Block Account - Generic Deprecated

Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: * Active Directory * PAN-OS - This requires PAN-OS 9.1 or higher.
Common Playbooks · 9 tasks · 2 inputs · 0 outputs
Details

ID	`block_account_-_generic`
From Version	5.0.0
Tasks	9
README

Deprecated. Use ‘Block Account - Generic v2’ instead. This playbook blocks malicious usernames using all integrations that you have enabled.
Supported integrations for this playbook:
Active Directory
PAN-OS - This requires PAN-OS 9.1 or higher.
Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks

This playbook does not use any sub-playbooks.
Integrations

activedir
Scripts

This playbook does not use any scripts.
Commands

pan-os-register-user-tag
ad-disable-account
Playbook Inputs

Name	Description	Default Value	Required
Username	Array of malicious usernames to block.		Optional
Tag	PAN-OS tag name to apply to the username that you want to block.		Optional
Playbook Outputs

There are no outputs for this playbook.
Playbook Image

Block Account - Generic
Inputs

Username — Array of malicious usernames to block.
Tag — PAN-OS Tag name to apply to the username that you want to block.
Commands used

ad-disable-account pan-os-register-user-tag
Flowchart

Source

playbook-Block_Account_-_Generic.yml playbook-Block_Account_-_Generic_v2.yml playbook-Block_Account_-_Generic_v2_README.md
Download History Raw
id: Block Account - Generic v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Block Account - Generic v2
description: |-
  This playbook blocks malicious usernames using all integrations that you have enabled.

