_type''], MACAddress: val[''mac_address''], OS: val[''os_type''], Integration: ''Cortex XDR - IR''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 380,
          "y": 1265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: 0eea89b2-b09a-4dae-8356-31b186e1613a
    type: condition
    task:
      id: 0eea89b2-b09a-4dae-8356-31b186e1613a
      version: -1
      name: Cortex Core IR enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "55"
      "yes":
      - "56"
    scriptarguments:
      brandname:
        simple: Cortex Core - IR
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: 1b426d46-5211-4355-8bd5-dde940087cd5
    type: title
    task:
      id: 1b426d46-5211-4355-8bd5-dde940087cd5
      version: -1
      name: Done - Cortex Core
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: f9afe925-5210-4714-805f-e076e97c9973
    type: regular
    task:
      id: f9afe925-5210-4714-805f-e076e97c9973
      version: -1
      name: Cortex Core - Get device details
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
      script: '|||core-get-endpoints'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "57"
    scriptarguments:
      username:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 6d47d858-a121-415e-82d4-dd033b20222a
    type: condition
    task:
      id: 6d47d858-a121-415e-82d4-dd033b20222a
      version: -1
      name: Any results?
      description: ""
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "55"
      "yes":
      - "58"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Core.Endpoint.endpoint_id
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: baa6ebfb-b39f-4b7a-80cf-89ac44b6969e
    type: regular
    task:
      id: baa6ebfb-b39f-4b7a-80cf-89ac44b6969e
      version: -1
      name: Set XDREndpoints
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "55"
    scriptarguments:
      key:
        simple: XDREndpoints
      value:
        simple: '${Core.Endpoint={Name: val[''endpoint_name''], SerialNumber: '''', ID: val[''endpoint_id''], Model: val[''endpoint_type''], MACAddress: val[''mac_address''], OS: val[''os_type''], Integration: ''Cortex Core - IR''}}'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1265
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "14_15_yes": 0.42,
      "14_16_no": 0.11,
      "18_19_yes": 0.47,
      "18_20_no": 0.16,
      "1_12_#default#": 0.89,
      "1_13_yes": 0.49,
      "1_21_yes": 0.81,
      "1_2_yes": 0.88,
      "1_30_yes": 0.89,
      "1_7_yes": 0.87,
      "22_23_yes": 0.4,
      "22_26_no": 0.13,
      "24_26_#default#": 0.2,
      "31_34_#default#": 0.1,
      "32_34_no": 0.15,
      "37_6_#default#": 0.12,
      "38_6_#default#": 0.2,
      "46_11_#default#": 0.13,
      "46_47_yes": 0.4,
      "4_11_#default#": 0.15,
      "50_20_#default#": 0.19,
      "50_51_yes": 0.42,
      "52_16_#default#": 0.69,
      "52_53_yes": 0.37,
      "54_55_no": 0.11,
      "57_55_#default#": 0.69,
      "5_11_no": 0.42,
      "9_6_no": 0.18
    },
    "paper": {
      "dimensions": {
        "height": 2345,
        "width": 4190,
        "x": -1160,
        "y": 120
      }
    }
  }
inputs:
- key: Username
  value: {}
  required: false
  description: The username of the user.
  playbookInputQuery:
- key: GsuiteCustomerID
  value: {}
  required: false
  description: If using Google Workspace, a customer ID is needed.
  playbookInputQuery:
- key: CustomADAttribute
  value: {}
  required: false
  description: |-
    A custom Active Directory attribute.
    In case there is a custom attribute in Active Directory which stores the name of the computer assigned to the user in the user object, it would be fetched.
  playbookInputQuery:
outputs:
- contextPath: GSuite.MobileDevices
  description: Gsuite mobile devices.
  type: unknown
- contextPath: GSuite.MobileDevices.MobileListObjects
  description: A list of mobile device objects.
- contextPath: GSuite.MobileDevices.MobileListObjects.kind
  description: The type of the API resource.
- contextPath: GSuite.MobileDevices.MobileListObjects.etag
  description: ETag of the resource.
- contextPath: GSuite.MobileDevices.MobileListObjects.resourceId
  description: The unique ID the API service uses to identify the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.deviceId
  description: The serial number for a Google Sync mobile device. For Android and iOS devices, this is a software-generated unique identifier.
- contextPath: GSuite.MobileDevices.MobileListObjects.name
  description: A list of the owner's usernames.
