Microsoft Endpoint Configuration Manager

Overview

The configuration manager provides the overall Configuration Management (CM) infrastructure and environment to the product development team (formerly known as SCCM).

This integration was integrated and tested with version 1906 of Microsoft Endpoint Configuration Manager.

Prerequisites

  • This integration requires root access in order to execute commands. If you configured the server to run Docker images with a non-root internal user make sure to exclude the demisto/powershell-ubuntu Docker image as documented here
  • Installation and configuration for Windows Remote Management to support a PowerShell session is a prerequisite in order to support this integration. For more information, refer to the following Microsoft Article.
  • PowerShell Remote sessions are created over port 5985 (Microsoft Web service management/WinRm). This port needs to be opened from XSOAR to the hosts on the local and network firewalls.
  • Authentication is NTLM-based.
  • The integration requires a valid domain user with the permission set needed to perform the required remote tasks.

Configure Microsoft Endpoint Configuration Manager on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Microsoft Endpoint Configuration Manager.
  3. Click Add instance to create and configure a new integration instance.
ParameterDescriptionRequired
ComputerNameECM Server URL (e.g., 192.168.64.128)True
credentialsUsername (i.e, DOMAIN\username)True
SiteCodeECM Site CodeTrue
  1. Click Test to validate the ComputerName, credentials, and connection.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

ms-ecm-user-last-log-on


Gets the last user that logged on to a given computer name

Base Command

ms-ecm-user-last-log-on

Input

Argument NameDescriptionRequired
device_nameSpecifies the name of a device.Required

Context Output

PathTypeDescription
MicrosoftECM.LastLogOnUser.CreationDatedateThe date the computer was created
MicrosoftECM.LastLogOnUser.IPstringThe IP of the computer
MicrosoftECM.LastLogOnUser.LastLogonTimestampdateThe date of the last login to the computer
MicrosoftECM.LastLogOnUser.LastLogonUserNamestringThe name of the last user who logged in to the computer
MicrosoftECM.LastLogOnUser.NamestringThe name of the computer

Command Example

!ms-ecm-user-last-log-on device_name=EC2AMAZ-2AKQ815

Context Example

{
"MicrosoftECM": {
"LastLogOnUser": {
"CreationDate": "2019-12-07T10:07:51Z",
"IP": "172.1.1.1 fe80::81c5:1670:9363:a40b ",
"LastLogonTimestamp": "2020-41-23T04:09:37Z",
"LastLogonUserName": null,
"Name": "EC2AMAZ-2AKQ815"
}
}
}

Human Readable Output

Last log gon user on EC2AMAZ-2AKQ815

CreationDateIPNameLastLogonTimestampLastLogonUserName
2019-12-07T10:07:51Z172.1.1.1 fe80::81c5:1670:9363:a40bEC2AMAZ-2AKQ8152020-41-23T04:09:37Z

ms-ecm-user-get-primary


Get the primary user of a given computer name

Base Command

ms-ecm-user-get-primary

Input

Argument NameDescriptionRequired
device_nameSpecifies the name of a device.Required

Context Output

PathTypeDescription
MicrosoftECM.PrimaryUsers.MachineNamestringThe name of the computer
MicrosoftECM.PrimaryUsers.UserNamestringThe name of the primary user

Command Example

!ms-ecm-user-get-primary device_name=EC2AMAZ-2AKQ815

Context Example

{
"MicrosoftECM": {
"PrimaryUsers": {
"MachineName": "EC2AMAZ-2AKQ815",
"UserName": "demisto\\sccmadmin"
}
}
}

Human Readable Output

Primary users on EC2AMAZ-2AKQ815

MachineNameUserName
EC2AMAZ-2AKQ815demisto\sccmadmin

ms-ecm-collection-list


Gets a Configuration Manager collection

Base Command

ms-ecm-collection-list

Input

Argument NameDescriptionRequired
collection_typeSpecifies a type for the collection. Valid values are: Root User Device UnknownRequired
collection_idSpecifies a collection ID. If you do not specify a collection, all collections in the hierarchy are returned (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameSpecifies a collection name. If you do not specify a collection, all collections in the hierarchy are returned (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional

Context Output

PathTypeDescription
MicrosoftECM.Collections.NamestringThe collection's name
MicrosoftECM.Collections.IDstringUnique auto-generated ID containing eight characters. The default value is ""
MicrosoftECM.Collections.TypestringThe type of the collection
MicrosoftECM.Collections.CommentstringGeneral comment or note that documents the collection
MicrosoftECM.Collections.CurrentStatusstringCurrent status of the collection
MicrosoftECM.Collections.HasProvisionedMemberbooleantrue if this collection has provisioned members.
MicrosoftECM.Collections.IncludeExcludeCollectionsCountnumberCount of collections that are included and excluded with this one.
MicrosoftECM.Collections.IsBuiltInbooleanThis value, when set to true, denotes that the collection is built in.
MicrosoftECM.Collections.IsReferenceCollectionbooleanThis value, when set to true, denotes that the collection is not limited by another collection.
MicrosoftECM.Collections.LastChangeTimedateDate and time of when the collection was last altered in any way.
MicrosoftECM.Collections.LastMemberChangeTimedateDate and time of when the collection membership was last altered.
MicrosoftECM.Collections.LastRefreshTimedateDate and time of when the collection membership was last refreshed.
MicrosoftECM.Collections.LimitToCollectionIDstringThe CollectionID of the collection to limit the query results to.
MicrosoftECM.Collections.LimitToCollectionNamestringThe Name of the collection to limit the query results to.
MicrosoftECM.Collections.LocalMemberCountnumberCount of members visible at the local site.
MicrosoftECM.Collections.MemberClassNamestringClass name having instances that are the members of the collection
MicrosoftECM.Collections.MemberCountnumberA count of the collection members.
MicrosoftECM.Collections.UseClusterbooleanSpecifies that this collection is a server group.
MicrosoftECM.Collections.CollectionRulesstringName of the defining membership criteria for the collection

