mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
275 lines
11 KiB
JSON
275 lines
11 KiB
JSON
{
|
|
"blockly": false,
|
|
"blockly_xml": "<xml></xml>",
|
|
"category": "Account Locking",
|
|
"coa": {
|
|
"data": {
|
|
"description": "Accepts user name that needs to be disabled in Azure Active Directory. Generates an observable output based on the status of account locking or disabling.",
|
|
"edges": [
|
|
{
|
|
"id": "port_0_to_port_2",
|
|
"sourceNode": "0",
|
|
"sourcePort": "0_out",
|
|
"targetNode": "2",
|
|
"targetPort": "2_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_2_to_port_3",
|
|
"sourceNode": "2",
|
|
"sourcePort": "2_out",
|
|
"targetNode": "3",
|
|
"targetPort": "3_in"
|
|
},
|
|
{
|
|
"id": "port_4_to_port_1",
|
|
"sourceNode": "4",
|
|
"sourcePort": "4_out",
|
|
"targetNode": "1",
|
|
"targetPort": "1_in"
|
|
},
|
|
{
|
|
"id": "port_3_to_port_5",
|
|
"sourceNode": "3",
|
|
"sourcePort": "3_out",
|
|
"targetNode": "5",
|
|
"targetPort": "5_in"
|
|
},
|
|
{
|
|
"conditions": [
|
|
{
|
|
"index": 0
|
|
}
|
|
],
|
|
"id": "port_5_to_port_4",
|
|
"sourceNode": "5",
|
|
"sourcePort": "5_out",
|
|
"targetNode": "4",
|
|
"targetPort": "4_in"
|
|
}
|
|
],
|
|
"hash": "6c58fabb2330bc8e95deed79637e55071609c19c",
|
|
"nodes": {
|
|
"0": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_start",
|
|
"id": "0",
|
|
"type": "start"
|
|
},
|
|
"errors": {},
|
|
"id": "0",
|
|
"type": "start",
|
|
"warnings": {},
|
|
"x": 19.999999999999986,
|
|
"y": -3.836930773104541e-13
|
|
},
|
|
"1": {
|
|
"data": {
|
|
"advanced": {
|
|
"join": []
|
|
},
|
|
"functionName": "on_finish",
|
|
"id": "1",
|
|
"type": "end"
|
|
},
|
|
"errors": {},
|
|
"id": "1",
|
|
"type": "end",
|
|
"warnings": {},
|
|
"x": 19.999999999999986,
|
|
"y": 860
|
|
},
|
|
"2": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "user name filter",
|
|
"customNameId": 0,
|
|
"delimiter": ",",
|
|
"delimiter_enabled": true,
|
|
"description": "Filter user name inputs to route inputs to appropriate actions.",
|
|
"join": [],
|
|
"note": "Filter user name inputs to route inputs to appropriate actions."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "!=",
|
|
"param": "playbook_input:user",
|
|
"value": ""
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "user_name_check",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 1,
|
|
"functionName": "user_name_filter",
|
|
"id": "2",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "2",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 60,
|
|
"y": 140
|
|
},
|
|
"3": {
|
|
"data": {
|
|
"action": "disable user",
|
|
"actionType": "generic",
|
|
"advanced": {
|
|
"customName": "disable user account",
|
|
"customNameId": 0,
|
|
"description": "Disable the user attributes for filtered playbook inputs.",
|
|
"join": [],
|
|
"note": "Disable the user attributes for filtered playbook inputs."
|
|
},
|
|
"connector": "Azure AD Graph",
|
|
"connectorConfigs": [
|
|
"azure_ad_graph"
|
|
],
|
|
"connectorId": "c6d3b801-5c26-4abd-9e89-6d8007e2778f",
|
|
"connectorVersion": "v1",
|
|
"functionId": 1,
|
|
"functionName": "disable_user_account",
|
|
"id": "3",
|
|
"parameters": {
|
|
"user_id": "filtered-data:user_name_filter:condition_1:playbook_input:user"
|
|
},
|
|
"requiredParameters": [
|
|
{
|
|
"data_type": "string",
|
|
"field": "user_id"
|
|
}
|
|
],
|
|
"type": "action"
|
|
},
|
|
"errors": {},
|
|
"id": "3",
|
|
"type": "action",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 320
|
|
},
|
|
"4": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "username observables",
|
|
"customNameId": 0,
|
|
"description": "Format a normalized output for each user.",
|
|
"join": [],
|
|
"note": "Format a normalized output for each user."