- contextPath: GSuite.MobileDevices.MobileListObjects.email
  description: A list of the owner's email addresses.
- contextPath: GSuite.MobileDevices.MobileListObjects.model
  description: The mobile device's model name.
- contextPath: GSuite.MobileDevices.MobileListObjects.os
  description: The mobile device's operating system.
- contextPath: GSuite.MobileDevices.MobileListObjects.type
  description: The type of mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.status
  description: The mobile device's status.
- contextPath: GSuite.MobileDevices.MobileListObjects.hardwareId
  description: The IMEI/MEID unique identifier for Android hardware.
- contextPath: GSuite.MobileDevices.MobileListObjects.firstSync
  description: The date and time the mobile device was initially synchronized with the policy settings in the Admin console.
- contextPath: GSuite.MobileDevices.MobileListObjects.lastSync
  description: The date and time the mobile device was last synchronized with the policy settings in the Admin console.
- contextPath: GSuite.MobileDevices.MobileListObjects.userAgent
  description: Information about the mobile device such as the operating system version.
- contextPath: GSuite.MobileDevices.MobileListObjects.serialNumber
  description: The mobile device's serial number.
- contextPath: GSuite.MobileDevices.MobileListObjects.imei
  description: The mobile device's IMEI number.
- contextPath: GSuite.MobileDevices.MobileListObjects.meid
  description: The mobile device's MEID number.
- contextPath: GSuite.MobileDevices.MobileListObjects.wifiMacAddress
  description: The mobile device's MAC address on Wi-Fi networks.
- contextPath: GSuite.MobileDevices.MobileListObjects.networkOperator
  description: Mobile device mobile or network operator.
- contextPath: GSuite.MobileDevices.MobileListObjects.defaultLanguage
  description: The default locale used on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.managedAccountIsOnOwnerProfile
  description: Boolean indicating if this account is on the owner/primary profile.
- contextPath: GSuite.MobileDevices.MobileListObjects.deviceCompromisedStatus
  description: The compromised device status.
- contextPath: GSuite.MobileDevices.MobileListObjects.buildNumber
  description: The mobile device's operating system build number.
- contextPath: GSuite.MobileDevices.MobileListObjects.kernelVersion
  description: The mobile device's kernel version.
- contextPath: GSuite.MobileDevices.MobileListObjects.basebandVersion
  description: The mobile device's baseband version.
- contextPath: GSuite.MobileDevices.MobileListObjects.unknownSourcesStatus
  description: Unknown sources enabled or disabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.adbStatus
  description: Whether adb (USB debugging) is enabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.developerOptionsStatus
  description: Whether developer options are enabled on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.otherAccountsInfo
  description: A list of accounts added on the device.
- contextPath: GSuite.MobileDevices.MobileListObjects.supportsWorkProfile
  description: Work profile supported on the mobile device.
- contextPath: GSuite.MobileDevices.MobileListObjects.manufacturer
  description: Mobile device manufacturer.
- contextPath: GSuite.MobileDevices.MobileListObjects.releaseVersion
  description: Mobile device release version.
- contextPath: GSuite.MobileDevices.MobileListObjects.securityPatchLevel
  description: Mobile device security patch level.
- contextPath: GSuite.MobileDevices.MobileListObjects.brand
  description: Mobile device brand.
- contextPath: GSuite.MobileDevices.MobileListObjects.bootloaderVersion
  description: Mobile device bootloader version.
- contextPath: GSuite.MobileDevices.MobileListObjects.hardware
  description: Mobile device hardware.
- contextPath: GSuite.MobileDevices.MobileListObjects.encryptionStatus
  description: Mobile device encryption status.
- contextPath: GSuite.MobileDevices.MobileListObjects.devicePasswordStatus
  description: Mobile device password status.
- contextPath: GSuite.MobileDevices.MobileListObjects.privilege
  description: DM agent permission.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications
  description: Mobile device applications.
  type: unknown
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.packageName
  description: The application's package name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.displayName
  description: The application's display name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionName
  description: The application's version name.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionCode
  description: The application's version code.
- contextPath: GSuite.MobileDevices.MobileListObjects.applications.permission
  description: The list of permissions of this application.
- contextPath: JAMF.Computer
  description: Computer object.
  type: unknown
- contextPath: JAMF.Computer.id
  description: The computer ID.
- contextPath: JAMF.Computer.name
  description: The computer name.
