commonfields: id: Active Directory Query v2 version: -1 sectionorder: - Connect - Collect name: Active Directory Query v2 display: Active Directory Query v2 category: Authentication & Identity Management provider: Microsoft description: The Active Directory Query integration enables you to access and manage Active Directory objects (users, contacts, and computers). configuration: - display: Server IP address (for example, 192.168.0.1) name: server_ip type: 0 required: true section: Connect - display: Server port. If not specified, the default port is 389 for LDAP, 636 for LDAPS, or 3268 for global catalog servers. name: port type: 0 section: Connect advanced: true required: false - display: Username name: credentials type: 9 required: true section: Connect displaypassword: Password - display: NTLM authentication name: ntlm type: 8 section: Connect advanced: true required: false - display: Base DN (for example "dc=company,dc=com") name: base_dn type: 0 required: true section: Connect - display: Page size name: page_size defaultvalue: "500" type: 0 required: false section: Collect - display: Secure Connection name: secure_connection defaultvalue: SSL type: 15 required: true options: - None - SSL - TLS - Start TLS section: Connect - additionalinfo: 'The SSL\TLS version to use in SSL or Start TLS connections types. Default is None. It is recommended to select the TLS_CLIENT option, which auto-negotiate the highest protocol version that both the client and server support, and configure the context client-side connections.' defaultvalue: None display: SSL Version name: ssl_version options: - None - TLS - TLSv1 - TLSv1_1 - TLSv1_2 - TLS_CLIENT type: 15 section: Connect advanced: true required: false - display: Trust any certificate (not secure) name: unsecure type: 8 section: Connect advanced: true required: false - name: verify_base_dn display: Verify base DN on every command defaultvalue: 'true' type: 8 required: false section: Connect advanced: true - additionalinfo: Used in the IAM commands. defaultvalue: User Profile - Active Directory (Incoming) display: Incoming Mapper name: mapper-in required: true type: 0 section: Connect - additionalinfo: Used in the IAM commands. defaultvalue: User Profile - Active Directory (Outgoing) display: Outgoing Mapper name: mapper-out required: true type: 0 section: Connect - display: Group CN for terminated employees name: group-cn type: 0 section: Connect required: false - additionalinfo: If true, the user is created if the user profile doesn't exist in AD. Used in IAM commands only. defaultvalue: 'true' display: Create user if does not exist name: create-if-not-exists type: 8 section: Connect advanced: true required: false - display: Default base query to use in the ad-get-user command additionalinfo: This value will only be used when no arguments were given to the ad-get-user command. name: default_base_query type: 0 section: Connect advanced: true required: false defaultvalue: '(&(objectClass=User)(objectCategory=person))' script: script: '' type: python subtype: python3 commands: - name: ad-expire-password prettyname: Force Password Reset [ActiveDirectory] quickaction: false quickaction:platform: true arguments: - name: username required: true description: The username (samAccountName) of the user to modify. prettyname: username - name: base-dn prettyname: Base DN description: Root (for example, DC=domain,DC=com). description: Expires the password of an Active Directory user. compliantpolicies: - User Soft Remediation - name: ad-create-user arguments: - name: username required: true description: The username (samAccountName) of the user to modify. - name: password required: true description: 'The initial password to set for the user. The user is requested to change the password after login.' - name: user-dn required: true description: The user DN. - name: display-name description: The user display name. - name: description description: A short description of the user. - name: email description: The user email. - name: telephone-number description: The user telephone number. - name: title description: The user job title. - name: custom-attributes description: Sets basic or custom attributes of the user object. For example, custom-attributes="{\"notes\":\"a note about the contact\",\"company\":\"company name\"}". description: Creates an Active Directory user. This command requires a secure connection (SSL,TLS). - name: ad-search arguments: - name: filter required: true description: 'Enables you to define search criteria in the Query Active Directory using Active Directory syntax. For example, the following query searches for all user objects except Andy: "(&(objectCategory=person)(objectClass=user)(!