Command Example

!ms-ecm-collection-list collection_name="All Systems" collection_type=Device

Context Example

{
"MicrosoftECM": {
"Collections": {
"CollectionRules": [
"\ninstance of SMS_CollectionRuleQuery\n{\n\tQueryExpression = \"select * from sms_r_system\";\n\tQueryID = 1;\n\tRuleName = \"All Systems\";\n};",
"\ninstance of SMS_CollectionRuleQuery\n{\n\tQueryExpression = \"select SMS_R_UNKNOWNSYSTEM.ResourceID,SMS_R_UNKNOWNSYSTEM.ResourceType,SMS_R_UNKNOWNSYSTEM.Name,SMS_R_UNKNOWNSYSTEM.Name,SMS_R_UNKNOWNSYSTEM.Name from SMS_R_UnknownSystem\";\n\tQueryID = 2;\n\tRuleName = \"All Unknown Computers\";\n};\n"
],
"Comment": "All Systems",
"CurrentStatus": null,
"HasProvisionedMember": "True",
"ID": "SMS00001",
"IncludeExcludeCollectionsCount": "0",
"IsBuiltIn": "True",
"IsReferenceCollection": "True",
"LastChangeTime": "2019-07-17T14:04:58Z",
"LastMemberChangeTime": "2019-15-07T10:07:35Z",
"LastRefreshTime": "2020-00-29T04:09:39Z",
"LimitToCollectionID": "",
"LimitToCollectionName": "",
"LocalMemberCount": "5",
"MemberClassName": "SMS_CM_RES_COLL_SMS00001",
"MemberCount": "5",
"Name": "All Systems",
"Type": null,
"UseCluster": "False"
}
}
}

Human Readable Output

Collection List

NameIDTypeCommentCurrentStatusCollectionRulesHasProvisionedMemberIncludeExcludeCollectionsCountIsBuiltInIsReferenceCollectionLastChangeTimeLastMemberChangeTimeLastRefreshTimeLimitToCollectionIDLimitToCollectionNameLocalMemberCountMemberClassNameMemberCountUseCluster
All SystemsSMS00001All Systems
instance of SMS_CollectionRuleQuery
{
QueryExpression = "select * from sms_r_system";
QueryID = 1;
RuleName = "All Systems";
};
,
instance of SMS_CollectionRuleQuery
{
QueryExpression = "select SMS_R_UNKNOWNSYSTEM.ResourceID,SMS_R_UNKNOWNSYSTEM.ResourceType,SMS_R_UNKNOWNSYSTEM.Name,SMS_R_UNKNOWNSYSTEM.Name,SMS_R_UNKNOWNSYSTEM.Name from SMS_R_UnknownSystem";
QueryID = 2;
RuleName = "All Unknown Computers";
};
True0TrueTrue2019-07-17T14:04:58Z2019-15-07T10:07:35Z2020-00-29T04:09:39Z5SMS_CM_RES_COLL_SMS000015False

ms-ecm-device-list


Gets a Configuration Manager device

Base Command

ms-ecm-device-list

Input

Argument NameDescriptionRequired
collection_idSpecifies an ID for a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameSpecifies the name of a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
device_nameSpecifies the name of the device (can be retrived via !ms-ecm-device-list)Optional
resource_idSpecifies the resource ID of a device (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional

Context Output

PathTypeDescription
MicrosoftECM.Devices.NamestringThe name of the device
MicrosoftECM.Devices.ClientVersionstringVersion of the installed client software
MicrosoftECM.Devices.CurrentLogonUserstringThe current logged on user
MicrosoftECM.Devices.DeviceCategorystringCategory of the device
MicrosoftECM.Devices.DeviceOS.DeviceOSBuildstringDevice operating system
MicrosoftECM.Devices.DeviceOSBuildstringDevice operating system build
MicrosoftECM.Devices.DomainstringDomain to which the device belongs
MicrosoftECM.Devices.IsActivebooleantrue if there has been a recent heartbeat from the client.
MicrosoftECM.Devices.LastActiveTimedateComes from Client Health. Represents the last reported time the client was active.
MicrosoftECM.Devices.LastHardwareScandateTimestamp from the last hardware inventory scan
MicrosoftECM.Devices.LastInstallationErrordateLast reported error code from the installation on this client.
MicrosoftECM.Devices.LastLogonUserstringLast logged on user
MicrosoftECM.Devices.LastMPServerNamestringManagement Point server name where the client performed its last policy request.
MicrosoftECM.Devices.MACAddressstringThe MAC address of the device
MicrosoftECM.Devices.PrimaryUserstringUsers who have user-device-affinity with this device
MicrosoftECM.Devices.ResourceIDnumberUnique Configuration Manager-supplied ID for the resource.
MicrosoftECM.Devices.SiteCodestringSite code of the site that created the collection.
MicrosoftECM.Devices.StatusstringCurrent status

Command Example

!ms-ecm-device-list

Context Example

{
"MicrosoftECM": {
"Devices": [
{
"ClientVersion": "5.00.8790.1007",
"CurrentLogonUser": null,
"DeviceAccessState": null,
"DeviceCategory": null,
"DeviceOS": "Microsoft Windows NT Advanced Server 10.0",
"DeviceOSBuild": "10.0.14393.3025",
"Domain": "DEMISTO",
"IsActive": "True",
"LastActiveTime": "2020-26-29T13:09:53Z",
"LastHardwareScan": "2020-31-27T14:09:34Z",
"LastInstallationError": null,
"LastLogonUser": null,
"LastMPServerName": "EC2AMAZ-PHPTDJV.DEMISTO.LOCAL",
"MACAddress": "06:0D:64:90:63:4A",
"Name": "EC2AMAZ-2AKQ815",
"PrimaryUser": "demisto\\sccmadmin",
"ResourceID": 16777220,
"SiteCode": "ISR",
"Status": null
}
]
}
}