  Supported integrations for this playbook:
  * Active Directory
  * PAN-OS - This requires PAN-OS 9.1 or higher.
  * SailPoint
  * PingOne
  * AWS IAM
  * Clarizen IAM
  * Envoy IAM
  * ExceedLMS IAM
  * Okta
  * Microsoft Graph User (Entra ID Users)
  * Google Workspace Admin
  * Slack IAM
  * ServiceNow IAM
  * Prisma Cloud IAM
  * Zoom IAM
  * Atlassian IAM
  * GitHub IAM.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: cc38d57c-1f3a-4616-8fc3-b3d5b2beefb3
    type: start
    task:
      id: cc38d57c-1f3a-4616-8fc3-b3d5b2beefb3
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1700,
          "y": -1450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 78bcaa68-2a3d-4805-8e25-1bee31249d8f
    type: title
    task:
      id: 78bcaa68-2a3d-4805-8e25-1bee31249d8f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1070,
          "y": 1470
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: df7e57df-4f26-4b41-8552-0d4068792d13
    type: title
    task:
      id: df7e57df-4f26-4b41-8552-0d4068792d13
      version: -1
      name: Block accounts
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
      - "18"
      - "19"
      - "20"
      - "21"
      - "22"
      - "23"
      - "25"
      - "24"
      - "54"
      - "56"
      - "58"
      - "60"
      - "66"
      - "68"
      - "71"
      - "64"
      - "73"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1960,
          "y": 410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 84a222c3-d83f-4d9c-8f75-605f9c1cd233
    type: condition
    task:
      id: 84a222c3-d83f-4d9c-8f75-605f9c1cd233
      version: -1
      name: Is there a username to block?
      description: Verify that the playbook input includes at least one username to block.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "39"
      "yes":
      - "38"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Username
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1700,
          "y": -1260
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: d50b5c24-46e7-4b68-8082-632feb18733d
    type: regular
    task:
      id: d50b5c24-46e7-4b68-8082-632feb18733d
      version: -1
      name: PAN-OS - Register Tag to User
      description: Registers users to a tag. This command is only available for PAN-OS version 9.x and above.
      script: '|||pan-os-register-user-tag'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      Users:
        complex:
          root: Blocklist
          accessor: Final
      tag:
        complex:
          root: inputs.Tag
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2330,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "16":
    id: "16"
    taskid: 134ffe20-63fc-486a-8a79-685e3d206ae8
    type: condition
    task:
      id: 134ffe20-63fc-486a-8a79-685e3d206ae8
      version: -1
      name: Is there a Tag name to register?
      description: Verify that the playbook input includes at least one tag to apply to the user.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.Tag
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2330,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: dd28a21a-8e77-4e94-8ebd-6b4dd2a40907
    type: title
    task:
      id: dd28a21a-8e77-4e94-8ebd-6b4dd2a40907
      version: -1
      name: OKTA
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "26"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1960,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: 253e9206-6499-4698-81bc-4f6b405723e9
    type: title
    task:
      id: 253e9206-6499-4698-81bc-4f6b405723e9
      version: -1
      name: SailPoint
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "27"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 4665f43b-c357-46ab-8658-1f5307d73e34
    type: title
    task:
      id: 4665f43b-c357-46ab-8658-1f5307d73e34
      version: -1
      name: AWS IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "28"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -220,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "20":
    id: "20"
    taskid: 9f3e4789-ef65-4d8b-8142-b931aca2d1b8
    type: title
    task:
      id: 9f3e4789-ef65-4d8b-8142-b931aca2d1b8
      version: -1
      name: PingOne
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "21":
    id: "21"
    taskid: 5af0265d-f69a-47ef-8fdd-8be726ab8812
    type: title
    task:
      id: 5af0265d-f69a-47ef-8fdd-8be726ab8812
      version: -1
      name: Clarizen IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "22":
    id: "22"
    taskid: 8170d464-f524-484a-8578-d2d5c6b44c24
    type: title
    task:
      id: 8170d464-f524-484a-8578-d2d5c6b44c24
      version: -1
      name: Envoy IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "31"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1070,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "23":
    id: "23"
    taskid: 9426248c-bc57-4e2a-898c-333c705fe7c9
    type: title
    task:
      id: 9426248c-bc57-4e2a-898c-333c705fe7c9
      version: -1
      name: ExceedLMS IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1500,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: e3d46f19-bf96-4280-887d-c746b0e95976
    type: title
    task:
      id: e3d46f19-bf96-4280-887d-c746b0e95976
      version: -1
      name: PAN-OS
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "36"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2330,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "25":
    id: "25"
    taskid: 00761e97-8a6e-48f4-85fb-d894509a2c17
    type: title
    task:
      id: 00761e97-8a6e-48f4-85fb-d894509a2c17
      version: -1
