Skip to main content

Get User Devices by Username - Generic

This Playbook is part of the Common Playbooks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.8.0 and later.

This playbook retrieves information on all of the associated user devices, based on the user's username. In order to get a generic output, the following information on all of the retrieved devices will be saved under the UserDevices context key:

  • Name
  • Serial Number
  • ID
  • Model
  • MAC Address
  • OS
  • Integration

Note that not all of the supported integrations will be able to retrieve this information.

Supported integrations:

  • jamf v2
  • Microsoft Defender for Endpoint
  • Cortex XDR IR
  • ServiceNow v2
  • Google Workspace (Gsuite)
  • Active Directory Query v2.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

  • ServiceNow v2
  • Cortex XDR - IR
  • jamf v2
  • Microsoft Defender Advanced Threat Protection

Scripts#

  • SetAndHandleEmpty
  • SetMultipleValues
  • IsIntegrationAvailable

Commands#

  • gsuite-mobiledevice-list
  • jamf-get-mobile-device-by-match
  • ad-get-user
  • microsoft-atp-get-user-machines
  • servicenow-query-computers
  • core-get-endpoints
  • jamf-get-mobile-device-by-id
  • servicenow-query-users
  • jamf-get-computer-by-match
  • xdr-get-endpoints
  • jamf-get-computer-by-id

Playbook Inputs#


NameDescriptionDefault ValueRequired
UsernameThe username of the user.Optional
GsuiteCustomerIDIf using Google Workspace, a customer ID is needed.Optional
CustomADAttributeA custom Active Directory attribute.
In case there is a custom attribute in Active Directory which stores the name of the computer assigned to the user in the user object, it would be fetched.
Optional