- contextPath: JAMF.Computer.udid
  description: The computer UDID.
- contextPath: JAMF.Computer.serial_number
  description: The computer serial number.
- contextPath: JAMF.Computer.mac_address
  description: The computer MAC address.
- contextPath: JAMF.Computer.alt_mac_address
  description: The computer alt MAC address.
- contextPath: JAMF.Computer.asset_tag
  description: The computer asset tag.
- contextPath: JAMF.Computer.bar_code_1
  description: The computer barcode 1.
- contextPath: JAMF.Computer.bar_code_2
  description: The computer barcode 2.
- contextPath: JAMF.Computer.username
  description: The computer username.
- contextPath: JAMF.Computer.realname
  description: The computer real name.
- contextPath: JAMF.Computer.email
  description: The computer email address.
- contextPath: JAMF.Computer.email_address
  description: The computer email address.
- contextPath: JAMF.Computer.room
  description: The computer room.
- contextPath: JAMF.Computer.position
  description: The computer position.
- contextPath: JAMF.Computer.building
  description: The computer building.
- contextPath: JAMF.Computer.building_name
  description: The computer building name.
- contextPath: JAMF.Computer.department
  description: The computer department.
- contextPath: JAMF.Computer.department_name
  description: The computer department name.
- contextPath: JAMF.MobileDevice
  description: Mobile device object.
  type: unknown
- contextPath: JAMF.MobileDevice.id
  description: The mobile device ID.
- contextPath: JAMF.MobileDevice.name
  description: The mobile device name.
- contextPath: JAMF.MobileDevice.udid
  description: The mobile device UDID.
- contextPath: JAMF.MobileDevice.serial_number
  description: The mobile device serial number.
- contextPath: JAMF.MobileDevice.mac_address
  description: The mobile device MAC address.
- contextPath: JAMF.MobileDevice.wifi_mac_address
  description: The mobile device WI-FI MAC address.
- contextPath: JAMF.MobileDevice.username
  description: The mobile device username.
- contextPath: JAMF.MobileDevice.realname
  description: The mobile device real name.
- contextPath: JAMF.MobileDevice.email
  description: The mobile device user email address.
- contextPath: JAMF.MobileDevice.email_address
  description: The mobile device user email address.
- contextPath: JAMF.MobileDevice.room
  description: The mobile device room.
- contextPath: JAMF.MobileDevice.position
  description: The mobile device position.
- contextPath: JAMF.MobileDevice.building
  description: The mobile device building.
- contextPath: JAMF.MobileDevice.building_name
  description: The mobile device building name.
- contextPath: JAMF.MobileDevice.department
  description: The mobile device department.
- contextPath: JAMF.MobileDevice.department_name
  description: The mobile device department name.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
  description: The endpoint ID.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
  description: The endpoint name.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type
  description: The endpoint type.
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
  description: The status of the endpoint.
- contextPath: PaloAltoNetworksXDR.Endpoint.os_type
  description: The endpoint OS type.
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
  description: A list of IP addresses.
- contextPath: PaloAltoNetworksXDR.Endpoint.users
  description: A list of users.
- contextPath: PaloAltoNetworksXDR.Endpoint.domain
  description: The endpoint domain.
- contextPath: PaloAltoNetworksXDR.Endpoint.alias
  description: The endpoint's aliases.
- contextPath: PaloAltoNetworksXDR.Endpoint.first_seen
  description: First seen date/time in Epoch (milliseconds).
- contextPath: PaloAltoNetworksXDR.Endpoint.last_seen
  description: Last seen date/time in Epoch (milliseconds).
- contextPath: PaloAltoNetworksXDR.Endpoint.content_version
  description: Content version.
- contextPath: PaloAltoNetworksXDR.Endpoint.installation_package
  description: Installation package.
- contextPath: PaloAltoNetworksXDR.Endpoint.active_directory
  description: Active directory.
- contextPath: PaloAltoNetworksXDR.Endpoint.install_date
  description: Install date in Epoch (milliseconds).
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version
  description: Endpoint version.
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
  description: Whether the endpoint is isolated.
- contextPath: PaloAltoNetworksXDR.Endpoint.group_name
  description: The name of the group to which the endpoint belongs.
- contextPath: PaloAltoNetworksXDR.Endpoint.count
  description: Number of endpoints returned.