      name: Microsoft Active Directory
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "37"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "26":
    id: "26"
    taskid: ca29fc92-0b56-4eca-8fb4-285bf732a419
    type: condition
    task:
      id: ca29fc92-0b56-4eca-8fb4-285bf732a419
      version: -1
      name: Is OKTA Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: Okta IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1960,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "27":
    id: "27"
    taskid: 692fc977-5dff-49fa-8ef9-4c0c53979786
    type: condition
    task:
      id: 692fc977-5dff-49fa-8ef9-4c0c53979786
      version: -1
      name: Is SailPoint Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "75"
    scriptarguments:
      brandname:
        simple: SailPointIdentityIQ
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "28":
    id: "28"
    taskid: c00031c8-63dc-447a-8064-458b8b89c0b9
    type: condition
    task:
      id: c00031c8-63dc-447a-8064-458b8b89c0b9
      version: -1
      name: Is AWS IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: AWS - IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -220,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 1dfdb5b5-b388-49f8-8778-b631675b5228
    type: condition
    task:
      id: 1dfdb5b5-b388-49f8-8778-b631675b5228
      version: -1
      name: Is PingOne Integration Enabled
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "34"
    scriptarguments:
      brandname:
        simple: PingOne
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: 1e40e759-f2e0-46f7-8c4c-e6c305ada2fe
    type: condition
    task:
      id: 1e40e759-f2e0-46f7-8c4c-e6c305ada2fe
      version: -1
      name: Is ClarizenIAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: ClarizenIAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -640,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "31":
    id: "31"
    taskid: e69ec334-a883-4519-8b53-2d12a380819d
    type: condition
    task:
      id: e69ec334-a883-4519-8b53-2d12a380819d
      version: -1
      name: Is Envoy IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: Envoy IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1070,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: d7750a59-552e-4fbe-8d72-6a0dbf2c50b2
    type: condition
    task:
      id: d7750a59-552e-4fbe-8d72-6a0dbf2c50b2
      version: -1
      name: Is ExceedLMS IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: ExceedLMS IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1500,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 85bde384-178d-44b1-8c73-5899e51cf664
    type: regular
    task:
      id: 85bde384-178d-44b1-8c73-5899e51cf664
      version: -1
      name: IAM Disable User
      description: Disable an active user.
      script: '|||iam-disable-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      user-profile:
        simple: ${Blocklist.Final}
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1280,
          "y": 940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 08d5ce28-f0dd-4a81-889a-383591a50ad5
    type: regular
    task:
      id: 08d5ce28-f0dd-4a81-889a-383591a50ad5
      version: -1
      name: PingOne - Deactivate user
      description: Deactivate a user's account.
      script: '|||pingone-deactivate-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      username:
        complex:
          root: Blocklist
          accessor: Final
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 210,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 50b2030e-e402-47f1-86df-5b5f4e8e7077
    type: regular
    task:
      id: 50b2030e-e402-47f1-86df-5b5f4e8e7077
      version: -1
      name: SailPoint-Disable account
      description: Disable account's active status by id using IdentityIQ SCIM API's.
      script: '|||identityiq-disable-account'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      id:
        complex:
          root: IdentityIQ.Account
          accessor: id
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "36":
    id: "36"
    taskid: 90a2adf8-4f57-4b53-896d-44bddd4d064c
    type: condition
    task:
      id: 90a2adf8-4f57-4b53-896d-44bddd4d064c
      version: -1
      name: Is PAN-OS/Panorama Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "16"
    scriptarguments:
      brandname:
        simple: Panorama
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 2330,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "37":
    id: "37"
    taskid: e31ad79c-5806-41f0-839b-f896c860d3cc
    type: condition
    task:
      id: e31ad79c-5806-41f0-839b-f896c860d3cc
      version: -1
      name: Is Active Directory Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "76"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1060,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "38":
    id: "38"
    taskid: c34085c0-1974-4153-8f36-fb22e4ba0c4e
    type: condition
    task:
      id: c34085c0-1974-4153-8f36-fb22e4ba0c4e
      version: -1
      name: Is User Verification Required?
      description: Check if manual verification is required before block
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "47"
      "yes":
      - "40"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.UserVerification
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1700,
          "y": -1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "39":
    id: "39"
    taskid: eda8a397-b0f5-4cb8-85a6-804bbbf59244
    type: title
    task:
      id: eda8a397-b0f5-4cb8-85a6-804bbbf59244
      version: -1
      name: No User to be blocked