(cn=andy)))". Note: If you have special characters such as "*","(",or "\" the character must be preceded by two backslashes "\\". For example, to use "*", type "\\*". For more information about search filters, see syntax: https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax' - name: base-dn description: Root. For example, DC=domain,DC=com). By default, the Base DN configured for the instance is used. - name: attributes description: A CSV list of the object attributes to return. For example, "dn,memberOf". To return all object attributes, specify 'ALL'. - name: size-limit description: The maximum number of records to return. defaultValue: "50" - name: time-limit description: The maximum time to pull records (in seconds). - name: context-output auto: PREDEFINED predefined: - "yes" - "no" defaultValue: "yes" description: Whether to output the search results to the context. - name: page-size description: The page size to query. The size-limit value will be ignored. - name: page-cookie description: An opaque string received in a paged search, used for requesting subsequent entries. outputs: - contextPath: 'ActiveDirectory.Search.dn' description: The distinguished names that match the query. type: string - contextPath: 'ActiveDirectory.Search' description: The result of the search. type: unknown - contextPath: ActiveDirectory.SearchPageCookie description: An opaque string received in a paged search, used for requesting subsequent entries. type: string description: Runs Active Directory queries. - name: ad-add-to-group arguments: - name: username description: "The username of the user to add to the group. If this argument is not specified, the computer name argument must be specified.\\n Supports single or comma delimited list of usernames." - name: computer-name description: The name of the computer to add to the group. If this argument is not specified, the username argument must be specified. - name: group-cn required: true description: The name of the group to add the user to. - name: base-dn description: Root. For example, DC=domain,DC=com. By default, the Base DN configured for the instance is used. - description: The name of the group to add as a member of the group specified group-cn. name: nested_group_cn description: Adds an Active Directory user or computer to a group. - name: ad-remove-from-group arguments: - name: username description: "The name of the user to remove from the group. If this argument is not specified, the computer name argument must be specified." - name: computer-name description: The name of the computer to remove from the group. If this argument is not specified, the username argument must be specified. - name: group-cn required: true description: "The name of the group to remove the user from." - name: base-dn description: Root. For example, DC=domain,DC=com). By default, the Base DN configured for the instance is used. description: Removes an Active Directory user or computer from a group. - name: ad-update-user arguments: - name: username required: true description: "The username of the account to update (sAMAccountName)." - name: attribute-name required: true description: The name of the attribute to modify. For example, sn, displayName, mail, and so on. - name: attribute-value required: true description: The value to change the attribute to. When attribute-type is "byte", provide a comma-separated list of decimal integers (0-255), e.g. "0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0" for logonHours. - name: attribute-type description: The type of the attribute value. Set to "byte" for binary/Octet String attributes such as logonHours, objectSID, or objectGUID. When set, attribute-value must be a comma-separated list of decimal integers (0-255). auto: PREDEFINED predefined: - byte - name: base-dn description: Root. For example, DC=domain,DC=com. By default, the Base DN configured for the instance is used. description: Updates attributes of an existing Active Directory user. compliantpolicies: - User Hard Remediation - name: ad-delete-user arguments: - name: user-dn required: true description: The DN of the user to delete. description: Deletes an Active Directory user. compliantpolicies: - User Hard Remediation - name: ad-create-contact arguments: - name: contact-dn required: true description: "The contact DN." - name: display-name description: "The contact display name." - name: description description: The short description of the contact. - name: email description: The email address of the contact. - name: telephone-number description: The contact telephone number. - name: custom-attributes description: Sets basic or custom attributes of the contact object. For example, custom-attributes="{\"notes\":\"some note about the contact\",\"company\":\"some company\"}". - name: title description: The contact job title. description: Creates an Active Directory contact. - name: ad-update-contact arguments: - name: contact-dn required: true description: "The contact DN." - name: attribute-name required: true description: "The attribute name to update." - name: attribute-value required: true description: "The attribute value to update. When attribute-type is \"byte\", provide a comma-separated list of decimal integers (0-255)." - name: attribute-type description: The type of the attribute value. Set to "byte" for binary/Octet String attributes. When set, attribute-value must be a comma-separated list of decimal integers (0-255). auto: PREDEFINED predefined: - byte description: Updates attributes of an existing Active Directory contact. - name: ad-disable-account quickaction: false quickaction:platform: true prettyname: Disable User Account [ActiveDirectory] arguments: - description: "The username of the account to disable (sAMAccountName)." name: username required: true prettyname: username - name: base-dn prettyname: Base DN