SafeNet Trusted Access - Add to Unusual Activity Group

This playbook adds the user to a group that was created to identify unusual activity. SafeNet Trusted Access policies can be configured to take this into account and provide stronger protection when handling access events from users who are members of the group. The user is added to this group for a configurable period of time.

Thales SafeNet Trusted Access · 24 tasks · 4 inputs · 0 outputs

Inputs

  • UserName — Username of the user.
  • UnusualActivityGroup — Name of the Unusual Activity Group.
  • InstanceName — Name of the SafeNet Trusted Access integration instance.
  • Time — Amount of time for which the user will remain in the Unusual Activity Group.

Commands used

closeInvestigation setIncident sta-add-user-group sta-get-group-info sta-get-user-info sta-remove-user-group sta-user-exist-group sta-validate-tenant

Flowchart

yes yes yes yes yes no yes Start Start Get Group Information. - sta-get-group-info Get Group Information. sta-get-group-info Group exist in the tenant ? Group exist in the tenant ? Add user to Unusual Activity Group. - sta-add-user-group Add user to Unusual Activ... sta-add-user-group Failed Message. Failed Message. Sleep Time - User in the group for ${inputs.Time} hours. Sleep Time - User in the ... Remove user from Unusual Activity Group. - sta-remove-user-group Remove user from Unusual ... sta-remove-user-group Close Incident. - closeInvestigation Close Incident. closeInvestigation Check user's existence in Unusual Activity Group. - sta-user-exist-group Check user's existence in... sta-user-exist-group User is a member of Unusual Activity Group ? User is a member of Unusu... Close all old incidents for the same user as duplicates. - closeInvestigation Close all old incidents f... closeInvestigation Get User Information. - sta-get-user-info Get User Information. sta-get-user-info User exist in the tenant ? User exist in the tenant ? Failed Message. Failed Message. Search old incidents for the same user. Search old incidents for ... Old incident exist for the same user in the same instance ? Old incident exist for th... Close Incident. - closeInvestigation Close Incident. closeInvestigation Validate tenant. - sta-validate-tenant Validate tenant. sta-validate-tenant Check if tenant is accessible? Check if tenant is access... Failed Message. Failed Message. Set Incident Fields. - setIncident Set Incident Fields. setIncident Is Integration Available? Is Integration Available? Failed Message. Failed Message. Done Done