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -5370,
          "y": 1105
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "40":
    id: "40"
    taskid: 90c4e379-c164-495b-8bd0-74e807433506
    type: regular
    task:
      id: 90c4e379-c164-495b-8bd0-74e807433506
      version: -1
      name: Set Naming Convention to a key
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "42"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: checks.common
      value:
        complex:
          root: inputs.NamingConvention
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith: {}
              toReplace:
                value:
                  simple: ' '
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2230,
          "y": -880
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "41":
    id: "41"
    taskid: 603550b4-89d3-4df1-84d9-1eb2951e0871
    type: regular
    task:
      id: 603550b4-89d3-4df1-84d9-1eb2951e0871
      version: -1
      name: Identify Potential Sensitive Users
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "45"
      - "43"
    scriptarguments:
      key:
        simple: Blocklist.Sensitive
      value:
        complex:
          root: Blocklist.Potential
          filters:
          - - operator: StringContainsArray
              left:
                value:
                  simple: Blocklist.Potential
                iscontext: true
              right:
                value:
                  simple: checks.common
                iscontext: true
              ignorecase: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2230,
          "y": -560
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "42":
    id: "42"
    taskid: 93dc1c23-81e4-40fd-8f62-9f4290882421
    type: regular
    task:
      id: 93dc1c23-81e4-40fd-8f62-9f4290882421
      version: -1
      name: Set User to a potential block list
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "41"
    scriptarguments:
      key:
        simple: Blocklist.Potential
      value:
        complex:
          root: inputs.Username
          transformers:
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2230,
          "y": -720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "43":
    id: "43"
    taskid: 39b3cf6c-5757-447b-8188-9ead6e21a445
    type: condition
    task:
      id: 39b3cf6c-5757-447b-8188-9ead6e21a445
      version: -1
      name: Check if there are any sensitive users to block
      description: Check if there are any sensitive users to block
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "45"
      "yes":
      - "44"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: Blocklist.Sensitive
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2670,
          "y": -390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "44":
    id: "44"
    taskid: 6ab46eeb-8460-44ab-8b96-0c6a35e38581
    type: collection
    task:
      id: 6ab46eeb-8460-44ab-8b96-0c6a35e38581
      version: -1
      name: Ask the user for verification [Sensitive Users]
      description: |-
        Please note that in this form there are serval accounts that are listed as "Sensitive Accounts":
        ${User.Sensetive}
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2670,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
        simple:marketplacev2: Investigator
      subject:
        simple: Block Sensitive Account - User Verification Form
      body:
        simple: |
          <p>Dear XSOAR user,</p>
          <p>This notification informs you that the following list of sensitive accounts will be blocked on your XSOAR's integrated IDP/IAM devices.</p>
          <p><br />(<strong>Note</strong>: the Accounts will be set to disabled on those XSOAR integrated devices).</p>
          <p>Also, <strong>please note</strong> that the following accounts are listed as <strong> "Sensitive Accounts" based on a naming convention </strong> mentioned in the playbook:</p>
          <p>${Blocklist.Sensitive}</p>
          <p>&nbsp;</p>
          <p>For more information, click the link below.</p>
      methods:
      - email
      format: html
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: true
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: 'Sensitive Users:'
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - simple: ${Blocklist.Sensitive}
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: 'Which sensitive users you would like to Block?  Choose from the following lists :'
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "45":
    id: "45"
    taskid: 4d484404-eefc-4cf6-8f56-abdae89d61e6
    type: collection
    task:
      id: 4d484404-eefc-4cf6-8f56-abdae89d61e6
      version: -1
      name: Ask the user for verification [without Sensitive Users]
      description: |-
        Please note that in this form there are serval accounts that are listed as "Sensitive Accounts":
        ${User.Sensetive}
      type: collection
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "52"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2230,
          "y": -190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
        simple: Analyst
        simple:marketplacev2: Investigator
      subject:
        simple: Block Account - User Verification Form
      body:
        simple: |
          <p>Dear XSOAR user,</p>
          <p>This notification informs you that the following list of accounts will be blocked on your XSOAR's integrated IDP/IAM devices.</p>
          <p><br />(<strong>Note</strong>: the Accounts will be set to disabled on those XSOAR integrated devices).</p>
          <p>&nbsp;</p>