|
|
},
|
|
"functionId": 1,
|
|
"functionName": "username_observables",
|
|
"id": "4",
|
|
"inputParameters": [
|
|
"filtered-data:filter_disable_result:condition_1:disable_user_account:action_result.parameter.user_id",
|
|
"filtered-data:filter_disable_result:condition_1:disable_user_account:action_result.status",
|
|
"filtered-data:filter_disable_result:condition_1:disable_user_account:action_result.message"
|
|
],
|
|
"outputVariables": [
|
|
"observable_array"
|
|
],
|
|
"type": "code"
|
|
},
|
|
"errors": {},
|
|
"id": "4",
|
|
"type": "code",
|
|
"userCode": "\n # Write your custom code here...\n username_observables__observable_array = []\n \n for user_id, status, msg in zip(filtered_result_0_parameter_user_id, filtered_result_0_status, filtered_result_0_message):\n user_acc_status = {\n \"type\": \"Azure AD Account\",\n \"value\": user_id,\n \"message\": msg,\n \"status\": status\n }\n username_observables__observable_array.append(user_acc_status)\n #phantom.debug(username_observables__observable_array)\n",
|
|
"warnings": {},
|
|
"x": 0,
|
|
"y": 680
|
|
},
|
|
"5": {
|
|
"data": {
|
|
"advanced": {
|
|
"customName": "filter disable result",
|
|
"customNameId": 0,
|
|
"delimiter": ",",
|
|
"delimiter_enabled": true,
|
|
"description": "filter check if the user is disabled successfully.",
|
|
"join": [],
|
|
"note": "filter check if the user is disabled successfully."
|
|
},
|
|
"conditions": [
|
|
{
|
|
"comparisons": [
|
|
{
|
|
"conditionIndex": 0,
|
|
"op": "==",
|
|
"param": "disable_user_account:action_result.status",
|
|
"value": "success"
|
|
}
|
|
],
|
|
"conditionIndex": 0,
|
|
"customName": "disabled_success",
|
|
"logic": "and"
|
|
}
|
|
],
|
|
"functionId": 2,
|
|
"functionName": "filter_disable_result",
|
|
"id": "5",
|
|
"type": "filter"
|
|
},
|
|
"errors": {},
|
|
"id": "5",
|
|
"type": "filter",
|
|
"warnings": {},
|
|
"x": 60,
|
|
"y": 500
|
|
}
|
|
},
|
|
"notes": "Inputs: users\nInteractions: Azure AD Graph\nActions: Account Locking/Disabling\nOutputs: observables"
|
|
},
|
|
"input_spec": [
|
|
{
|
|
"contains": [
|
|
"user name",
|
|
"azure user principal name"
|
|
],
|
|
"description": "A user name provided to be disable - Azure AD",
|
|
"name": "user"
|
|
}
|
|
],
|
|
"output_spec": [
|
|
{
|
|
"contains": [],
|
|
"datapaths": [
|
|
"username_observables:custom_function:observable_array"
|
|
],
|
|
"deduplicate": false,
|
|
"description": "An array of observable dictionaries ",
|
|
"metadata": {},
|
|
"name": "observable"
|
|
}
|
|
],
|
|
"playbook_type": "data",
|
|
"python_version": "3.13",
|
|
"schema": "5.0.10",
|
|
"version": "6.0.1.123902"
|
|
},
|
|
"create_time": "2023-08-17T18:47:08.503246+00:00",
|
|
"draft_mode": false,
|
|
"labels": [
|
|
"*"
|
|
],
|
|
"tags": [
|
|
"user",
|
|
"azure_ad_graph",
|
|
"disable_account",
|
|
"D3-AL",
|
|
"active_directory"
|
|
]
|
|
} |