id: Get User Devices by Username - Generic version: -1 name: Get User Devices by Username - Generic description: |- This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the `UserDevices` context key: - Name - Serial Number - ID - Model - MAC Address - OS - Integration Note that not all of the supported integrations will be able to retrieve this information. Supported integrations: - jamf v2 - Microsoft Defender for Endpoint - Cortex XDR IR - ServiceNow v2 - Google Workspace (Gsuite) - Active Directory Query v2. starttaskid: "0" tasks: "0": id: "0" taskid: 7f91d06d-7f39-42b3-8fc9-c053b9711389 type: start task: id: 7f91d06d-7f39-42b3-8fc9-c053b9711389 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "1" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 380, "y": 120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "1": id: "1" taskid: 92420939-e8b5-4eca-8e8a-ca4a185b06fb type: condition task: id: 92420939-e8b5-4eca-8e8a-ca4a185b06fb version: -1 name: Username exists? description: Checks if the username input is not empty. type: condition iscommand: false brand: "" nexttasks: '#default#': - "12" "yes": - "7" - "17" - "13" - "21" - "2" - "30" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.Username iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 380, "y": 290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: 98d3f19b-42e7-4129-8271-9b3b12ae0ebb type: title task: id: 98d3f19b-42e7-4129-8271-9b3b12ae0ebb version: -1 name: Google Workspace (Gsuite) type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "4" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -640, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: b2d45d85-574f-4005-8bd4-94faafb71264 type: regular task: id: b2d45d85-574f-4005-8bd4-94faafb71264 version: -1 name: Google Workspace - Get device details description: Retrieves a paginated list that includes company-owned mobile devices. script: '|||gsuite-mobiledevice-list' type: regular iscommand: true brand: "" nexttasks: '#none#': - "46" scriptarguments: customer_id: complex: root: inputs.GsuiteCustomerID query: simple: name:${inputs.Username} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -640, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: 642325ab-a47b-466b-8ceb-5f6b870645dc type: condition task: id: 642325ab-a47b-466b-8ceb-5f6b870645dc version: -1 name: Customer ID exist? description: Checks if the customer ID input is not empty. type: condition iscommand: false brand: "" nexttasks: '#default#': - "11" "yes": - "5" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.GsuiteCustomerID iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": -640, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 7f8b6c8c-f41b-4dcb-8b8b-7aca28f4a929 type: condition task: id: 7f8b6c8c-f41b-4dcb-8b8b-7aca28f4a929 version: -1 name: GSuiteAdmin enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "11" "yes": - "3" scriptarguments: brandname: simple: GSuiteAdmin results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -640, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 4ef40554-cf34-49cb-899f-08d60acdb09c type: title task: id: 4ef40554-cf34-49cb-899f-08d60acdb09c version: -1 name: Done - Jamf type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1980, "y": 1830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 9f903855-b87e-49e4-89b6-4b8e936f155f type: title task: id: 9f903855-b87e-49e4-89b6-4b8e936f155f version: -1 name: Jamf type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "9" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1980, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 43cebc52-17a9-417a-8b2f-9b4f9aba01b9 type: regular task: id: 43cebc52-17a9-417a-8b2f-9b4f9aba01b9 version: -1 name: Jamf Pro - Get computer details description: Matches computers by specific characteristics and returns general data on each of the computers. script: jamf v2|||jamf-get-computer-by-match type: regular iscommand: true brand: jamf v2 nexttasks: '#none#': - "37" scriptarguments: match: complex: root: inputs.Username separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: e7ef5ffc-3774-47a7-8703-65b270b9c86d type: condition task: id: e7ef5ffc-3774-47a7-8703-65b270b9c86d version: -1 name: jamf v2 enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "6" "yes": - "8" - "10" scriptarguments: brandname: simple: jamf v2 results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1980, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 7810b5de-6dcc-4003-8d47-66daf1804f68 type: regular task: id: 7810b5de-6dcc-4003-8d47-66daf1804f68 version: -1 name: Jamf Pro - Get mobile device details description: Matches mobile devices by specific characteristics and returns general data on each one of the mobile devices. script: '|||jamf-get-mobile-device-by-match' type: regular iscommand: true brand: "" nexttasks: '#none#': - "38" scriptarguments: match: complex: root: inputs.Username separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2650, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: bb7d7602-53db-41d3-892d-1f67433977cd type: title task: id: bb7d7602-53db-41d3-892d-1f67433977cd version: -1 name: Done - GSuite type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -640, "y": 1820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 9d63ac27-9180-446e-8368-6618eddb2c5f type: title task: id: 9d63ac27-9180-446e-8368-6618eddb2c5f version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2500, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 