          <p>For more information, click the link below.</p>
      methods:
      - email
      format: html
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: 'Users to be blocked:'
        required: false
        gridcolumns: []
        defaultrows: []
        type: multiSelect
        options: []
        optionsarg:
        - complex:
            root: Blocklist
            accessor: Potential
        fieldassociated: ""
        placeholder: ""
        tooltip: ""
        readonly: false
      title: 'Which Users you would like to Block?  Choose from the following lists :'
      description: ""
      sender: ""
      expired: false
      totalanswers: 0
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "46":
    id: "46"
    taskid: 9e174bd8-73a8-46ef-8a56-138a1cac0b61
    type: regular
    task:
      id: 9e174bd8-73a8-46ef-8a56-138a1cac0b61
      version: -1
      name: Set the final accounts list to be blocked
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Blocklist.Final
      value:
        complex:
          root: ${Which Users you would like to Block?  Choose from the following lists :.Answers
          accessor: 0}
          transformers:
          - operator: append
            args:
              item:
                value:
                  simple: Which sensitive users you would like to Block?  Choose from the following lists :.Answers.0
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2230,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "47":
    id: "47"
    taskid: f97632fd-1653-4fda-8222-e8dbe5c36646
    type: regular
    task:
      id: f97632fd-1653-4fda-8222-e8dbe5c36646
      version: -1
      name: Set the final accounts list to be blocked
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Blocklist.Final
      value:
        complex:
          root: inputs.Username
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -1700,
          "y": 170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "48":
    id: "48"
    taskid: f9188978-a51d-4e86-8420-1749db9f1d3b
    type: regular
    task:
      id: f9188978-a51d-4e86-8420-1749db9f1d3b
      version: -1
      name: Active Directory - Disable Account
      description: Disables an Active Directory user account.
      script: Active Directory Query v2|||ad-disable-account
      type: regular
      iscommand: true
      brand: Active Directory Query v2
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      username:
        complex:
          root: UserAD
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1050,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "52":
    id: "52"
    taskid: 64ddf917-048c-444b-8fea-b9529a3ad0b3
    type: condition
    task:
      id: 64ddf917-048c-444b-8fea-b9529a3ad0b3
      version: -1
      name: Is Username selected?
      description: Check if the analyst selected any users to block
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "39"
      "yes":
      - "46"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: Which Users you would like to Block?  Choose from the following lists :.Answers.0
            iscontext: true
          right:
            value: {}
        - operator: isNotEmpty
          left:
            value:
              simple: Which sensitive users you would like to Block?  Choose from the following lists :.Answers.0
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2230,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "53":
    id: "53"
    taskid: 8791822e-5e1e-4b28-82d9-a822aa17108d
    type: condition
    task:
      id: 8791822e-5e1e-4b28-82d9-a822aa17108d
      version: -1
      name: Is Slack IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: Slack IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2410,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "54":
    id: "54"
    taskid: e2aaa6e8-de1f-4399-8e89-2321fe4fa030
    type: title
    task:
      id: e2aaa6e8-de1f-4399-8e89-2321fe4fa030
      version: -1
      name: Slack IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "53"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2410,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "55":
    id: "55"
    taskid: e8b7f7a8-2b9c-44ef-8eff-ceb494799432
    type: condition
    task:
      id: e8b7f7a8-2b9c-44ef-8eff-ceb494799432
      version: -1
      name: Is ServiceNow IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: ServiceNow IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2840,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "56":
    id: "56"
    taskid: 6a694bcc-610d-46c4-8d22-dec644076b78
    type: title
    task:
      id: 6a694bcc-610d-46c4-8d22-dec644076b78
      version: -1
      name: ServiceNow IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "55"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -2840,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "57":
    id: "57"
    taskid: 6345f42c-51a8-401f-8099-ecea5a0403c4
    type: condition
    task:
      id: 6345f42c-51a8-401f-8099-ecea5a0403c4
      version: -1
      name: Is Salesforce IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: Salesforce IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3260,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "58":
    id: "58"
    taskid: dba2b9c1-cb47-41a9-8386-1de15a47de2d
    type: title
    task:
      id: dba2b9c1-cb47-41a9-8386-1de15a47de2d
      version: -1
      name: Salesforce IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "57"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3260,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "59":
    id: "59"
