Block Account - Generic Deprecated

Deprecated. Use 'Block Account - Generic v2' instead. This playbook blocks malicious usernames using all integrations that you have enabled. Supported integrations for this playbook: * Active Directory * PAN-OS - This requires PAN-OS 9.1 or higher.

Common Playbooks · 9 tasks · 2 inputs · 0 outputs

Details

IDblock_account_-_generic
From Version5.0.0
Tasks9

README

Deprecated. Use ‘Block Account - Generic v2’ instead. This playbook blocks malicious usernames using all integrations that you have enabled.

Supported integrations for this playbook:

  • Active Directory
  • PAN-OS - This requires PAN-OS 9.1 or higher.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • activedir

Scripts

This playbook does not use any scripts.

Commands

  • pan-os-register-user-tag
  • ad-disable-account

Playbook Inputs

Name Description Default Value Required
Username Array of malicious usernames to block.   Optional
Tag PAN-OS tag name to apply to the username that you want to block.   Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Block Account - Generic

Inputs

  • Username — Array of malicious usernames to block.
  • Tag — PAN-OS Tag name to apply to the username that you want to block.

Commands used

ad-disable-account pan-os-register-user-tag

Flowchart

yes yes yes yes Start Start Done Done Block accounts Block accounts Is there a username to block? Is there a username to bl... Is Active Directory enabled? Is Active Directory enabled? Disable account in active directory - ad-disable-account Disable account in active... ad-disable-account Is PAN-OS enabled? Is PAN-OS enabled? PAN-OS - Register Tag to User - pan-os-register-user-tag PAN-OS - Register Tag to ... pan-os-register-user-tag Is there a Tag name to register? Is there a Tag name to re...

Source

playbook-Block_Account_-_Generic.yml playbook-Block_Account_-_Generic_v2.yml playbook-Block_Account_-_Generic_v2_README.md
Download History Raw 
This playbook blocks malicious usernames using all integrations that you have enabled.

Supported integrations for this playbook:
* Active Directory
* PAN-OS - This requires PAN-OS 9.1 or higher.
* SailPoint
* PingOne
* AWS IAM
* Clarizen IAM
* Envoy IAM
* ExceedLMS IAM
* Okta
* Microsoft Graph User (Entra ID Users)
* Google Workspace Admin
* Slack IAM
* ServiceNow IAM
* Prisma Cloud IAM
* Zoom IAM
* Atlassian IAM
* GitHub IAM.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

* Active Directory Query v2

### Scripts

* IsIntegrationAvailable
* SetAndHandleEmpty

### Commands

* iam-disable-user
* gsuite-user-update
* identityiq-disable-account
* pingone-deactivate-user
* msgraph-user-account-disable
* pan-os-register-user-tag
* ad-get-user
* msgraph-user-get
* ad-disable-account
* identityiq-get-accounts

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| Username | Array of malicious usernames to block. |  | Optional |
| Tag | PAN-OS Tag name to apply to the username that you want to block. | Bad Account | Optional |
| NamingConvention | In case you are using naming convention in your IDP, please specify a prefix for special/service accounts \(use comma separated\) |  | Optional |
| UserVerification | Possible values:True/False. Default:True.<br/>Specify if User Verification is Requrired | True | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| Blocklist.Final | Blocked accounts | unknown |

## Playbook Image

---

![Block Account - Generic v2](../doc_files/Block_Account_-_Generic_v2.png)