169c5e7e-5e78-4951-8ccf-b4124b0390ed type: title task: id: 169c5e7e-5e78-4951-8ccf-b4124b0390ed version: -1 name: Cortex XDR / Core type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "14" - "54" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 640, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 31e75795-67a1-413d-8c95-e82a2d24c709 type: condition task: id: 31e75795-67a1-413d-8c95-e82a2d24c709 version: -1 name: Cortex XDR IR enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "16" "yes": - "15" scriptarguments: brandname: simple: Cortex XDR - IR results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 380, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 65bab14c-a758-4bfc-83a4-6147f0a3cf3a type: regular task: id: 65bab14c-a758-4bfc-83a4-6147f0a3cf3a version: -1 name: Cortex XDR - Get device details description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0). script: Cortex XDR - IR|||xdr-get-endpoints type: regular iscommand: true brand: Cortex XDR - IR nexttasks: '#none#': - "52" scriptarguments: username: complex: root: inputs.Username separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 380, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: fe65ba2d-93e9-4c59-8496-3006d7164738 type: title task: id: fe65ba2d-93e9-4c59-8496-3006d7164738 version: -1 name: Done - Cortex XDR type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 380, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: 6bc58f17-e345-4a64-87c9-ddda3d6a20f4 type: title task: id: 6bc58f17-e345-4a64-87c9-ddda3d6a20f4 version: -1 name: Microsoft Defender for Endpoint type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "18" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1450, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 03a8ebf7-df74-4c8e-8230-cfc2c463d7d6 type: condition task: id: 03a8ebf7-df74-4c8e-8230-cfc2c463d7d6 version: -1 name: Microsoft Defender Advanced Threat Protection enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "20" "yes": - "19" scriptarguments: brandname: simple: Microsoft Defender Advanced Threat Protection results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1450, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 51b7ad17-cc11-41e4-861a-49d64130c5b3 type: regular task: id: 51b7ad17-cc11-41e4-861a-49d64130c5b3 version: -1 name: MS ATP - get user machines description: Retrieves a collection of machines related to a given user ID. script: Microsoft Defender Advanced Threat Protection|||microsoft-atp-get-user-machines type: regular iscommand: true brand: Microsoft Defender Advanced Threat Protection nexttasks: '#none#': - "50" scriptarguments: username: complex: root: inputs.Username separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1450, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 96d6a3fa-d31e-4a75-8ae9-4fff83d6d792 type: title task: id: 96d6a3fa-d31e-4a75-8ae9-4fff83d6d792 version: -1 name: Done - MS Defender type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1460, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 94a1a4b2-10d0-4f39-8f22-ca766e57a227 type: title task: id: 94a1a4b2-10d0-4f39-8f22-ca766e57a227 version: -1 name: ServiceNow CMDB type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "22" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -120, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 279c5cef-b588-4af1-8454-a121c3615b6f type: condition task: id: 279c5cef-b588-4af1-8454-a121c3615b6f version: -1 name: ServiceNow v2 enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "26" "yes": - "23" scriptarguments: brandname: simple: ServiceNow v2 results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -120, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: f3b72eb2-8f8d-4ab0-8830-ae6d86cb4a6d type: regular task: id: f3b72eb2-8f8d-4ab0-8830-ae6d86cb4a6d version: -1 name: SNOW - Get user ID by username description: Queries the sys_user table in ServiceNow. script: ServiceNow v2|||servicenow-query-users type: regular iscommand: true brand: ServiceNow v2 nexttasks: '#none#': - "24" scriptarguments: user_name: complex: root: inputs.Username separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -120, "y": 880 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 35f1249e-457e-4e2a-8357-d9fa3044431b type: condition task: id: 35f1249e-457e-4e2a-8357-d9fa3044431b version: -1 name: User found? description: Checks if a username was found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "25" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: ServiceNow.User accessor: ID iscontext: true continueonerrortype: "" view: |- { "position": { "x": -120, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: 385e4bce-8feb-4a3d-8110-526a7d560ab7 type: regular task: id: 385e4bce-8feb-4a3d-8110-526a7d560ab7 version: -1 name: SNOW - Get computer details by UserID description: Queries the cmdb_ci_computer table in ServiceNow. script: ServiceNow v2|||servicenow-query-computers type: regular iscommand: true brand: ServiceNow v2 nexttasks: '#none#': - "44" scriptarguments: query: simple: assigned_by=${ServiceNow.User.ID} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -120, "y": 1240 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 973a28e2-18df-4f15-8093-2955093cad2c type: title task: id: 973a28e2-18df-4f15-8093-2955093cad2c version: -1 name: Done - SNOW type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -120, "y": 