Block Account - Generic Deprecated

Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: * Active Directory * PAN-OS - This requires PAN-OS 9.1 or higher.

Common Playbooks · 9 tasks · 2 inputs · 0 outputs

Details

ID	`block_account_-_generic`
From Version	5.0.0
Tasks	9

README

Deprecated. Use ‘Block Account - Generic v2’ instead. This playbook blocks malicious usernames using all integrations that you have enabled.

Supported integrations for this playbook:

Active Directory
PAN-OS - This requires PAN-OS 9.1 or higher.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

activedir

Scripts

This playbook does not use any scripts.

Commands

pan-os-register-user-tag
ad-disable-account

Playbook Inputs

Name	Description	Default Value	Required
Username	Array of malicious usernames to block.		Optional
Tag	PAN-OS tag name to apply to the username that you want to block.		Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Block Account - Generic

Inputs

Username — Array of malicious usernames to block.
Tag — PAN-OS Tag name to apply to the username that you want to block.

Commands used

ad-disable-account pan-os-register-user-tag

Flowchart

Source

playbook-Block_Account_-_Generic.yml playbook-Block_Account_-_Generic_v2.yml playbook-Block_Account_-_Generic_v2_README.md

Download History Raw

id: block_account_-_generic
version: -1
name: Block Account - Generic
fromversion: 5.0.0
description: |-
  Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled.

  Supported integrations for this playbook:
  * Active Directory
  * PAN-OS - This requires PAN-OS 9.1 or higher.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: b95110b7-ba18-42a5-87ad-c5d37915401c
    type: start
    task:
      id: b95110b7-ba18-42a5-87ad-c5d37915401c
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 20
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 1808d949-f921-4957-8796-7bbedd822ad9
    type: title
    task:
      id: 1808d949-f921-4957-8796-7bbedd822ad9
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 0,
          "y": 1180
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 0b958771-7e06-4239-899f-f7d133be6938
    type: title
    task:
      id: 0b958771-7e06-4239-899f-f7d133be6938
      version: -1
      name: Block accounts
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 250,
          "y": 360
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 2c5a17dd-e019-4e20-8f5b-4333678a26e0
    type: condition
    task:
      id: 2c5a17dd-e019-4e20-8f5b-4333678a26e0
      version: -1
      name: Is there a username to block?
      description: Verify that the playbook input includes at least one username to block.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.Username
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 165
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 5da07472-33bb-451d-8562-365e05f456ec
    type: condition
    task:
      id: 5da07472-33bb-451d-8562-365e05f456ec
      version: -1
      name: Is Active Directory enabled?
      description: |
        Verify that there is a valid instance of Active Directory enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: activedir
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 230,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: c8b9285e-4d21-4070-89b6-33c611531812
    type: regular
    task:
      id: c8b9285e-4d21-4070-89b6-33c611531812
      version: -1
      name: Disable account in active directory
      description: Disable the account using Active Directory.
      script: activedir|||ad-disable-account
      type: regular
      iscommand: true
      brand: activedir
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      base-dn: {}
      username:
        complex:
          root: inputs.Username
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 320,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: 7b9a0521-f530-41f2-8e6c-06df1f72ad87
    type: condition
    task:
      id: 7b9a0521-f530-41f2-8e6c-06df1f72ad87
      version: -1
      name: Is PAN-OS enabled?
      description: |
        Verify that there is a valid instance of PAN-OS enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "16"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: panorama
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 770,
          "y": 505
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: 9da1c44c-5522-421f-8f84-a70123600e4a
    type: regular
    task:
      id: 9da1c44c-5522-421f-8f84-a70123600e4a
      version: -1
      name: PAN-OS - Register Tag to User
      description: Apply a tag to a user.
      script: '|||pan-os-register-user-tag'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Users:
        simple: ${inputs.Username}
      tag:
        simple: ${inputs.Tag}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 900,
          "y": 1000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "16":
    id: "16"
    taskid: 06dfb070-8751-4cbc-8dcd-b7ffd39ca2cc
    type: condition
    task:
      id: 06dfb070-8751-4cbc-8dcd-b7ffd39ca2cc
      version: -1
      name: Is there a Tag name to register?
      description: Verify that the playbook input includes at least one tag to apply to the user.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.Tag
            iscontext: true
    view: |-
      {
        "position": {
          "x": 900,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "12_2_#default#": 0.1,
      "14_16_yes": 0.6,
      "14_2_#default#": 0.1,
      "16_15_yes": 0.71,
      "16_2_#default#": 0.1,
      "8_2_#default#": 0.16
    },
    "paper": {
      "dimensions": {
        "height": 1225,
        "width": 1280,
        "x": 0,
        "y": 20
      }
    }
  }
inputs:
- key: Username
  value: {}
  required: false
  description: Array of malicious usernames to block.
- key: Tag
  value: {}
  required: false
  description: PAN-OS Tag name to apply to the username that you want to block.
outputs: []
tests:
- No tests (auto formatted)
marketplaces:
- xsoar
- marketplacev2
- platform
deprecated: true