Human Readable Output

Devices List

NameClientVersionCurrentLogonUserDeviceAccessStateDeviceCategoryDeviceOSDeviceOSBuildDomainIsActiveLastActiveTimeLastHardwareScanLastInstallationErrorLastLogonUserLastMPServerNameMACAddressPrimaryUserResourceIDSiteCodeStatus
EC2AMAZ-2AKQ8155.00.8790.1007Microsoft Windows NT Advanced Server 10.010.0.14393.3025DEMISTOTrue2020-26-29T13:09:53Z2020-31-27T14:09:34ZEC2AMAZ-PHPTDJV.DEMISTO.LOCAL06:0D:64:90:63:4Ademisto\sccmadmin16777220ISR

ms-ecm-script-list


Gets Configuration Manager PowerShell scripts

Base Command

ms-ecm-script-list

Input

Argument NameDescriptionRequired
authorSpecifies the author of the script (can be retrived via !ms-ecm-script-list)Optional
script_nameSpecifies a script name (can be retrived via !ms-ecm-script-list)Optional

Context Output

PathTypeDescription
MicrosoftECM.Scripts.ApprovalStatestringThe approval state of the script
MicrosoftECM.Scripts.ApproverstringThe approver of the script
MicrosoftECM.Scripts.AuthorstringThe author of the script
MicrosoftECM.Scripts.CommentstringA short comment about the script
MicrosoftECM.Scripts.LastUpdateTimedateThe date of the last script upda
MicrosoftECM.Scripts.ParameterliststringThe parameter list of the script
MicrosoftECM.Scripts.ScriptstringThe code of the script
MicrosoftECM.Scripts.ScriptGuidstringThe unique identifier of the script
MicrosoftECM.Scripts.ScriptHashstringThe hash of the script
MicrosoftECM.Scripts.ScriptHashAlgorithmstringThe algorithm with which the script hash was generated
MicrosoftECM.Scripts.ScriptNamestringThe name of the script
MicrosoftECM.Scripts.ScriptTypestringThe type of the script
MicrosoftECM.Scripts.ScriptVersionnumberThe version of the script

Command Example

!ms-ecm-script-list script_name="XSOAR StartService"

Context Example

{
"MicrosoftECM": {
"Scripts": {
"ApprovalState": null,
"Approver": "DEMISTO\\sccmadmin",
"Author": "DEMISTO\\sccmadmin",
"Comment": "XSOAR StartService script",
"LastUpdateTime": "2020-38-24T09:09:31Z",
"Parameterlist": null,
"Script": "\ufffd\ufffdGet-Service dnscache | Start-Service -PassThru -ErrorAction Stop",
"ScriptGuid": "7C9940D7-BC42-421D-AAF7-F851425A0D85",
"ScriptHash": "641A7B75566E330AFFBAD979DE33E1C89E3B7623680233BA324765C042FC5860",
"ScriptHashAlgorithm": "SHA256",
"ScriptName": "XSOAR StartService",
"ScriptType": 0,
"ScriptVersion": "1"
}
}
}

Human Readable Output

Scripts List

ApprovalStateApproverAuthorCommentLastUpdateTimeParameterlistScriptScriptGuidScriptHashScriptHashAlgorithmScriptNameScriptTypeScriptVersion
DEMISTO\sccmadminDEMISTO\sccmadminXSOAR StartService script2020-38-24T09:09:31Z��Get-Service dnscache | Start-Service -PassThru -ErrorAction Stop7C9940D7-BC42-421D-AAF7-F851425A0D85641A7B75566E330AFFBAD979DE33E1C89E3B7623680233BA324765C042FC5860SHA256XSOAR StartService1

ms-ecm-script-create


create new powershell script

Base Command

ms-ecm-script-create

Input

Argument NameDescriptionRequired
script_file_entry_idThe Entry ID of the script fileOptional
script_textThe text of the stringOptional
script_nameThe name of the scriptRequired

Context Output

PathTypeDescription
MicrosoftECM.Scripts.ApprovalStatestringThe approval state of the script
MicrosoftECM.Scripts.ApproverstringThe approver of the script
MicrosoftECM.Scripts.AuthorstringThe author of the script
MicrosoftECM.Scripts.CommentstringA short comment about the script
MicrosoftECM.Scripts.LastUpdateTimedateThe date of the last script upda
MicrosoftECM.Scripts.ParameterliststringThe parameter list of the script
MicrosoftECM.Scripts.ScriptstringThe code of the script
MicrosoftECM.Scripts.ScriptGuidstringThe unique identifier of the script
MicrosoftECM.Scripts.ScriptHashstringThe hash of the script
MicrosoftECM.Scripts.ScriptHashAlgorithmstringThe algorithm with which the script hash was generated
MicrosoftECM.Scripts.ScriptNamestringThe name of the script
MicrosoftECM.Scripts.ScriptTypestringThe type of the script
MicrosoftECM.Scripts.ScriptVersionnumberThe version of the script

Command Example

!ms-ecm-script-create script_name="My new script" script_text="$PSVersionTable"

Context Example

{
"MicrosoftECM": {
"Scripts": {
"ApprovalState": null,
"Approver": "",
"Author": "DEMISTO\\sccmadmin",
"Comment": "",
"LastUpdateTime": "2020-12-29T15:09:18Z",
"Parameterlist": null,
"Script": "\ufffd\ufffd$PSVersionTable",
"ScriptGuid": "D00E9486-B062-422B-9D84-26415DE563CC",
"ScriptHash": "CE09E98D654CF613A0D219B744B56392E8356430534F309F715960E45A1417F8",
"ScriptHashAlgorithm": "SHA256",
"ScriptName": "My new script",
"ScriptType": 0,
"ScriptVersion": "1"
}
}
}