- contextPath: Endpoint.Hostname
  description: The hostname that is mapped to this endpoint.
- contextPath: Endpoint.ID
  description: The unique ID within the tool retrieving the endpoint.
- contextPath: Endpoint.IPAddress
  description: The IP address of the endpoint.
- contextPath: Endpoint.Domain
  description: The domain of the endpoint.
- contextPath: Endpoint.OS
  description: The endpoint's operation system.
- contextPath: Endpoint.Status
  description: The endpoint's status.
- contextPath: Endpoint.IsIsolated
  description: The endpoint's isolation status.
- contextPath: Endpoint.MACAddress
  description: The endpoint's MAC address.
- contextPath: Endpoint.Vendor
  description: The integration name of the endpoint vendor.
- contextPath: MicrosoftATP.UserMachine.Username
  description: The username.
- contextPath: MicrosoftATP.UserMachine.Machines.ID
  description: The machine ID.
- contextPath: MicrosoftATP.UserMachine.Machines.ComputerDNSName
  description: The machine DNS name.
- contextPath: MicrosoftATP.UserMachine.Machines.FirstSeen
  description: The first date and time the machine was observed by Microsoft Defender ATP.
- contextPath: MicrosoftATP.UserMachine.Machines.LastSeen
  description: The last date and time the machine was observed by Microsoft Defender ATP.
- contextPath: MicrosoftATP.UserMachine.Machines.OSPlatform
  description: The operating system platform.
- contextPath: MicrosoftATP.UserMachine.Machines.OSVersion
  description: The operating system version.
- contextPath: MicrosoftATP.UserMachine.Machines.OSProcessor
  description: The operating system processor.
- contextPath: MicrosoftATP.UserMachine.Machines.LastExternalIPAddress
  description: The last IP through which the machine accessed the internet.
- contextPath: MicrosoftATP.UserMachine.Machines.OSBuild
  description: The operating system build number.
- contextPath: MicrosoftATP.UserMachine.Machines.HealthStatus
  description: The machine health status.
- contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupID
  description: The machine RBAC group ID.
- contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupName
  description: The machine RBAC group name.
- contextPath: MicrosoftATP.UserMachine.Machines.RiskScore
  description: The machine risk score.
- contextPath: MicrosoftATP.UserMachine.Machines.ExposureLevel
  description: The machine exposure level.
- contextPath: MicrosoftATP.UserMachine.Machines.IsAADJoined
  description: True if machine is AAD joined, False otherwise.
- contextPath: MicrosoftATP.UserMachine.Machines.AADDeviceID
  description: The AAD device ID.
- contextPath: MicrosoftATP.UserMachine.Machines.MachineTags
  description: Set of machine tags.
- contextPath: MicrosoftATP.v.Machines.LastIPAddress
  description: The last IP on the machine.
- contextPath: ServiceNow.Computer.ID
  description: Computer system ID.
- contextPath: ServiceNow.Computer.AssetTag
  description: Computer asset tag.
- contextPath: ServiceNow.Computer.Name
  description: Computer name.
- contextPath: ServiceNow.Computer.DisplayName
  description: Computer display name.
- contextPath: ServiceNow.Computer.SupportGroup
  description: Computer support group.
- contextPath: ServiceNow.Computer.OperatingSystem
  description: Computer operating system.
- contextPath: ServiceNow.Computer.Company
  description: Computer company system ID.
- contextPath: ServiceNow.Computer.AssignedTo
  description: Computer assigned to user system ID.
- contextPath: ServiceNow.Computer.State
  description: Computer state.
- contextPath: ServiceNow.Computer.Cost
  description: Computer cost.
- contextPath: ServiceNow.Computer.Comments
  description: Computer comments.
- contextPath: UserDevices
  description: Devices retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Name
  description: Devices names retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.SerialNumber
  description: Devices serial numbers retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.ID
  description: Devices IDs retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Model
  description: Devices models retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.OS
  description: Devices operating systems retrieved by this playbook.
  type: unknown
- contextPath: UserDevices.Integration
  description: The integration which retrieved the devices.
  type: unknown
- contextPath: UserDevices.MACAddress
  description: Devices MAC Address retrieved by this playbook.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.8.0
supportedModules:
- cloud_runtime_security
- xsiam
- edr
- agentix
- cloud
marketplaces:
- xsoar
- marketplacev2
- platform
contentitemexportablefields:
  contentitemfields: {}