description: Root (e.g., DC=domain,DC=com). By default, the Base DN configured for the instance is used. description: Disables an Active Directory user account. compliantpolicies: - User Hard Remediation - name: ad-enable-account quickaction: false quickaction:platform: true prettyname: Enable User Account [ActiveDirectory] arguments: - name: username prettyname: username required: true description: "The username of the account to enable (sAMAccountName)." - name: base-dn prettyname: Base DN description: Root. For example, DC=domain,DC=com). By default, the Base DN configured for the instance is used. - name: restore_user auto: PREDEFINED predefined: - 'true' - 'false' description: "If true, the command will enable the user with his restored options." description: Enables a previously disabled Active Directory account. compliantpolicies: - User Hard Remediation - name: ad-unlock-account arguments: - name: username required: true description: "The username of the account to unlock (sAMAccountName)." - name: base-dn description: Root. For example, DC=domain,DC=com. By default, the Base DN configured for the instance is used. description: Unlocks a previously locked Active Directory user account. compliantpolicies: - User Soft Remediation - name: ad-set-new-password arguments: - name: username required: true description: "The username whose password will be changed." - name: password secret: true required: true description: "The password to set for the user." - name: base-dn description: Root. For example, DC=domain,DC=com. Base DN configured for the instance is used as default. description: Sets a new password for an Active Directory user. This command requires a secure connection (SSL,TLS). compliantpolicies: - User Soft Remediation - name: ad-modify-computer-ou arguments: - name: computer-name required: true description: "The name of the computer to modify." - name: full-superior-dn description: Superior DN. For example, OU=computers,DC=domain,DC=com (the specified domain must be the same as the current computer domain). description: Modifies the computer organizational unit within a domain. - name: ad-modify-user-ou arguments: - name: user-name required: true description: "The name of the user to modify." - name: full-superior-dn description: Superior DN. For example, OU=users,DC=domain,DC=com (the specified domain must be the same as the current user domain). description: Modifies the user organizational unit within a domain. compliantpolicies: - User Hard Remediation - name: ad-get-user arguments: - name: dn default: true description: The Distinguished Name of the user in which to return information. - name: name description: The name of the user to return information. - name: attributes description: Adds AD attributes of the resulting objects to the default attributes. - name: attributes-to-exclude description: Removes AD attributes of the resulting objects from the attributes. - name: custom-field-type description: Queries users by custom field type. - name: custom-field-data description: Queries users by custom field data (relevant only if the `custom-field-type` argument is provided). - name: username description: Queries users by the samAccountName attribute. - name: sAMAccountName description: Queries users by the samAccountName attribute. - name: email description: Queries by the user's email address. - name: user-account-control-out auto: PREDEFINED predefined: - "true" - "false" description: Whether to include verbose translation for UserAccountControl flags. Default is false. defaultValue: "false" - name: limit description: The maximum number of objects to return. defaultValue: "20" - name: page-size description: The page size to query. The limit value will be ignored. - name: page-cookie description: An opaque string received in a paged search, used for requesting subsequent entries. outputs: - contextPath: 'ActiveDirectory.Users.dn' description: The user distinguished name. type: string - contextPath: 'ActiveDirectory.Users.displayName' description: The user display name. type: string - contextPath: 'ActiveDirectory.Users.name' description: The user common name. type: string - contextPath: 'ActiveDirectory.Users.sAMAccountName' description: The user sAMAccountName. type: string - contextPath: 'ActiveDirectory.Users.userAccountControl' description: The user account control flag. type: number - contextPath: 'ActiveDirectory.Users.mail' description: The user email address. type: string - contextPath: 'ActiveDirectory.Users.manager' description: The manager of the user. type: string - contextPath: 'ActiveDirectory.Users.memberOf' description: Groups in which the user is a member. type: string - contextPath: ActiveDirectory.Users.userAccountControlFields.SCRIPT description: Whether the login script is run. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.ACCOUNTDISABLE description: Whether the user account is disabled. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.HOMEDIR_REQUIRED description: Whether the home folder is required. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.LOCKOUT description: Whether the user is locked out. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.PASSWD_NOTREQD description: Whether the password is required. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.PASSWD_CANT_CHANGE description: Whether the user can change the password. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.ENCRYPTED_TEXT_PWD_ALLOWED description: Whether the user can send an encrypted password. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.TEMP_DUPLICATE_ACCOUNT description: Whether this is an account for users whose primary account is in another domain. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.NORMAL_ACCOUNT description: Whether this is a default account type that represents a typical user. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.INTERDOMAIN_TRUST_ACCOUNT description: Whether the account is permitted to trust a system domain that trusts other domains. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.WORKSTATION_TRUST_ACCOUNT description: Whether this is a computer account for a computer running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.SERVER_TRUST_ACCOUNT description: Whether this is a computer account for a domain controller that is a member of this domain. Works for *Windows Server 2012 R2*. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.DONT_EXPIRE_PASSWORD description: Whether to never expire the password on the account. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.MNS_LOGON_ACCOUNT description: Whether this is an MNS login account. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.SMARTCARD_REQUIRED description: Whether to force the user to log in by using a smart card. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.TRUSTED_FOR_DELEGATION description: Whether the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.NOT_DELEGATED description: Whether the security context of the user isn't delegated to a service even if the service account is set as trusted for Kerberos delegation. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.USE_DES_KEY_ONLY description: Whether to restrict this principal to use only Data Encryption Standard (DES) encryption types for keys. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.DONT_REQ_PREAUTH description: Whether this account require Kerberos pre-authentication for logging on. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.PASSWORD_EXPIRED description: Whether the user password expired. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.TRUSTED_TO_AUTH_FOR_DELEGATION description: Whether the account is enabled for delegation. type: bool - contextPath: ActiveDirectory.Users.userAccountControlFields.PARTIAL_SECRETS_ACCOUNT description: Whether the account is a read-only domain controller (RODC). type: bool - contextPath: 'ActiveDirectory.UsersPageCookie' description: An opaque string received in a paged search, used for requesting subsequent entries. type: string - contextPath: 'Account.DisplayName' description: The user display name. type: string - contextPath: 'Account.Groups' description: "Groups for which the user is a member." type: string - contextPath: 'Account.Manager' description: "The user manager." type: string - contextPath: 'Account.ID' description: The user distinguished name. type: string - contextPath: 'Account.Username' description: The user samAccountName. type: string - contextPath: 'Account.Email' description: The user email address. type: string description: Retrieves detailed information about a user account. The user can be specified by name, email address, or as an Active Directory Distinguished Name (DN). If no filter is specified, all users are returned. - name: ad-get-computer arguments: - name: dn description: The computer's DN. - name: name description: The name of the computer to return information about. - name: attributes description: Adds AD attributes of the resulting objects to the default attributes. - name: custom-field-data description: Search computers by custom field data (relevant only if the `customFieldType` argument is provided). - name: custom-field-type description: Search the computer by custom field type. - name: limit description: The maximum number of records to return. - name: page-size description: The page size to query. The limit value will be ignored. - name: page-cookie description: An opaque string received in a paged search, used for requesting subsequent entries. outputs: - contextPath: 'ActiveDirectory.Computers.dn' description: The computer distinguished name. - contextPath: 'ActiveDirectory.Computers.memberOf' description: Groups for which the computer is listed. - contextPath: 'ActiveDirectory.Computers.name' description: The computer name. - contextPath: 'Endpoint.ID' description: The computer DN. - contextPath: 'Endpoint.Hostname' description: The computer host name. - contextPath: 'Endpoint.Groups' description: Groups for which the computer is listed as a member. - contextPath: ActiveDirectory.ComputersPageCookie description: An opaque string received in a paged search, used for requesting subsequent entries. type: string description: 'Retrieves detailed information about a computer account. The computer can be specified by name, email address, or as an Active Directory Distinguished Name (DN). If no filters are provided, all computers are returned.' - name: ad-get-group-members arguments: - name: group-dn required: true description: "The Distinguished Name of the