Human Readable Output

Scripts List

ApprovalStateApproverAuthorCommentLastUpdateTimeParameterlistScriptScriptGuidScriptHashScriptHashAlgorithmScriptNameScriptTypeScriptVersion
DEMISTO\sccmadmin2020-12-29T15:09:18Z��$PSVersionTableD00E9486-B062-422B-9D84-26415DE563CCCE09E98D654CF613A0D219B744B56392E8356430534F309F715960E45A1417F8SHA256My new script1

ms-ecm-script-invoke


Invokes a script in Configuration Manager

Base Command

ms-ecm-script-invoke

Input

Argument NameDescriptionRequired
script_guidSpecifies the script ID (can be retrived via !ms-ecm-script-list)Required
collection_idSpecifies the collection ID (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameSpecifies the collection name (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
device_nameSpecifies a device name in Configuration ManagerOptional

Context Output

PathTypeDescription
MicrosoftECM.ScriptsInvocation.OperationIDnumberThe unique Id of the script operation
MicrosoftECM.ScriptsInvocation.ReturnValuenumberThe Return value of the script operation, 0 upon success

Command Example

!ms-ecm-script-invoke script_guid=394EDB29-5D89-4B9B-9745-A1F6DC8214E2 collection_name="All Systems"

Context Example

{
"MicrosoftECM": {
"ScriptsInvocation": {
"OperationID": 16777274,
"ReturnValue": "0"
}
}
}

Human Readable Output

Script Invocation Result

OperationIDReturnValue
167772740

ms-ecm-script-approve


Approves a Configuration Manager PowerShell script

Base Command

ms-ecm-script-approve

Input

Argument NameDescriptionRequired
commentSpecifies a comment about the approval of the scriptRequired
script_guidSpecifies the script ID (can be retrived via !ms-ecm-script-list)Required

Context Output

There is no context output for this command.

Command Example

!ms-ecm-script-approve comment="Some comment" script_guid=394EDB29-5D89-4B9B-9745-A1F6DC8214E2

Human Readable Output

Script was approved successfully

ms-ecm-device-collection-create


Creates a Configuration Manager collection

Base Command

ms-ecm-device-collection-create

Input

Argument NameDescriptionRequired
commentSpecifies a comment for the collectionRequired
collection_nameSpecifies a name for the collectionRequired
limiting_collection_nameSpecifies the name of a collection to use as a scope for this collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Required

Context Output

PathTypeDescription
MicrosoftECM.Collections.NamestringThe collection's name
MicrosoftECM.Collections.IDstringUnique auto-generated ID containing eight characters.
MicrosoftECM.Collections.TypestringThe type of the collection
MicrosoftECM.Collections.CommentstringGeneral comment or note that documents the collection
MicrosoftECM.Collections.CurrentStatusstringCurrent status of the collection
MicrosoftECM.Collections.HasProvisionedMemberbooleantrue if this collection has provisioned members.
MicrosoftECM.Collections.IncludeExcludeCollectionsCountnumberCount of collections that are included and excluded with this one.
MicrosoftECM.Collections.IsBuiltInbooleanThis value, when set to true, denotes that the collection is built in.
MicrosoftECM.Collections.IsReferenceCollectionbooleanThis value, when set to true, denotes that the collection is not limited by another collection.
MicrosoftECM.Collections.LastChangeTimedateDate and time of when the collection was last altered in any way.
MicrosoftECM.Collections.LastMemberChangeTimedateDate and time of when the collection membership was last altered.
MicrosoftECM.Collections.LastRefreshTimedateDate and time of when the collection membership was last refreshed.
MicrosoftECM.Collections.LimitToCollectionIDstringThe CollectionID of the collection to limit the query results to.
MicrosoftECM.Collections.LimitToCollectionNamestringThe Name of the collection to limit the query results to.
MicrosoftECM.Collections.LocalMemberCountnumberCount of members visible at the local site.
MicrosoftECM.Collections.MemberClassNamestringClass name having instances that are the members of the collection
MicrosoftECM.Collections.MemberCountnumberA count of the collection members.
MicrosoftECM.Collections.UseClusterbooleanSpecifies that this collection is a server group.
MicrosoftECM.Collections.CollectionRulesstringName of the defining membership criteria for the collection

Command Example

!ms-ecm-device-collection-create collection_name="my new collection name" comment="my collection comment" limiting_collection_name="All Systems"

Context Example

{
"MicrosoftECM": {
"Collections": {
"CollectionRules": [
""
],
"Comment": "my collection comment",
"CurrentStatus": null,
"HasProvisionedMember": "False",
"ID": "ISR0001F",
"IncludeExcludeCollectionsCount": "0",
"IsBuiltIn": "False",
"IsReferenceCollection": "False",
"LastChangeTime": "2020-11-29T15:09:46Z",
"LastMemberChangeTime": "1980-00-01T00:01:00Z",
"LastRefreshTime": "1980-00-01T00:01:00Z",
"LimitToCollectionID": "SMS00001",
"LimitToCollectionName": "All Systems",
"LocalMemberCount": "0",
"MemberClassName": "SMS_CM_RES_COLL_ISR0001F",
"MemberCount": "0",
"Name": "my new collection name",
"Type": null,
"UseCluster": "False"
}
}
}