1820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 76c960de-4232-407e-88d3-3a2b4d1e54e1 type: condition task: id: 76c960de-4232-407e-88d3-3a2b4d1e54e1 version: -1 name: Check if any device found description: Checks if any user device was found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "29" "yes": - "28" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: SnowComputers iscontext: true right: value: {} - operator: isNotEmpty left: value: complex: root: GoogleDevices iscontext: true - operator: isNotEmpty left: value: complex: root: JamfMobileDevices iscontext: true - operator: isNotEmpty left: value: complex: root: JamfComputers iscontext: true - operator: isNotEmpty left: value: complex: root: MSDefenderDevices iscontext: true - operator: isNotEmpty left: value: complex: root: XDREndpoints iscontext: true - operator: isNotEmpty left: value: complex: root: ADComputer iscontext: true continueonerrortype: "" view: |- { "position": { "x": 380, "y": 2020 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: c7f91ab4-017e-4c32-8e3e-23220e1c84fc type: regular task: id: c7f91ab4-017e-4c32-8e3e-23220e1c84fc version: -1 name: Set UserDevices description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "29" scriptarguments: key: simple: UserDevices value: complex: root: SnowComputers transformers: - operator: AppendIfNotEmpty args: item: value: simple: GoogleDevices iscontext: true raw: {} - operator: AppendIfNotEmpty args: item: value: simple: JamfMobileDevices iscontext: true raw: {} - operator: AppendIfNotEmpty args: item: value: simple: JamfComputers iscontext: true raw: {} - operator: AppendIfNotEmpty args: item: value: simple: ADComputer iscontext: true raw: {} - operator: AppendIfNotEmpty args: item: value: simple: MSDefenderDevices iscontext: true raw: {} - operator: AppendIfNotEmpty args: item: value: simple: XDREndpoints iscontext: true raw: {} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 380, "y": 2220 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: b3a51b55-5793-4767-8b11-66fe0b941298 type: title task: id: b3a51b55-5793-4767-8b11-66fe0b941298 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 380, "y": 2400 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "30": id: "30" taskid: 9c39a8e6-c7c4-49ba-8c35-a263f08206a6 type: title task: id: 9c39a8e6-c7c4-49ba-8c35-a263f08206a6 version: -1 name: Active Directory type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "31" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 530 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 0ad9d77f-b679-45ee-894e-7830b1502627 type: condition task: id: 0ad9d77f-b679-45ee-894e-7830b1502627 version: -1 name: CustomADAttribute exist? description: Checks if a custom AD attribute was provided in the playbook input. type: condition iscommand: false brand: "" nexttasks: '#default#': - "34" "yes": - "32" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.CustomADAttribute iscontext: true continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: d292e8d7-86db-428f-8513-e5035a1a6947 type: condition task: id: d292e8d7-86db-428f-8513-e5035a1a6947 version: -1 name: Active Directory Query v2 enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "34" "yes": - "33" scriptarguments: brandname: simple: Active Directory Query v2 results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 5970a949-ae5e-44dc-8057-f44414377bb1 type: regular task: id: 5970a949-ae5e-44dc-8057-f44414377bb1 version: -1 name: AD - Get user details description: Retrieves detailed information about a user account. The user can be specified by name, email address, or as an Active Directory Distinguished Name (DN). If no filter is specified, all users are returned. script: '|||ad-get-user' type: regular iscommand: true brand: "" nexttasks: '#none#': - "49" scriptarguments: attributes: complex: root: inputs.CustomADAttribute username: complex: root: inputs.Username separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "34": id: "34" taskid: 29853db3-1746-4cc0-8174-545ff4db7b45 type: title task: id: 29853db3-1746-4cc0-8174-545ff4db7b45 version: -1 name: Done - AD type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 1820 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "35": id: "35" taskid: 0ab095b0-5fe3-465f-8b47-81cba6b3b83d type: regular task: id: 0ab095b0-5fe3-465f-8b47-81cba6b3b83d version: -1 name: Save the custom attribute value description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "48" scriptarguments: key: simple: ADComputerName value: complex: root: ActiveDirectory accessor: Users transformers: - operator: getField args: field: value: simple: inputs.CustomADAttribute iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 1460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "37": id: "37" taskid: 54307288-b5f0-4a11-83ed-3744b5fe18ee type: condition task: id: 54307288-b5f0-4a11-83ed-3744b5fe18ee version: -1 name: Any results? description: Checks if any result was found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "39" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: JAMF.Computer accessor: id iscontext: true continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 1075 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "38": id: "38" taskid: aeec665b-9c0d-4fe6-8150-d1a37cf235ba type: condition task: id: aeec665b-9c0d-4fe6-8150-d1a37cf235ba version: -1 name: Any results? description: Checks if any result was