Group's Active Directory." - name: member-type required: true auto: PREDEFINED predefined: - person - computer - group description: 'The type of members to search. Can be: "Person", or "computer". Default is person.' defaultValue: person - name: attributes description: CSV list of attributes to include in the results, in addition to the default attributes. - defaultValue: '180' description: Time limit (in seconds) for the search to run. name: time_limit - auto: PREDEFINED defaultValue: 'false' description: Whether to disable recursive retrieval of group memberships of a user. name: disable-nested-search predefined: - 'false' - 'true' - name: sAMAccountName description: Queries results by the samAccountName attribute. defaultValue: '*' - name: limit description: The maximum number of records to return. - name: page-size description: The page size to query. The limit value will be ignored. - name: page-cookie description: An opaque string received in a paged search, used for requesting subsequent entries. outputs: - contextPath: 'ActiveDirectory.Groups.dn' description: The group DN. type: string - contextPath: 'ActiveDirectory.Groups.members.dn' description: The group member DN. type: string - contextPath: 'ActiveDirectory.Groups.members.category' description: The group members category. type: string - contextPath: ActiveDirectory.GroupsPageCookie description: An opaque string received in a paged search, used for requesting subsequent entries. type: string description: Retrieves the list of users or computers that are members of the specified group. - name: ad-create-group arguments: - name: name description: The Active Directory name of the group. required: true - name: group-type description: 'The type of group. Can be: "security", or "distribution".' required: true auto: PREDEFINED predefined: - security - distribution - name: dn required: true description: The Full Distinguished Name (DN) of the group. Use double quotes ("") rather than single quotes ('') when initializing this command. - name: members description: The Full DN Of users or groups that will be members of the newly created group. isArray: true description: Creates a new security or distribution Active Directory group. execution: true - name: ad-delete-group arguments: - name: dn description: The Active Directory Distinguished Name (DN) of the group. required: true description: Deletes an existing Active Directory security or distribution group. execution: true - arguments: - name: user-profile required: true description: A User Profile indicator that contains user information, such as name, email address, etc. - auto: PREDEFINED defaultValue: 'true' description: When set to true, after the command execution the status of the user in the 3rd-party integration will be active. name: allow-enable predefined: - 'true' - 'false' description: Creates an Active Directory user. This command requires a secure connection (SSL,TLS). name: iam-create-user outputs: - contextPath: IAM.UserProfile description: The user profile. type: Unknown - contextPath: IAM.Vendor.active description: If true, the employee status is active. type: Boolean - contextPath: IAM.Vendor.brand description: The integration name. type: String - contextPath: IAM.Vendor.details description: Tells the user if the API was successful, otherwise provides error information. type: Unknown - contextPath: IAM.Vendor.email description: The employee email address. type: String - contextPath: IAM.Vendor.errorCode description: The HTTP error response code. type: Number - contextPath: IAM.Vendor.errorMessage description: The reason the API failed. type: String - contextPath: IAM.Vendor.id description: The employee user ID in the app. type: String - contextPath: IAM.Vendor.instanceName description: The name of the integration instance. type: Unknown - contextPath: IAM.Vendor.success description: If true, the command executed successfully. type: Boolean - contextPath: IAM.Vendor.username description: The employee username in the app. type: String - contextPath: IAM.Vendor.action description: The command name. type: String - arguments: - name: user-profile required: true description: A User Profile indicator that contains user information, such as name and email address. description: "Retrieves a single user resource." name: iam-get-user outputs: - contextPath: IAM.UserProfile description: The user profile. type: Unknown - contextPath: IAM.Vendor.active description: If true the employee status is active. type: Boolean - contextPath: IAM.Vendor.brand description: The integration name. type: String - contextPath: IAM.Vendor.details description: Tells the user if the API was successful, otherwise provides error information. type: Unknown - contextPath: IAM.Vendor.email description: The employee email address. type: String - contextPath: IAM.Vendor.errorCode description: The HTTP error response code. type: Number - contextPath: IAM.Vendor.errorMessage description: The reason the API failed. type: String - contextPath: IAM.Vendor.id description: The employee user ID in the app. type: String - contextPath: IAM.Vendor.instanceName description: The integration instance name. type: Unknown - contextPath: IAM.Vendor.success description: If true, the command was executed successfully. type: Boolean - contextPath: IAM.Vendor.username description: The employee username in the app. type: String - contextPath: IAM.Vendor.action description: The command name. type: String - arguments: - name: user-profile required: true description: A User Profile indicator that contains user information, such as name and email address. - auto: PREDEFINED defaultValue: 'true' description: When set to true, after the command executes the user status in the 3rd-party integration is active. name: allow-enable predefined: - 'true' - 'false' description: 'Updates an existing user with the data in the User Profile indicator that is passed in the user-profile argument.' name: iam-update-user outputs: - contextPath: IAM.UserProfile description: The user profile. type: Unknown - contextPath: IAM.Vendor.active description: Gives the active status of user. Can be true or false. type: Boolean - contextPath: IAM.Vendor.brand description: The integration name. type: String - contextPath: IAM.Vendor.details description: Tells the user if the API was successful, otherwise provides error information. type: Unknown - contextPath: IAM.Vendor.email description: The employee email address. type: String - contextPath: IAM.Vendor.errorCode description: The HTTP error response code. type: Number - contextPath: IAM.Vendor.errorMessage description: The reason the API failed. type: String - contextPath: IAM.Vendor.id description: The employee user ID in the app. type: String - contextPath: IAM.Vendor.instanceName description: The integration instance name. type: Unknown - contextPath: IAM.Vendor.success description: If true, the command executed successfully. type: Boolean - contextPath: IAM.Vendor.username description: The employee username in the app. type: String - contextPath: IAM.Vendor.action description: The command name. type: String compliantpolicies: - User Hard Remediation - arguments: - name: user-profile required: true description: "A User Profile indicator that contains user information, such as name and email address." description: Disables a user. execution: true name: iam-disable-user outputs: - contextPath: IAM.UserProfile description: The user profile. type: Unknown - contextPath: IAM.Vendor.active description: Gives the active status of user. Can be true or false. type: Boolean - contextPath: IAM.Vendor.brand description: The integration name. type: String - contextPath: IAM.Vendor.details description: Tells the user if the API was successful, otherwise provides error information. type: Unknown - contextPath: IAM.Vendor.email description: The employee email address. type: String - contextPath: IAM.Vendor.errorCode description: The HTTP error response code. type: Number - contextPath: IAM.Vendor.errorMessage description: The reason the API failed. type: String - contextPath: IAM.Vendor.id description: The employee user ID in the app. type: String - contextPath: IAM.Vendor.instanceName description: The integration instance name. type: Unknown - contextPath: IAM.Vendor.success description: If true, the command was executed successfully. type: Boolean - contextPath: IAM.Vendor.username description: The employee username in the app. type: String - contextPath: IAM.Vendor.action description: The command name. type: String compliantpolicies: - User Hard Remediation - description: Retrieves a User Profile schema which holds all of the user fields in the application. Used for outgoing mapping through the Get Schema option. name: get-mapping-fields arguments: [] - arguments: - description: The group name of the group to update (sAMAccountName). name: groupname - description: The name of the attribute to modify. For example, Description and displayName. name: attributename required: true - description: The value of the attribute to change. When attribute-type is "byte", provide a comma-separated list of decimal integers (0-255). name: attributevalue required: true - description: The type of the attribute value. Set to "byte" for binary/Octet String attributes. When set, attributevalue must be a comma-separated list of decimal integers (0-255). name: attribute-type auto: PREDEFINED predefined: - byte - description: Root. For example, DC=domain,DC=com. By default, the Base DN configured for the instance is used. name: basedn description: Updates attributes of an existing Active Directory group. name: ad-update-group - name: ad-modify-password-never-expire arguments: - name: username required: true description: The sAMAccountName of the user to modify. - name: value required: true auto: PREDEFINED predefined: - 'true' - 'false' description: Value to set "Password Never Expire". description: 'Modifies the AD account attribute "Password Never Expire".' execution: true compliantpolicies: - User Soft Remediation - arguments: - description: Username to test. By itself or formatted like SERVER_IP\\USERNAME. name: username required: true - description: Password to test. name: password required: true description: Test given credentials. name: ad-test-credentials outputs: - contextPath: ActiveDirectory.ValidCredentials description: List of usernames that successfully logged in. dockerimage: demisto/ldap:2.9.1.9062583 ismappable: true isremotesyncout: true runonce: false supportsquickactions: true fromversion: 5.0.0 tests: - Active Directory Test