Human Readable Output

Collection List

NameIDTypeCommentCurrentStatusCollectionRulesHasProvisionedMemberIncludeExcludeCollectionsCountIsBuiltInIsReferenceCollectionLastChangeTimeLastMemberChangeTimeLastRefreshTimeLimitToCollectionIDLimitToCollectionNameLocalMemberCountMemberClassNameMemberCountUseCluster
my new collection nameISR0001Fmy collection commentFalse0FalseFalse2020-11-29T15:09:46Z1980-00-01T00:01:00Z1980-00-01T00:01:00ZSMS00001All Systems0SMS_CM_RES_COLL_ISR0001F0False

ms-ecm-device-collection-members-add


Adds a Direct Rule membership to a device collection

Base Command

ms-ecm-device-collection-members-add

Input

Argument NameDescriptionRequired
collection_idSpecifies the ID of a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameSpecifies the name of a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
device_resource_idsA comma seperated list of devices resource IDs (can be retrived via !ms-ecm-device-list)Required

Context Output

PathTypeDescription
MicrosoftECM.Collections.NamestringThe collection's name
MicrosoftECM.Collections.IDstringUnique auto-generated ID containing eight characters. The default value is ""
MicrosoftECM.Collections.TypestringThe type of the collection
MicrosoftECM.Collections.CommentstringGeneral comment or note that documents the collection
MicrosoftECM.Collections.CurrentStatusstringCurrent status of the collection
MicrosoftECM.Collections.HasProvisionedMemberbooleantrue if this collection has provisioned members.
MicrosoftECM.Collections.IncludeExcludeCollectionsCountnumberCount of collections that are included and excluded with this one.
MicrosoftECM.Collections.IsBuiltInbooleanThis value, when set to true, denotes that the collection is built in.
MicrosoftECM.Collections.IsReferenceCollectionbooleanThis value, when set to true, denotes that the collection is not limited by another collection.
MicrosoftECM.Collections.LastChangeTimedateDate and time of when the collection was last altered in any way.
MicrosoftECM.Collections.LastMemberChangeTimedateDate and time of when the collection membership was last altered.
MicrosoftECM.Collections.LastRefreshTimedateDate and time of when the collection membership was last refreshed.
MicrosoftECM.Collections.LimitToCollectionIDstringThe CollectionID of the collection to limit the query results to.
MicrosoftECM.Collections.LimitToCollectionNamestringThe Name of the collection to limit the query results to.
MicrosoftECM.Collections.LocalMemberCountnumberCount of members visible at the local site.
MicrosoftECM.Collections.MemberClassNamestringClass name having instances that are the members of the collection
MicrosoftECM.Collections.MemberCountnumberA count of the collection members.
MicrosoftECM.Collections.UseClusterbooleanA comma separated list of resource IDs e.g 0001,0002
MicrosoftECM.Collections.CollectionRulesstringName of the defining membership criteria for the collection

Command Example

!ms-ecm-device-collection-members-add device_resource_ids=16777220 collection_name="my new collection name"

Context Example

{
"MicrosoftECM": {
"Collections": {
"CollectionRules": [
"\ninstance of SMS_CollectionRuleDirect\n{\n\tResourceClassName = \"SMS_R_System\";\n\tResourceID = 16777220;\n\tRuleName = \"EC2AMAZ-2AKQ815\";\n};",
"\ninstance of SMS_CollectionRuleExcludeCollection\n{\n\tExcludeCollectionID = \"ISR00014\";\n\tRuleName = \"Test\";\n};\n"
],
"Comment": "my collection comment",
"CurrentStatus": null,
"HasProvisionedMember": "False",
"ID": "ISR0001F",
"IncludeExcludeCollectionsCount": "1",
"IsBuiltIn": "False",
"IsReferenceCollection": "False",
"LastChangeTime": "2020-11-29T15:09:55Z",
"LastMemberChangeTime": "2020-11-29T15:09:53Z",
"LastRefreshTime": "2020-11-29T15:09:53Z",
"LimitToCollectionID": "SMS00001",
"LimitToCollectionName": "All Systems",
"LocalMemberCount": "0",
"MemberClassName": "SMS_CM_RES_COLL_ISR0001F",
"MemberCount": "0",
"Name": "my new collection name",
"Type": null,
"UseCluster": "False"
}
}
}

Human Readable Output

Collection List

NameIDTypeCommentCurrentStatusCollectionRulesHasProvisionedMemberIncludeExcludeCollectionsCountIsBuiltInIsReferenceCollectionLastChangeTimeLastMemberChangeTimeLastRefreshTimeLimitToCollectionIDLimitToCollectionNameLocalMemberCountMemberClassNameMemberCountUseCluster
my new collection nameISR0001Fmy collection comment
instance of SMS_CollectionRuleDirect
{
ResourceClassName = "SMS_R_System";
ResourceID = 16777220;
RuleName = "EC2AMAZ-2AKQ815";
};
,
instance of SMS_CollectionRuleExcludeCollection
{
ExcludeCollectionID = "ISR00014";
RuleName = "Test";
};
False1FalseFalse2020-11-29T15:09:55Z2020-11-29T15:09:53Z2020-11-29T15:09:53ZSMS00001All Systems0SMS_CM_RES_COLL_ISR0001F0False

ms-ecm-device-collection-include


Adds an Include Collections membership rule to a device collection

Base Command

ms-ecm-device-collection-include

Input

Argument NameDescriptionRequired
collection_idSpecifies the ID of a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameSpecifies the name of a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
include_collection_idSpecifies the ID of a device collection to include in the membership rule (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
include_collection_nameSpecifies the name of a device collection to include in the membership rule (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional

Context Output

PathTypeDescription
MicrosoftECM.Collections.NamestringThe collection's name
MicrosoftECM.Collections.IDstringUnique auto-generated ID containing eight characters. The default value is ""
MicrosoftECM.Collections.TypestringThe type of the collection
MicrosoftECM.Collections.CommentstringGeneral comment or note that documents the collection
MicrosoftECM.Collections.CurrentStatusstringCurrent status of the collection
MicrosoftECM.Collections.HasProvisionedMemberbooleantrue if this collection has provisioned members.
MicrosoftECM.Collections.IncludeExcludeCollectionsCountnumberCount of collections that are included and excluded with this one.
MicrosoftECM.Collections.IsBuiltInbooleanThis value, when set to true, denotes that the collection is built in.
MicrosoftECM.Collections.IsReferenceCollectionbooleanThis value, when set to true, denotes that the collection is not limited by another collection.
MicrosoftECM.Collections.LastChangeTimedateDate and time of when the collection was last altered in any way.
MicrosoftECM.Collections.LastMemberChangeTimedateDate and time of when the collection membership was last altered.
MicrosoftECM.Collections.LastRefreshTimedateDate and time of when the collection membership was last refreshed.
MicrosoftECM.Collections.LimitToCollectionIDstringThe CollectionID of the collection to limit the query results to.
MicrosoftECM.Collections.LimitToCollectionNamestringThe Name of the collection to limit the query results to.
MicrosoftECM.Collections.LocalMemberCountnumberCount of members visible at the local site.
MicrosoftECM.Collections.MemberClassNamestringClass name having instances that are the members of the collection
MicrosoftECM.Collections.MemberCountnumberA count of the collection members.
MicrosoftECM.Collections.UseClusterbooleanA comma separated list of resource IDs e.g 0001,0002
MicrosoftECM.Collections.CollectionRulesstringName of the defining membership criteria for the collection

Command Example

Human Readable Output

ms-ecm-device-collection-exclude


Adds an exclude membership rule to one or more Configuration Manager device collections.

Base Command

ms-ecm-device-collection-exclude

Input

Argument NameDescriptionRequired
collection_idSpecifies the ID of a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameSpecifies the name of a device collection (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
exclude_collection_idSpecifies the ID of a device collection to exclude from the membership rule (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
exclude_collection_nameSpecifies the name of a device collection to exclude from the membership rule (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional

Context Output

PathTypeDescription
MicrosoftECM.Collections.NamestringThe collection's name
MicrosoftECM.Collections.IDstringUnique auto-generated ID containing eight characters. The default value is ""
MicrosoftECM.Collections.TypestringThe type of the collection
MicrosoftECM.Collections.CommentstringGeneral comment or note that documents the collection
MicrosoftECM.Collections.CurrentStatusstringCurrent status of the collection
MicrosoftECM.Collections.HasProvisionedMemberbooleantrue if this collection has provisioned members.
MicrosoftECM.Collections.IncludeExcludeCollectionsCountnumberCount of collections that are included and excluded with this one.
MicrosoftECM.Collections.IsBuiltInbooleanThis value, when set to true, denotes that the collection is built in.
MicrosoftECM.Collections.IsReferenceCollectionbooleanThis value, when set to true, denotes that the collection is not limited by another collection.
MicrosoftECM.Collections.LastChangeTimedateDate and time of when the collection was last altered in any way.
MicrosoftECM.Collections.LastMemberChangeTimedateDate and time of when the collection membership was last altered.
MicrosoftECM.Collections.LastRefreshTimedateDate and time of when the collection membership was last refreshed.
MicrosoftECM.Collections.LimitToCollectionIDstringThe CollectionID of the collection to limit the query results to.
MicrosoftECM.Collections.LimitToCollectionNamestringThe Name of the collection to limit the query results to.
MicrosoftECM.Collections.LocalMemberCountnumberCount of members visible at the local site.
MicrosoftECM.Collections.MemberClassNamestringClass name having instances that are the members of the collection
MicrosoftECM.Collections.MemberCountnumberA count of the collection members.
MicrosoftECM.Collections.UseClusterbooleanA comma separated list of resource IDs e.g 0001,0002
MicrosoftECM.Collections.CollectionRulesstringName of the defining membership criteria for the collection

Command Example

!ms-ecm-device-collection-exclude collection_name="my new collection name" exclude_collection_name="Test"

Context Example

{
"MicrosoftECM": {
"Collections": {
"CollectionRules": [
"\ninstance of SMS_CollectionRuleExcludeCollection\n{\n\tExcludeCollectionID = \"ISR00014\";\n\tRuleName = \"Test\";\n};\n"
],
"Comment": "my collection comment",
"CurrentStatus": null,
"HasProvisionedMember": "False",
"ID": "ISR0001F",
"IncludeExcludeCollectionsCount": "0",
"IsBuiltIn": "False",
"IsReferenceCollection": "False",
"LastChangeTime": "2020-11-29T15:09:46Z",
"LastMemberChangeTime": "2020-11-29T15:09:53Z",
"LastRefreshTime": "2020-11-29T15:09:53Z",
"LimitToCollectionID": "SMS00001",
"LimitToCollectionName": "All Systems",
"LocalMemberCount": "0",
"MemberClassName": "SMS_CM_RES_COLL_ISR0001F",
"MemberCount": "0",
"Name": "my new collection name",
"Type": null,
"UseCluster": "False"
}
}
}

Human Readable Output

Collection List

NameIDTypeCommentCurrentStatusCollectionRulesHasProvisionedMemberIncludeExcludeCollectionsCountIsBuiltInIsReferenceCollectionLastChangeTimeLastMemberChangeTimeLastRefreshTimeLimitToCollectionIDLimitToCollectionNameLocalMemberCountMemberClassNameMemberCountUseCluster
my new collection nameISR0001Fmy collection comment
instance of SMS_CollectionRuleExcludeCollection
{
ExcludeCollectionID = "ISR00014";
RuleName = "Test";
};
False0FalseFalse2020-11-29T15:09:46Z2020-11-29T15:09:53Z2020-11-29T15:09:53ZSMS00001All Systems0SMS_CM_RES_COLL_ISR0001F0False

ms-ecm-device-collection-members-by-query-add


Adds a query membership rule to one or more Configuration Manager device collections