found. type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "40" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: JAMF.MobileDevice accessor: id iscontext: true continueonerrortype: "" view: |- { "position": { "x": 2650, "y": 1075 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "39": id: "39" taskid: 4088218f-acad-42fa-82e0-e05649ecac4a type: regular task: id: 4088218f-acad-42fa-82e0-e05649ecac4a version: -1 name: Get computer information description: 'Returns the "general" subset of a specific computer, e.g.: name, MAC address, IP, serial number, UDID, etc.' script: '|||jamf-get-computer-by-id' type: regular iscommand: true brand: "" nexttasks: '#none#': - "41" scriptarguments: id: complex: root: JAMF.Computer accessor: id separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 1275 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: b380fc9d-1597-4148-88d0-ba38680246cc type: regular task: id: b380fc9d-1597-4148-88d0-ba38680246cc version: -1 name: Get mobile device information description: 'Returns the "general" subset of a specific mobile device, e.g.: name, MAC address, IP, serial number, UDID. etc.' script: '|||jamf-get-mobile-device-by-id' type: regular iscommand: true brand: "" nexttasks: '#none#': - "42" scriptarguments: id: complex: root: JAMF.MobileDevice accessor: id separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2650, "y": 1275 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "41": id: "41" taskid: 235add7f-9018-41f9-89f9-6820218625f1 type: regular task: id: 235add7f-9018-41f9-89f9-6820218625f1 version: -1 name: set JamfComputers description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "43" scriptarguments: key: simple: JamfComputers value: simple: '${JAMF.Computer={Name: val[''name''], SerialNumber: val[''serial_number''], ID: val[''id''], Model: val[''platform''], MACAddress: val[''mac_address''], OS: '''', Integration: ''jamf v2''}}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 1460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "42": id: "42" taskid: 485be541-d9d5-4d75-8b3e-c135a36eccbf type: regular task: id: 485be541-d9d5-4d75-8b3e-c135a36eccbf version: -1 name: set JamfMobileDevices description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "6" scriptarguments: key: simple: JamfMobileDevices value: simple: '${JAMF.MobileDevice={Name: val[''name''], SerialNumber: val[''serial_number''], ID: val[''id''], Model: val[''model''], MACAddress: val[''wifi_mac_address''], OS: '''', Integration: ''jamf v2''}}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2650, "y": 1460 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "43": id: "43" taskid: 304fe0fd-2226-4556-84d8-7fd4d20d9e6c type: regular task: id: 304fe0fd-2226-4556-84d8-7fd4d20d9e6c version: -1 name: Remove null results description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "6" scriptarguments: append: simple: "false" key: simple: JamfComputers value: complex: root: JamfComputers filters: - - operator: isExists left: value: simple: JamfComputers.ID iscontext: true ignorecase: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 1630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "44": id: "44" taskid: 10f93f62-40f7-467d-89d6-1ef8c5954712 type: condition task: id: 10f93f62-40f7-467d-89d6-1ef8c5954712 version: -1 name: Any results? description: Checks if there is any result. type: condition iscommand: false brand: "" nexttasks: '#default#': - "26" "yes": - "45" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: ServiceNow.Computer accessor: ID iscontext: true continueonerrortype: "" view: |- { "position": { "x": -120, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "45": id: "45" taskid: 7f978671-30dd-40df-8483-7a6e0eade9a6 type: regular task: id: 7f978671-30dd-40df-8483-7a6e0eade9a6 version: -1 name: Set SnowComputers description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "26" scriptarguments: key: simple: SnowComputers value: simple: '${ServiceNow.Computer={Name: val[''Name''], SerialNumber: '''', ID: val[''ID''], Model: '''', MACAddress: '''', OS: val[''OperatingSystem''], Integration: ''ServiceNow v2''}}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -120, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "46": id: "46" taskid: edc77b8c-9115-4658-879a-fc7d39e1c36e type: condition task: id: edc77b8c-9115-4658-879a-fc7d39e1c36e version: -1 name: Any results? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "11" "yes": - "47" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: GSuite.MobileDevices.MobileListObjects accessor: deviceId iscontext: true continueonerrortype: "" view: |- { "position": { "x": -640, "y": 1280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "47": id: "47" taskid: 84d39418-6b26-48d3-8785-3c06575be545 type: regular task: id: 84d39418-6b26-48d3-8785-3c06575be545 version: -1 name: Set GoogleDevices description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "11" scriptarguments: key: simple: GoogleDevices value: simple: '${GSuite.MobileDevices.MobileListObjects={Name: val[''name''], SerialNumber: val[''serialNumber''], ID: val[''deviceId''], Model: val[''model''], MACAddress: val[''wifiMacAddress''], OS: val[''os''], Integration: ''GSuiteAdmin''}}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -640, "y": 1480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "48": id: "48" taskid: e6b260f6-b77b-4281-89e4-caa634c1c01c type: regular task: id: e6b260f6-b77b-4281-89e4-caa634c1c01c version: -1 name: Set ADComputer description: Set multiple keys/values to the context. scriptName: SetMultipleValues type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" scriptarguments: keys: simple: Name,SerialNumber,ID,Model,MACAddress,OS,Integration parent: simple: ADComputer values: simple: ${ADComputerName},,,,,,Active Directory Query v2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 1650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "49": id: "49" taskid: b256ed98-732f-4165-88a1-86d94773c72d type: condition task: id: b256ed98-732f-4165-88a1-86d94773c72d version: -1 name: Any results? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "34" "yes": - "35" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: ActiveDirectory accessor: Users transformers: - operator: getField args: field: value: simple: inputs.CustomADAttribute iscontext: true iscontext: true continueonerrortype: "" view: |- { "position": { "x": -1160, "y": 1265 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "50": id: "50" taskid: ff18c78e-c128-42de-8cc2-5929bd1ec9ad type: condition task: id: ff18c78e-c128-42de-8cc2-5929bd1ec9ad version: -1 name: Any results? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "20" "yes": - "51" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: MicrosoftATP.UserMachine.Machines accessor: ID iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1450, "y": 1075 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "51": id: "51" taskid: 1e76e6a4-41e7-4a77-85aa-59e5a41f8e2d type: regular task: id: 1e76e6a4-41e7-4a77-85aa-59e5a41f8e2d version: -1 name: Set MSDefenderDevices description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" scriptarguments: key: simple: MSDefenderDevices value: simple: '${MicrosoftATP.UserMachine.Machines={Name: val[''ComputerDNSName''], SerialNumber: '''', ID: val[''AADDeviceID''], Model: '''', MACAddress: '''', OS: val[''OSPlatform''], Integration: ''Microsoft Defender Advanced Threat Protection''}}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1460, "y": 1260 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "52": id: "52" taskid: 360e2e81-7171-42c4-8063-6d45e7dbc441 type: condition task: id: 360e2e81-7171-42c4-8063-6d45e7dbc441 version: -1 name: Any results? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "16" "yes": - "53" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: PaloAltoNetworksXDR.Endpoint accessor: endpoint_id iscontext: true continueonerrortype: "" view: |- { "position": { "x": 380, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "53": id: "53" taskid: 69282860-ecd4-45b7-8ba3-7ff339cfe7e1 type: regular task: id: 69282860-ecd4-45b7-8ba3-7ff339cfe7e1 version: -1 name: Set XDREndpoints description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "16" scriptarguments: key: simple: XDREndpoints value: simple: '${PaloAltoNetworksXDR.Endpoint={Name: val[''endpoint_name''], SerialNumber: '''', ID: val[''endpoint_id''], Model: val[''endpoint_type''], MACAddress: val[''mac_address''], OS: val[''os_type''], Integration: ''Cortex XDR - IR''}}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 380, "y": 1265 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "54": id: "54" taskid: 0eea89b2-b09a-4dae-8356-31b186e1613a type: condition task: id: 0eea89b2-b09a-4dae-8356-31b186e1613a version: -1 name: Cortex Core IR enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "55" "yes": - "56" scriptarguments: brandname: simple: Cortex Core - IR results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 900, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "55": id: "55" taskid: 1b426d46-5211-4355-8bd5-dde940087cd5 type: title task: id: 1b426d46-5211-4355-8bd5-dde940087cd5 version: -1 name: Done - Cortex Core type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 900, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: f9afe925-5210-4714-805f-e076e97c9973 type: regular task: id: f9afe925-5210-4714-805f-e076e97c9973 version: -1 name: Cortex Core - Get device details description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0). script: '|||core-get-endpoints' type: regular iscommand: true brand: "" nexttasks: '#none#': - "57" scriptarguments: username: complex: root: inputs.Username separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 900, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "57": id: "57" taskid: 6d47d858-a121-415e-82d4-dd033b20222a type: condition task: id: 6d47d858-a121-415e-82d4-dd033b20222a version: -1 name: Any results? description: "" type: condition iscommand: false brand: "" nexttasks: '#default#': - "55" "yes": - "58" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: Core.Endpoint.endpoint_id iscontext: true continueonerrortype: "" view: |- { "position": { "x": 900, "y": 1080 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "58": id: "58" taskid: baa6ebfb-b39f-4b7a-80cf-89ac44b6969e type: regular task: id: baa6ebfb-b39f-4b7a-80cf-89ac44b6969e version: -1 name: Set XDREndpoints description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "55" scriptarguments: key: simple: XDREndpoints value: simple: '${Core.Endpoint={Name: val[''endpoint_name''], SerialNumber: '''', ID: val[''endpoint_id''], Model: val[''endpoint_type''], MACAddress: val[''mac_address''], OS: val[''os_type''], Integration: ''Cortex Core - IR''}}' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 900, "y": 1265 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "14_15_yes": 0.42, "14_16_no": 0.11, "18_19_yes": 