    taskid: c6cb894b-65a5-4e85-87f4-debe4d8cdbfe
    type: condition
    task:
      id: c6cb894b-65a5-4e85-87f4-debe4d8cdbfe
      version: -1
      name: Is PrismaCloud IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: PrismaCloud IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3690,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "60":
    id: "60"
    taskid: de7c1b4f-0ecc-4782-8346-50b679dac66b
    type: title
    task:
      id: de7c1b4f-0ecc-4782-8346-50b679dac66b
      version: -1
      name: PrismaCloud IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "59"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -3690,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "63":
    id: "63"
    taskid: 1a19cd62-eafa-4b66-80aa-b397a439f52c
    type: condition
    task:
      id: 1a19cd62-eafa-4b66-80aa-b397a439f52c
      version: -1
      name: Is Microsoft Graph User Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "78"
    scriptarguments:
      brandname:
        simple: Microsoft Graph User
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "64":
    id: "64"
    taskid: 31d15f37-d89d-4d09-8009-2a60c76d0b5e
    type: title
    task:
      id: 31d15f37-d89d-4d09-8009-2a60c76d0b5e
      version: -1
      name: Microsoft Graph User
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "63"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "65":
    id: "65"
    taskid: 31592372-486c-4648-8376-8889941df6c8
    type: condition
    task:
      id: 31592372-486c-4648-8376-8889941df6c8
      version: -1
      name: Is Zoom IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: Zoom_IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4120,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "66":
    id: "66"
    taskid: b98574a0-93fc-423b-87e1-bf888db3881a
    type: title
    task:
      id: b98574a0-93fc-423b-87e1-bf888db3881a
      version: -1
      name: Zoom IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "65"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4120,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "67":
    id: "67"
    taskid: deb7235b-0e73-4aa7-8e3e-2b07ad73daf9
    type: condition
    task:
      id: deb7235b-0e73-4aa7-8e3e-2b07ad73daf9
      version: -1
      name: Is Atlassian IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: Atlassian IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4550,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "68":
    id: "68"
    taskid: 5e5c6e1e-8c3a-42b8-85bd-3646e9b01531
    type: title
    task:
      id: 5e5c6e1e-8c3a-42b8-85bd-3646e9b01531
      version: -1
      name: Atlassian IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "67"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4550,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "69":
    id: "69"
    taskid: 909d3b40-e606-4225-8d09-a83ebdd33b79
    type: regular
    task:
      id: 909d3b40-e606-4225-8d09-a83ebdd33b79
      version: -1
      name: Microsoft Graph User - Disable Account
      description: |-
        Disables a user from all Office 365 applications, and prevents sign in. Note: This command disables user,
        but does not terminate an existing session. Supported only in a self deployed app flow with the
        Permission: Directory.AccessAsUser.All(Delegated)
      script: '|||msgraph-user-account-disable'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      user:
        complex:
          root: UserMSGraph
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 1290
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "70":
    id: "70"
    taskid: 909312b6-5f6e-451c-83dd-a00e31c49197
    type: condition
    task:
      id: 909312b6-5f6e-451c-83dd-a00e31c49197
      version: -1
      name: Is GitHub IAM Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "33"
    scriptarguments:
      brandname:
        simple: GitHub IAM
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4970,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "71":
    id: "71"
    taskid: 4f6321ef-dfb9-41fd-8a72-61bea5cff007
    type: title
    task:
      id: 4f6321ef-dfb9-41fd-8a72-61bea5cff007
      version: -1
      name: GitHub IAM
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "70"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -4970,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "72":
    id: "72"
    taskid: a274143d-2455-4679-8064-41a6cc01e1be
    type: condition
    task:
      id: a274143d-2455-4679-8064-41a6cc01e1be
      version: -1
      name: Is Google Workspace Admin Integration Enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "74"
    scriptarguments:
      brandname:
        simple: GSuiteAdmin
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 715
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "73":
    id: "73"
    taskid: fa1e6574-7969-4b44-8593-b2244060cebe
    type: title
    task:
      id: fa1e6574-7969-4b44-8593-b2244060cebe
      version: -1
      name: Google Workspace Admin
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "72"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 555
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "74":
    id: "74"
    taskid: 128ca043-fa17-4ebf-82e1-ce3b4812de86
    type: regular
    task:
      id: 128ca043-fa17-4ebf-82e1-ce3b4812de86
      version: -1
      name: Google Workspace Admin - Disable Account
      description: Updates a user.
      script: '|||gsuite-user-update'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      suspended:
        simple: "true"
      user_key:
        complex:
          root: Blocklist