Base Command

ms-ecm-device-collection-members-by-query-add

Input

Argument NameDescriptionRequired
collection_idSpecifies the ID of the device collection where the rule is applied (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameSpecifies the name of the device collection where the rule is applied (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
query_expressionSpecifies the query expression that Configuration Manager uses. For example "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where (ClientType = 1) OR (SMS_R_System.AgentEdition0 = 5)" to update the device collectionsRequired
rule_nameSpecifies the name for the ruleRequired

Context Output

PathTypeDescription
MicrosoftECM.Collections.NamestringThe collection's name
MicrosoftECM.Collections.IDstringUnique auto-generated ID containing eight characters. The default value is ""
MicrosoftECM.Collections.TypestringThe type of the collection
MicrosoftECM.Collections.CommentstringGeneral comment or note that documents the collection
MicrosoftECM.Collections.CurrentStatusstringCurrent status of the collection
MicrosoftECM.Collections.HasProvisionedMemberbooleantrue if this collection has provisioned members.
MicrosoftECM.Collections.IncludeExcludeCollectionsCountnumberCount of collections that are included and excluded with this one.
MicrosoftECM.Collections.IsBuiltInbooleanThis value, when set to true, denotes that the collection is built in.
MicrosoftECM.Collections.IsReferenceCollectionbooleanThis value, when set to true, denotes that the collection is not limited by another collection.
MicrosoftECM.Collections.LastChangeTimedateDate and time of when the collection was last altered in any way.
MicrosoftECM.Collections.LastMemberChangeTimedateDate and time of when the collection membership was last altered.
MicrosoftECM.Collections.LastRefreshTimedateDate and time of when the collection membership was last refreshed.
MicrosoftECM.Collections.LimitToCollectionIDstringThe CollectionID of the collection to limit the query results to.
MicrosoftECM.Collections.LimitToCollectionNamestringThe Name of the collection to limit the query results to.
MicrosoftECM.Collections.LocalMemberCountnumberCount of members visible at the local site.
MicrosoftECM.Collections.MemberClassNamestringClass name having instances that are the members of the collection
MicrosoftECM.Collections.MemberCountnumberA count of the collection members.
MicrosoftECM.Collections.UseClusterbooleanA comma separated list of resource IDs e.g 0001,0002
MicrosoftECM.Collections.CollectionRulesstringName of the defining membership criteria for the collection

Command Example

!ms-ecm-device-collection-members-by-query-add query_expression="select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where (ClientType = 1) OR (SMS_R_System.AgentEdition0 = 5)" rule_name="new Rule" collection_name="my new collection name"

Context Example

{
"MicrosoftECM": {
"Collections": {
"CollectionRules": [
"\ninstance of SMS_CollectionRuleExcludeCollection\n{\n\tExcludeCollectionID = \"ISR00014\";\n\tRuleName = \"Test\";\n};",
"\ninstance of SMS_CollectionRuleDirect\n{\n\tResourceClassName = \"SMS_R_System\";\n\tResourceID = 16777220;\n\tRuleName = \"EC2AMAZ-2AKQ815\";\n};",
"\ninstance of SMS_CollectionRuleQuery\n{\n\tQueryExpression = \"select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where (ClientType = 1) OR (SMS_R_System.AgentEdition0 = 5)\";\n\tRuleName = \"new Rule\";\n};\n"
],
"Comment": "my collection comment",
"CurrentStatus": null,
"HasProvisionedMember": "False",
"ID": "ISR0001F",
"IncludeExcludeCollectionsCount": "1",
"IsBuiltIn": "False",
"IsReferenceCollection": "False",
"LastChangeTime": "2020-12-29T15:09:01Z",
"LastMemberChangeTime": "2020-11-29T15:09:53Z",
"LastRefreshTime": "2020-12-29T15:09:03Z",
"LimitToCollectionID": "SMS00001",
"LimitToCollectionName": "All Systems",
"LocalMemberCount": "0",
"MemberClassName": "SMS_CM_RES_COLL_ISR0001F",
"MemberCount": "0",
"Name": "my new collection name",
"Type": null,
"UseCluster": "False"
}
}
}

Human Readable Output

Collection List

NameIDTypeCommentCurrentStatusCollectionRulesHasProvisionedMemberIncludeExcludeCollectionsCountIsBuiltInIsReferenceCollectionLastChangeTimeLastMemberChangeTimeLastRefreshTimeLimitToCollectionIDLimitToCollectionNameLocalMemberCountMemberClassNameMemberCountUseCluster
my new collection nameISR0001Fmy collection comment
instance of SMS_CollectionRuleExcludeCollection
{
ExcludeCollectionID = "ISR00014";
RuleName = "Test";
};
,
instance of SMS_CollectionRuleDirect
{
ResourceClassName = "SMS_R_System";
ResourceID = 16777220;
RuleName = "EC2AMAZ-2AKQ815";
};
,
instance of SMS_CollectionRuleQuery
{
QueryExpression = "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where (ClientType = 1) OR (SMS_R_System.AgentEdition0 = 5)";
RuleName = "new Rule";
};
False1FalseFalse2020-12-29T15:09:01Z2020-11-29T15:09:53Z2020-12-29T15:09:03ZSMS00001All Systems0SMS_CM_RES_COLL_ISR0001F0False

ms-ecm-service-start


Starts a service on a device or collection (Implemented by creating and invoking a script named XSOAR StartService)

Base Command

ms-ecm-service-start

Input

Argument NameDescriptionRequired
service_nameThe name of the serviceRequired
device_nameThe device name to start the service in. (can be retrived via !ms-ecm-device-list)Optional
collection_idThe ID of the collection to start the service in. (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameThe name of the collection to start the service in. (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional

Context Output

PathTypeDescription
MicrosoftECM.ScriptsInvocation.OperationIDnumberThe script execution operation ID
MicrosoftECM.ScriptsInvocation.ReturnValuenumberThe script execution return value