0.47, "18_20_no": 0.16, "1_12_#default#": 0.89, "1_13_yes": 0.49, "1_21_yes": 0.81, "1_2_yes": 0.88, "1_30_yes": 0.89, "1_7_yes": 0.87, "22_23_yes": 0.4, "22_26_no": 0.13, "24_26_#default#": 0.2, "31_34_#default#": 0.1, "32_34_no": 0.15, "37_6_#default#": 0.12, "38_6_#default#": 0.2, "46_11_#default#": 0.13, "46_47_yes": 0.4, "4_11_#default#": 0.15, "50_20_#default#": 0.19, "50_51_yes": 0.42, "52_16_#default#": 0.69, "52_53_yes": 0.37, "54_55_no": 0.11, "57_55_#default#": 0.69, "5_11_no": 0.42, "9_6_no": 0.18 }, "paper": { "dimensions": { "height": 2345, "width": 4190, "x": -1160, "y": 120 } } } inputs: - key: Username value: {} required: false description: The username of the user. playbookInputQuery: - key: GsuiteCustomerID value: {} required: false description: If using Google Workspace, a customer ID is needed. playbookInputQuery: - key: CustomADAttribute value: {} required: false description: |- A custom Active Directory attribute. In case there is a custom attribute in Active Directory which stores the name of the computer assigned to the user in the user object, it would be fetched. playbookInputQuery: outputs: - contextPath: GSuite.MobileDevices description: Gsuite mobile devices. type: unknown - contextPath: GSuite.MobileDevices.MobileListObjects description: A list of mobile device objects. - contextPath: GSuite.MobileDevices.MobileListObjects.kind description: The type of the API resource. - contextPath: GSuite.MobileDevices.MobileListObjects.etag description: ETag of the resource. - contextPath: GSuite.MobileDevices.MobileListObjects.resourceId description: The unique ID the API service uses to identify the mobile device. - contextPath: GSuite.MobileDevices.MobileListObjects.deviceId description: The serial number for a Google Sync mobile device. For Android and iOS devices, this is a software-generated unique identifier. - contextPath: GSuite.MobileDevices.MobileListObjects.name description: A list of the owner's usernames. - contextPath: GSuite.MobileDevices.MobileListObjects.email description: A list of the owner's email addresses. - contextPath: GSuite.MobileDevices.MobileListObjects.model description: The mobile device's model name. - contextPath: GSuite.MobileDevices.MobileListObjects.os description: The mobile device's operating system. - contextPath: GSuite.MobileDevices.MobileListObjects.type description: The type of mobile device. - contextPath: GSuite.MobileDevices.MobileListObjects.status description: The mobile device's status. - contextPath: GSuite.MobileDevices.MobileListObjects.hardwareId description: The IMEI/MEID unique identifier for Android hardware. - contextPath: GSuite.MobileDevices.MobileListObjects.firstSync description: The date and time the mobile device was initially synchronized with the policy settings in the Admin console. - contextPath: GSuite.MobileDevices.MobileListObjects.lastSync description: The date and time the mobile device was last synchronized with the policy settings in the Admin console. - contextPath: GSuite.MobileDevices.MobileListObjects.userAgent description: Information about the mobile device such as the operating system version. - contextPath: GSuite.MobileDevices.MobileListObjects.serialNumber description: The mobile device's serial number. - contextPath: GSuite.MobileDevices.MobileListObjects.imei description: The mobile device's IMEI number. - contextPath: GSuite.MobileDevices.MobileListObjects.meid description: The mobile device's MEID number. - contextPath: GSuite.MobileDevices.MobileListObjects.wifiMacAddress description: The mobile device's MAC address on Wi-Fi networks. - contextPath: GSuite.MobileDevices.MobileListObjects.networkOperator description: Mobile device mobile or network operator. - contextPath: GSuite.MobileDevices.MobileListObjects.defaultLanguage description: The default locale used on the mobile device. - contextPath: GSuite.MobileDevices.MobileListObjects.managedAccountIsOnOwnerProfile description: Boolean indicating if this account is on the owner/primary profile. - contextPath: GSuite.MobileDevices.MobileListObjects.deviceCompromisedStatus description: The compromised device status. - contextPath: GSuite.MobileDevices.MobileListObjects.buildNumber description: The mobile device's operating system build number. - contextPath: GSuite.MobileDevices.MobileListObjects.kernelVersion description: The mobile device's kernel version. - contextPath: GSuite.MobileDevices.MobileListObjects.basebandVersion description: The mobile device's baseband version. - contextPath: GSuite.MobileDevices.MobileListObjects.unknownSourcesStatus description: Unknown sources enabled or disabled on the mobile device. - contextPath: GSuite.MobileDevices.MobileListObjects.adbStatus description: Whether adb (USB debugging) is enabled on the mobile device. - contextPath: GSuite.MobileDevices.MobileListObjects.developerOptionsStatus description: Whether developer options are enabled on the mobile device. - contextPath: GSuite.MobileDevices.MobileListObjects.otherAccountsInfo description: A list of accounts added on the device. - contextPath: GSuite.MobileDevices.MobileListObjects.supportsWorkProfile description: Work profile supported on the mobile device. - contextPath: GSuite.MobileDevices.MobileListObjects.manufacturer description: Mobile device manufacturer. - contextPath: GSuite.MobileDevices.MobileListObjects.releaseVersion description: Mobile device release version. - contextPath: GSuite.MobileDevices.MobileListObjects.securityPatchLevel