          accessor: Final
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1900,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "75":
    id: "75"
    taskid: 4ebe9bf0-210f-4752-83d0-bb2e2a03262a
    type: regular
    task:
      id: 4ebe9bf0-210f-4752-83d0-bb2e2a03262a
      version: -1
      name: Get Account IDs From SailPoint
      description: Fetch accounts by search/filter parameters (id, display_name, last_refresh, native_identity, last_target_agg, identity_name & application_name) using IdentityIQ SCIM APIs.
      script: '|||identityiq-get-accounts'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "35"
    scriptarguments:
      display_name:
        complex:
          root: Blocklist
          accessor: Final
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 640,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "76":
    id: "76"
    taskid: da02de44-c739-4db1-85bc-3c053f8aa183
    type: regular
    task:
      id: da02de44-c739-4db1-85bc-3c053f8aa183
      version: -1
      name: Active Directory - Get User
      description: Retrieves detailed information about a user account. The user can be specified by name, email address, or as an Active Directory Distinguished Name (DN). If no filter is specified, all users are returned.
      script: '|||ad-get-user'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "77"
    scriptarguments:
      extend-context:
        simple: UserAD=attributes.sAMAccountName
      ignore-outputs:
        simple: "true"
      username:
        complex:
          root: Blocklist
          accessor: Final
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1050,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "77":
    id: "77"
    taskid: 419df6f0-2416-4a48-8124-eb64ce5da93a
    type: condition
    task:
      id: 419df6f0-2416-4a48-8124-eb64ce5da93a
      version: -1
      name: Does the username exist?
      description: Verify that the user exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "48"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: UserAD
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1050,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "78":
    id: "78"
    taskid: e56d753f-ac0c-417d-83b3-1eec253d740b
    type: regular
    task:
      id: e56d753f-ac0c-417d-83b3-1eec253d740b
      version: -1
      name: Microsoft Graph User - Get User
      description: |-
        Retrieves the properties and relationships of a user object. For more information, visit: https://docs.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0.
        Permissions: - User.Read (Delegated) - User.Read.All (Application).
      script: '|||msgraph-user-get'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "79"
    scriptarguments:
      extend-context:
        simple: UserMSGraph=id
      ignore-outputs:
        simple: "true"
      user:
        complex:
          root: Blocklist
          accessor: Final
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 920
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "79":
    id: "79"
    taskid: 6a4ebfcb-e506-4333-81b5-8889065e2fbe
    type: condition
    task:
      id: 6a4ebfcb-e506-4333-81b5-8889065e2fbe
      version: -1
      name: Does the username exist?
      description: Verify that the user exists.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "69"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: UserMSGraph
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1480,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "16_15_yes": 0.62,
      "16_2_#default#": 0.1,
      "26_2_#default#": 0.11,
      "26_33_yes": 0.14,
      "27_2_#default#": 0.1,
      "28_2_#default#": 0.15,
      "28_33_yes": 0.1,
      "29_2_#default#": 0.11,
      "29_34_yes": 0.36,
      "30_2_#default#": 0.26,
      "30_33_yes": 0.11,
      "31_2_#default#": 0.27,
      "31_33_yes": 0.12,
      "32_2_#default#": 0.18,
      "32_33_yes": 0.24,
      "36_2_#default#": 0.1,
      "37_2_#default#": 0.12,
      "43_44_yes": 0.49,
      "52_39_#default#": 0.2,
      "53_2_#default#": 0.1,
      "53_33_yes": 0.14,
      "55_2_#default#": 0.1,
      "55_33_yes": 0.21,
      "57_2_#default#": 0.1,
      "57_33_yes": 0.18,
      "59_2_#default#": 0.1,
      "59_33_yes": 0.14,
      "63_2_#default#": 0.1,
      "65_2_#default#": 0.1,
      "65_33_yes": 0.1,
      "67_2_#default#": 0.1,
      "67_33_yes": 0.1,
      "70_2_#default#": 0.1,
      "70_33_yes": 0.1,
      "72_2_#default#": 0.1,
      "72_74_yes": 0.44,
      "8_38_yes": 0.65,
      "8_39_#default#": 0.13
    },
    "paper": {
      "dimensions": {
        "height": 2985,
        "width": 8080,
        "x": -5370,
        "y": -1450
      }
    }
  }
inputs:
- key: Username
  value: {}
  required: false
  description: Array of malicious usernames to block.
  playbookInputQuery:
- key: Tag
  value:
    simple: Bad Account
  required: false
  description: PAN-OS Tag name to apply to the username that you want to block.
  playbookInputQuery:
- key: NamingConvention
  value: {}
  required: false
  description: In case you are using naming convention in your IDP, please specify a prefix for special/service accounts (use comma separated)
  playbookInputQuery:
- key: UserVerification
  value:
    simple: "True"
  required: false
  description: |-
    Possible values:True/False. Default:True.
    Specify if User Verification is Requrired
  playbookInputQuery:
outputs:
- contextPath: Blocklist.Final
  description: Blocked accounts.
  type: unknown
tests:
- No tests (auto formatted)
fromversion: 6.5.0
marketplaces:
- xsoar
- marketplacev2
- platform