Command Example

!ms-ecm-service-start service_name=dnscache collection_name="All Systems"

Context Example

{
"MicrosoftECM": {
"ScriptsInvocation": {
"OperationID": 16777276,
"ReturnValue": "0"
}
}
}

Human Readable Output

StartService script Invocation Result

OperationIDReturnValue
167772760

ms-ecm-service-restart


Restarts a service on a device or collection (Implemented by creating and invoking a script named XSOAR RestartService)

Base Command

ms-ecm-service-restart

Input

Argument NameDescriptionRequired
service_nameThe name of the serviceRequired
device_nameThe device name to start the service in. (can be retrived via !ms-ecm-device-list)Optional
collection_idThe ID of the collection to start the service in. (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameThe name of the collection to start the service in. (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional

Context Output

PathTypeDescription
MicrosoftECM.ScriptsInvocation.OperationIDnumberThe script execution operation ID
MicrosoftECM.ScriptsInvocation.ReturnValuenumberThe script execution return value

Command Example

!ms-ecm-service-restart service_name=dnscache collection_name="All Systems"

Context Example

{
"MicrosoftECM": {
"ScriptsInvocation": {
"OperationID": 16777275,
"ReturnValue": "0"
}
}
}

Human Readable Output

RestartService script Invocation Result

OperationIDReturnValue
167772750

ms-ecm-service-stop


Stops a service on a device or collection (Implemented by creating and invoking a script named XSOAR StopService)

Base Command

ms-ecm-service-stop

Input

Argument NameDescriptionRequired
service_nameThe name of the serviceRequired
device_nameThe device name to start the service in. (can be retrived via !ms-ecm-device-list)Optional
collection_idThe ID of the collection to start the service in. (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional
collection_nameThe name of the collection to start the service in. (can be retrived via !ms-ecm-collection-list collection_type="Device")Optional

Context Output

PathTypeDescription
MicrosoftECM.ScriptsInvocation.OperationIDnumberThe script execution operation ID
MicrosoftECM.ScriptsInvocation.ReturnValuenumberThe script execution return value

Command Example

!ms-ecm-service-stop service_name=dnscache collection_name="All Systems"

Context Example

{
"MicrosoftECM": {
"ScriptsInvocation": {
"OperationID": 16777277,
"ReturnValue": "0"
}
}
}

Human Readable Output

StopService script Invocation Result

OperationIDReturnValue
167772770

ms-ecm-script-invocation-results


Gets a script invocation results

Base Command

ms-ecm-script-invocation-results

Input

Argument NameDescriptionRequired
operation_idThe script invocation operation IDRequired

Context Output

PathTypeDescription
MicrosoftECM.ScriptsInvocationResults.ClientOperationIdnumberThe script invocation operation ID
MicrosoftECM.ScriptsInvocationResults.CollectionIdstringThe collection ID of the device on which the script was invoked on
MicrosoftECM.ScriptsInvocationResults.CollectionNamestringThe collection Name of the device on which the script was invoked on
MicrosoftECM.ScriptsInvocationResults.DeviceNamestringThe name of the device on which the script was invoked on
MicrosoftECM.ScriptsInvocationResults.ResourceIdnumberThe resource ID of the device on which the script was invoked on
MicrosoftECM.ScriptsInvocationResults.LastUpdateTimedateThe last time the Invocation result object was updated
MicrosoftECM.ScriptsInvocationResults.ScriptExecutionStatestringThe state of the script invocation
MicrosoftECM.ScriptsInvocationResults.ScriptExitCodenumberThe exit code of the script invocation
MicrosoftECM.ScriptsInvocationResults.ScriptGuidstringThe unique identifier of the script
MicrosoftECM.ScriptsInvocationResults.ScriptLastModifiedDatedateThe date of the script's last modification
MicrosoftECM.ScriptsInvocationResults.ScriptNamestringThe name of the script
MicrosoftECM.ScriptsInvocationResults.ScriptOutputstringThe output of the script invocation
MicrosoftECM.ScriptsInvocationResults.ScriptOutputHashstringThe hash of the output of the script invocation
MicrosoftECM.ScriptsInvocationResults.ScriptVersionnumberThe version of the script when it was invoked
MicrosoftECM.ScriptsInvocationResults.TaskIDstringThe unique identifier of the invocation

Command Example

!ms-ecm-script-invocation-results operation_id=16777267

Context Example

{
"MicrosoftECM": {
"ScriptsInvocationResults": {
"ClientOperationId": 16777267,
"CollectionId": "SMS00001",
"CollectionName": "All Systems",
"DeviceName": "EC2AMAZ-2AKQ815",
"LastUpdateTime": "2020-57-29T10:09:15Z",
"ResourceId": 16777220,
"ScriptExecutionState": null,
"ScriptExitCode": "-2147467259",
"ScriptGuid": "2E0D961D-1C89-477D-B1A7-3FFEDC0AF2FA",
"ScriptLastModifiedDate": "2020-36-24T14:09:32Z",
"ScriptName": "Fail",
"ScriptOutput": "",
"ScriptOutputHash": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
"ScriptVersion": "1",
"TaskID": "{FC58140A-B688-4D2E-8FEE-F7AED348FABF}"
}
}
}

Human Readable Output

Script Invocation Results

ClientOperationIdCollectionIdCollectionNameDeviceNameResourceIdLastUpdateTimeScriptExecutionStateScriptExitCodeScriptGuidScriptLastModifiedDateScriptNameScriptOutputScriptOutputHashScriptVersionTaskID
16777267SMS00001All SystemsEC2AMAZ-2AKQ815167772202020-57-29T10:09:15Z-21474672592E0D961D-1C89-477D-B1A7-3FFEDC0AF2FA2020-36-24T14:09:32ZFailE3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B8551{FC58140A-B688-4D2E-8FEE-F7AED348FABF}