Skip to main content

Windows Remote Management (Beta)

beta

This is a beta Integration, which lets you implement and test pre-release software. Since the integration is beta, it might contain bugs. Updates to the integration during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the integration to help us identify issues, fix them, and continually improve.

Uses the Python pywinrm library and commands to execute either a process or using Powershell scripts. This integration was integrated and tested with Windows Remote Management

Configure Windows Remote Management on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Windows Remote Management.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    CredentialsTrue
    Default HostTrue
    Authentication TypeTrue
    RealmDefault realm to use for Kerberos based authenticationFalse
    Decode codec (default is utf_8)Decode codec to use when decoding command outputs (defaults to 'utf_8')False
  4. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

winrm-run-process#


Executes a command on the host

Base Command#

winrm-run-process

Input#

Argument NameDescriptionRequired
hostnameThe hostname to run the command on. This will override the default hostname specified in the instance.Optional
commandCommand to execute.Required
argumentsComma separate list of arguments.Optional
decodeDecode codec to use when decoding command outputs (overrides value set in the instance). Possible values are: ascii, big5, big5hkscs, cp037, cp424, cp437, cp500, cp737, cp775, cp850, cp852, cp855, cp856, cp857, cp860, cp861, cp862, cp863, cp864, cp865, cp866, cp869, cp874, cp875, cp932, cp949, cp950, cp1006, cp1026, cp1140, cp1250, cp1251, cp1252, cp1253, cp1254, cp1255, cp1256, cp1257, cp1258, euc_jp, euc_jis_2004, euc_jisx0213, euc_kr, gb2312, gbk, gb18030, hz, iso2022_jp, iso2022_jp_1, iso2022_jp_2, iso2022_jp_2004, iso2022_jp_3, iso2022_jp_ext, iso2022_kr, latin_1, iso8859_2, iso8859_3, iso8859_4, iso8859_5, iso8859_6, iso8859_7, iso8859_8, iso8859_9, iso8859_10, iso8859_13, iso8859_14, iso8859_15, johab, koi8_r, koi8_u, mac_cyrillic, mac_greek, mac_iceland, mac_latin2, mac_roman, mac_turkish, ptcp154, shift_jis, shift_jis_2004, shift_jisx0213, utf_16, utf_16_be, utf_16_le, utf_7, utf_8.Optional

Context Output#

PathTypeDescription
WinRM.ProcessunknownProcess object of the WinRM command
WinRM.Process.OutputunknownSTDOUT of the WinRM command
WinRM.Process.ErrorunknownSTDERR of the WinRM command
WinRM.Process.StatusunknownStatus code of the WInRM command

Context Example#

"WinRM": {
"Process": {
"Error": "#SomeError",
"Output": "Hello DBot!",
"Status": 0
}
}

Command Example#

!winrm-run-process command=`HelloWorldProcess` arguments="DBot"

Human Readable Output#

"Hello DBot!"

winrm-run-powershell#


Executes a Powershell script on the endpoint

Base Command#

winrm-run-powershell

Input#

Argument NameDescriptionRequired
hostnameThe hostname to run the command on. This will override the default hostname specified in the instance.Optional
entryIDThe entry ID of the powershell script to run (overrides scriptname and script).Optional
scriptThe powershell script to execute (requires code, not a file input).Optional
scriptnameName of the script (optional).Optional
decodeDecode codec to use when decoding command outputs (overrides value set in the instance). Possible values are: ascii, big5, big5hkscs, cp037, cp424, cp437, cp500, cp737, cp775, cp850, cp852, cp855, cp856, cp857, cp860, cp861, cp862, cp863, cp864, cp865, cp866, cp869, cp874, cp875, cp932, cp949, cp950, cp1006, cp1026, cp1140, cp1250, cp1251, cp1252, cp1253, cp1254, cp1255, cp1256, cp1257, cp1258, euc_jp, euc_jis_2004, euc_jisx0213, euc_kr, gb2312, gbk, gb18030, hz, iso2022_jp, iso2022_jp_1, iso2022_jp_2, iso2022_jp_2004, iso2022_jp_3, iso2022_jp_ext, iso2022_kr, latin_1, iso8859_2, iso8859_3, iso8859_4, iso8859_5, iso8859_6, iso8859_7, iso8859_8, iso8859_9, iso8859_10, iso8859_13, iso8859_14, iso8859_15, johab, koi8_r, koi8_u, mac_cyrillic, mac_greek, mac_iceland, mac_latin2, mac_roman, mac_turkish, ptcp154, shift_jis, shift_jis_2004, shift_jisx0213, utf_16, utf_16_be, utf_16_le, utf_7, utf_8.Optional

Context Output#

PathTypeDescription
WinRM.Powershell.OutputunknownSTDOUT of the WinRM command
WinRM.Powershell.ErrorunknownSTDERR of the WinRM command
WinRM.Powershell.StatusunknownStatus code of the WInRM command

Context Example#

"WinRM": {
"Script": {
"error": "#SomeError",
"hostname": 8.8.8.8,
"output": "Hello, World!"
}
"script": "Hello",
"status": 0
}

Command Example#

!winrm-run-powershell script=`Write-Host "Hello, World!"` scriptname="Hello"

Human Readable Output#

Hello, World!