description: Mobile device security patch level. - contextPath: GSuite.MobileDevices.MobileListObjects.brand description: Mobile device brand. - contextPath: GSuite.MobileDevices.MobileListObjects.bootloaderVersion description: Mobile device bootloader version. - contextPath: GSuite.MobileDevices.MobileListObjects.hardware description: Mobile device hardware. - contextPath: GSuite.MobileDevices.MobileListObjects.encryptionStatus description: Mobile device encryption status. - contextPath: GSuite.MobileDevices.MobileListObjects.devicePasswordStatus description: Mobile device password status. - contextPath: GSuite.MobileDevices.MobileListObjects.privilege description: DM agent permission. - contextPath: GSuite.MobileDevices.MobileListObjects.applications description: Mobile device applications. type: unknown - contextPath: GSuite.MobileDevices.MobileListObjects.applications.packageName description: The application's package name. - contextPath: GSuite.MobileDevices.MobileListObjects.applications.displayName description: The application's display name. - contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionName description: The application's version name. - contextPath: GSuite.MobileDevices.MobileListObjects.applications.versionCode description: The application's version code. - contextPath: GSuite.MobileDevices.MobileListObjects.applications.permission description: The list of permissions of this application. - contextPath: JAMF.Computer description: Computer object. type: unknown - contextPath: JAMF.Computer.id description: The computer ID. - contextPath: JAMF.Computer.name description: The computer name. - contextPath: JAMF.Computer.udid description: The computer UDID. - contextPath: JAMF.Computer.serial_number description: The computer serial number. - contextPath: JAMF.Computer.mac_address description: The computer MAC address. - contextPath: JAMF.Computer.alt_mac_address description: The computer alt MAC address. - contextPath: JAMF.Computer.asset_tag description: The computer asset tag. - contextPath: JAMF.Computer.bar_code_1 description: The computer barcode 1. - contextPath: JAMF.Computer.bar_code_2 description: The computer barcode 2. - contextPath: JAMF.Computer.username description: The computer username. - contextPath: JAMF.Computer.realname description: The computer real name. - contextPath: JAMF.Computer.email description: The computer email address. - contextPath: JAMF.Computer.email_address description: The computer email address. - contextPath: JAMF.Computer.room description: The computer room. - contextPath: JAMF.Computer.position description: The computer position. - contextPath: JAMF.Computer.building description: The computer building. - contextPath: JAMF.Computer.building_name description: The computer building name. - contextPath: JAMF.Computer.department description: The computer department. - contextPath: JAMF.Computer.department_name description: The computer department name. - contextPath: JAMF.MobileDevice description: Mobile device object. type: unknown - contextPath: JAMF.MobileDevice.id description: The mobile device ID. - contextPath: JAMF.MobileDevice.name description: The mobile device name. - contextPath: JAMF.MobileDevice.udid description: The mobile device UDID. - contextPath: JAMF.MobileDevice.serial_number description: The mobile device serial number. - contextPath: JAMF.MobileDevice.mac_address description: The mobile device MAC address. - contextPath: JAMF.MobileDevice.wifi_mac_address description: The mobile device WI-FI MAC address. - contextPath: JAMF.MobileDevice.username description: The mobile device username. - contextPath: JAMF.MobileDevice.realname description: The mobile device real name. - contextPath: JAMF.MobileDevice.email description: The mobile device user email address. - contextPath: JAMF.MobileDevice.email_address description: The mobile device user email address. - contextPath: JAMF.MobileDevice.room description: The mobile device room. - contextPath: JAMF.MobileDevice.position description: The mobile device position. - contextPath: JAMF.MobileDevice.building description: The mobile device building. - contextPath: JAMF.MobileDevice.building_name description: The mobile device building name. - contextPath: JAMF.MobileDevice.department description: The mobile device department. - contextPath: JAMF.MobileDevice.department_name description: The mobile device department name. - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id description: The endpoint ID. - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name description: The endpoint name. - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type description: The endpoint type. - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status description: The status of the endpoint. - contextPath: PaloAltoNetworksXDR.Endpoint.os_type description: The endpoint OS type. - contextPath: PaloAltoNetworksXDR.Endpoint.ip description: A list of IP addresses. - contextPath: PaloAltoNetworksXDR.Endpoint.users description: A list of users. - contextPath: PaloAltoNetworksXDR.Endpoint.domain description: The endpoint domain. - contextPath: PaloAltoNetworksXDR.Endpoint.alias description: The endpoint's aliases. - contextPath: PaloAltoNetworksXDR.Endpoint.first_seen description: First seen date/time in Epoch (milliseconds). - contextPath: PaloAltoNetworksXDR.Endpoint.last_seen description: Last seen date/time in Epoch (milliseconds). - contextPath: PaloAltoNetworksXDR.Endpoint.content_version description: Content version. - contextPath: PaloAltoNetworksXDR.Endpoint.installation_package description: Installation package. - contextPath: PaloAltoNetworksXDR.Endpoint.active_directory description: Active directory. - contextPath: PaloAltoNetworksXDR.Endpoint.install_date description: Install date in Epoch (milliseconds). - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version description: Endpoint version. - contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated description: Whether the endpoint is isolated. - contextPath: PaloAltoNetworksXDR.Endpoint.group_name description: The name of the group to which the endpoint belongs. - contextPath: PaloAltoNetworksXDR.Endpoint.count description: Number of endpoints returned. - contextPath: Endpoint.Hostname description: The hostname that is mapped to this endpoint. - contextPath: Endpoint.ID description: The unique ID within the tool retrieving the endpoint. - contextPath: Endpoint.IPAddress description: The IP address of the endpoint. - contextPath: Endpoint.Domain description: The domain of the endpoint. - contextPath: Endpoint.OS description: The endpoint's operation system. - contextPath: Endpoint.Status description: The endpoint's status. - contextPath: Endpoint.IsIsolated description: The endpoint's isolation status. - contextPath: Endpoint.MACAddress description: The endpoint's MAC address. - contextPath: Endpoint.Vendor description: The integration name of the endpoint vendor. - contextPath: MicrosoftATP.UserMachine.Username description: The username. - contextPath: MicrosoftATP.UserMachine.Machines.ID description: The machine ID. - contextPath: MicrosoftATP.UserMachine.Machines.ComputerDNSName description: The machine DNS name. - contextPath: MicrosoftATP.UserMachine.Machines.FirstSeen description: The first date and time the machine was observed by Microsoft Defender ATP. - contextPath: MicrosoftATP.UserMachine.Machines.LastSeen description: The last date and time the machine was observed by Microsoft Defender ATP. - contextPath: MicrosoftATP.UserMachine.Machines.OSPlatform description: The operating system platform. - contextPath: MicrosoftATP.UserMachine.Machines.OSVersion description: The operating system version. - contextPath: MicrosoftATP.UserMachine.Machines.OSProcessor description: The operating system processor. - contextPath: MicrosoftATP.UserMachine.Machines.LastExternalIPAddress description: The last IP through which the machine accessed the internet. - contextPath: MicrosoftATP.UserMachine.Machines.OSBuild description: The operating system build number. - contextPath: MicrosoftATP.UserMachine.Machines.HealthStatus description: The machine health status. - contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupID description: The machine RBAC group ID. - contextPath: MicrosoftATP.UserMachine.Machines.RBACGroupName description: The machine RBAC group name. - contextPath: MicrosoftATP.UserMachine.Machines.RiskScore description: The machine risk score. - contextPath: MicrosoftATP.UserMachine.Machines.ExposureLevel description: The machine exposure level. - contextPath: MicrosoftATP.UserMachine.Machines.IsAADJoined description: True if machine is AAD joined, False otherwise. - contextPath: MicrosoftATP.UserMachine.Machines.AADDeviceID description: The AAD device ID. - contextPath: MicrosoftATP.UserMachine.Machines.MachineTags description: Set of machine tags. - contextPath: MicrosoftATP.v.Machines.LastIPAddress description: The last IP on the machine. - contextPath: ServiceNow.Computer.ID description: Computer system ID. - contextPath: ServiceNow.Computer.AssetTag description: Computer asset tag. - contextPath: ServiceNow.Computer.Name description: Computer name. - contextPath: ServiceNow.Computer.DisplayName description: Computer display name. - contextPath: ServiceNow.Computer.SupportGroup description: Computer support group. - contextPath: ServiceNow.Computer.OperatingSystem description: Computer operating system. - contextPath: ServiceNow.Computer.Company description: Computer company system ID. - contextPath: ServiceNow.Computer.AssignedTo description: Computer assigned to user system ID. - contextPath: ServiceNow.Computer.State description: Computer state. - contextPath: ServiceNow.Computer.Cost description: Computer cost. - contextPath: ServiceNow.Computer.Comments description: Computer comments. - contextPath: UserDevices description: Devices retrieved by this playbook. type: unknown - contextPath: UserDevices.Name description: Devices names retrieved by this playbook. type: unknown - contextPath: UserDevices.SerialNumber description: Devices serial numbers retrieved by this playbook. type: unknown - contextPath: UserDevices.ID description: Devices IDs retrieved by this playbook. type: unknown - contextPath: UserDevices.Model description: Devices models retrieved by this playbook. type: unknown - contextPath: UserDevices.OS description: Devices operating systems retrieved by this playbook. type: unknown - contextPath: UserDevices.Integration description: The integration which retrieved the devices. type: unknown - contextPath: UserDevices.MACAddress description: Devices MAC Address retrieved by this playbook. type: unknown tests: - No tests (auto formatted) fromversion: 6.8.0 supportedModules: - cloud_runtime_security - xsiam - edr - agentix - cloud marketplaces: - xsoar - marketplacev2 - platform contentitemexportablefields: contentitemfields: {}