id: Eradication Plan - Reset Password
version: -1
name: Eradication Plan - Reset Password
description: "This playbook is one of the sub-playbooks in the eradication plan. \nThe playbook executes actions to reset the user's passwords, which is a crucial step in the eradication process."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 09c31255-cc27-43a6-81db-fb416e7a41fc
    type: start
    task:
      id: 09c31255-cc27-43a6-81db-fb416e7a41fc
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: c674cf0c-a189-45a8-88d6-6f39d888ced0
    type: regular
    task:
      id: c674cf0c-a189-45a8-88d6-6f39d888ced0
      version: -1
      name: Auto password reset
      description: Invalidates the password of an Active Directory user.
      script: '|||ad-expire-password'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      username:
        complex:
          root: ResetPasswordToUsers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 83bdf4fd-82e0-41c8-801a-7dacf7cc7cb7
    type: title
    task:
      id: 83bdf4fd-82e0-41c8-801a-7dacf7cc7cb7
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: ed488801-2746-4d07-8abc-1dfb26c26f70
    type: condition
    task:
      id: ed488801-2746-4d07-8abc-1dfb26c26f70
      version: -1
      name: Is Active Directory Query v2 enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "14"
    scriptarguments:
      brandname:
        simple: Active Directory Query v2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: 948a893e-2686-482c-8662-cde9931f0644
    type: condition
    task:
      id: 948a893e-2686-482c-8662-cde9931f0644
      version: -1
      name: Should reset the user password?
      description: |+
        Whether to reset the user's password based on the input values.


      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UserRemediation
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Username
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 295
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 11182b8c-325c-453c-8d1e-6890e1846610
    type: regular
    task:
      id: 11182b8c-325c-453c-8d1e-6890e1846610
      version: -1
      name: Set the user with a password reset to the Incident context
      description: commands.local.cmd.set.parent.incident.context
      script: Builtin|||setParentIncidentContext
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: UserPasswordReset
      value:
        complex:
          root: ResetPasswordToUsers
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 89912e2c-f160-47d2-8ea0-a03d2e7125eb
    type: regular
    task:
      id: 89912e2c-f160-47d2-8ea0-a03d2e7125eb
      version: -1
      name: Set users to reset password
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: ResetPasswordToUsers
      value:
        complex:
          root: inputs.Username
          filters:
          - - operator: isNotEqualString
              left:
                value:
                  simple: inputs.Username
                iscontext: true
              right:
                value:
                  simple: Administrator
              ignorecase: true
          transformers:
          - operator: uniq
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 735
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "8_3_#default#": 0.16,
      "9_3_#default#": 0.14
    },
    "paper": {
      "dimensions": {
        "height": 1215,
        "width": 380,
        "x": 450,
        "y": 150
      }
    }
  }
inputs:
- key: UserRemediation
  value:
    simple: "True"
  required: false
  description: Set to 'True' to reset the user's password.
  playbookInputQuery:
- key: Username
  value: {}
  required: false
  description: The username to reset the password for.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.6.0
marketplaces:
- marketplacev2
- platform