Playbook Outputs#


PathDescriptionType
GSuite.MobileDevicesGsuite mobile devices.unknown
GSuite.MobileDevices.MobileListObjectsA list of mobile device objects.unknown
GSuite.MobileDevices.MobileListObjects.kindThe type of the API resource.unknown
GSuite.MobileDevices.MobileListObjects.etagETag of the resource.unknown
GSuite.MobileDevices.MobileListObjects.resourceIdThe unique ID the API service uses to identify the mobile device.unknown
GSuite.MobileDevices.MobileListObjects.deviceIdThe serial number for a Google Sync mobile device. For Android and iOS devices, this is a software-generated unique identifier.unknown
GSuite.MobileDevices.MobileListObjects.nameA list of the owner's usernames.unknown
GSuite.MobileDevices.MobileListObjects.emailA list of the owner's email addresses.unknown
GSuite.MobileDevices.MobileListObjects.modelThe mobile device's model name.unknown
GSuite.MobileDevices.MobileListObjects.osThe mobile device's operating system.unknown
GSuite.MobileDevices.MobileListObjects.typeThe type of mobile device.unknown
GSuite.MobileDevices.MobileListObjects.statusThe mobile device's status.unknown
GSuite.MobileDevices.MobileListObjects.hardwareIdThe IMEI/MEID unique identifier for Android hardware.unknown
GSuite.MobileDevices.MobileListObjects.firstSyncThe date and time the mobile device was initially synchronized with the policy settings in the Admin console.unknown
GSuite.MobileDevices.MobileListObjects.lastSyncThe date and time the mobile device was last synchronized with the policy settings in the Admin console.unknown
GSuite.MobileDevices.MobileListObjects.userAgentInformation about the mobile device such as the operating system version.unknown
GSuite.MobileDevices.MobileListObjects.serialNumberThe mobile device's serial number.unknown
GSuite.MobileDevices.MobileListObjects.imeiThe mobile device's IMEI number.unknown
GSuite.MobileDevices.MobileListObjects.meidThe mobile device's MEID number.unknown
GSuite.MobileDevices.MobileListObjects.wifiMacAddressThe mobile device's MAC address on Wi-Fi networks.unknown
GSuite.MobileDevices.MobileListObjects.networkOperatorMobile device mobile or network operator.unknown
GSuite.MobileDevices.MobileListObjects.defaultLanguageThe default locale used on the mobile device.unknown
GSuite.MobileDevices.MobileListObjects.managedAccountIsOnOwnerProfileBoolean indicating if this account is on the owner/primary profile.unknown
GSuite.MobileDevices.MobileListObjects.deviceCompromisedStatusThe compromised device status.unknown
GSuite.MobileDevices.MobileListObjects.buildNumberThe mobile device's operating system build number.unknown
GSuite.MobileDevices.MobileListObjects.kernelVersionThe mobile device's kernel version.unknown
GSuite.MobileDevices.MobileListObjects.basebandVersionThe mobile device's baseband version.unknown
GSuite.MobileDevices.MobileListObjects.unknownSourcesStatusUnknown sources enabled or disabled on the mobile device.unknown
GSuite.MobileDevices.MobileListObjects.adbStatusWhether adb (USB debugging) is enabled on the mobile device.unknown
GSuite.MobileDevices.MobileListObjects.developerOptionsStatusWhether developer options are enabled on the mobile device.unknown
GSuite.MobileDevices.MobileListObjects.otherAccountsInfoA list of accounts added on the device.unknown
GSuite.MobileDevices.MobileListObjects.supportsWorkProfileWork profile supported on the mobile device.unknown
GSuite.MobileDevices.MobileListObjects.manufacturerMobile device manufacturer.unknown
GSuite.MobileDevices.MobileListObjects.releaseVersionMobile device release version.unknown
GSuite.MobileDevices.MobileListObjects.securityPatchLevelMobile device security patch level.unknown
GSuite.MobileDevices.MobileListObjects.brandMobile device brand.unknown
GSuite.MobileDevices.MobileListObjects.bootloaderVersionMobile device bootloader version.unknown
GSuite.MobileDevices.MobileListObjects.hardwareMobile device hardware.unknown
GSuite.MobileDevices.MobileListObjects.encryptionStatusMobile device encryption status.unknown
GSuite.MobileDevices.MobileListObjects.devicePasswordStatusMobile device password status.unknown
GSuite.MobileDevices.MobileListObjects.privilegeDM agent permission.unknown
GSuite.MobileDevices.MobileListObjects.applicationsMobile device applications.unknown
GSuite.MobileDevices.MobileListObjects.applications.packageNameThe application's package name.unknown
GSuite.MobileDevices.MobileListObjects.applications.displayNameThe application's display name.unknown
GSuite.MobileDevices.MobileListObjects.applications.versionNameThe application's version name.unknown
GSuite.MobileDevices.MobileListObjects.applications.versionCodeThe application's version code.unknown
GSuite.MobileDevices.MobileListObjects.applications.permissionThe list of permissions of this application.unknown
JAMF.ComputerComputer object.unknown
JAMF.Computer.idThe computer ID.unknown
JAMF.Computer.nameThe computer name.unknown
JAMF.Computer.udidThe computer UDID.unknown
JAMF.Computer.serial_numberThe computer serial number.unknown
JAMF.Computer.mac_addressThe computer MAC address.unknown
JAMF.Computer.alt_mac_addressThe computer alt MAC address.unknown
JAMF.Computer.asset_tagThe computer asset tag.unknown
JAMF.Computer.bar_code_1The computer barcode 1.unknown
JAMF.Computer.bar_code_2The computer barcode 2.unknown
JAMF.Computer.usernameThe computer username.unknown
JAMF.Computer.realnameThe computer real name.unknown
JAMF.Computer.emailThe computer email address.unknown
JAMF.Computer.email_addressThe computer email address.unknown
JAMF.Computer.roomThe computer room.unknown
JAMF.Computer.positionThe computer position.unknown
JAMF.Computer.buildingThe computer building.unknown
JAMF.Computer.building_nameThe computer building name.unknown
JAMF.Computer.departmentThe computer department.unknown
JAMF.Computer.department_nameThe computer department name.unknown
JAMF.MobileDeviceMobile device object.unknown
JAMF.MobileDevice.idThe mobile device ID.unknown
JAMF.MobileDevice.nameThe mobile device name.unknown
JAMF.MobileDevice.udidThe mobile device UDID.unknown
JAMF.MobileDevice.serial_numberThe mobile device serial number.unknown
JAMF.MobileDevice.mac_addressThe mobile device MAC address.unknown
JAMF.MobileDevice.wifi_mac_addressThe mobile device WI-FI MAC address.unknown
JAMF.MobileDevice.usernameThe mobile device username.unknown
JAMF.MobileDevice.realnameThe mobile device real name.unknown
JAMF.MobileDevice.emailThe mobile device user email address.unknown
JAMF.MobileDevice.email_addressThe mobile device user email address.unknown
JAMF.MobileDevice.roomThe mobile device room.unknown
JAMF.MobileDevice.positionThe mobile device position.unknown
JAMF.MobileDevice.buildingThe mobile device building.unknown
JAMF.MobileDevice.building_nameThe mobile device building name.unknown
JAMF.MobileDevice.departmentThe mobile device department.unknown
JAMF.MobileDevice.department_nameThe mobile device department name.unknown
PaloAltoNetworksXDR.Endpoint.endpoint_idThe endpoint ID.unknown
PaloAltoNetworksXDR.Endpoint.endpoint_nameThe endpoint name.unknown
PaloAltoNetworksXDR.Endpoint.endpoint_typeThe endpoint type.unknown
PaloAltoNetworksXDR.Endpoint.endpoint_statusThe status of the endpoint.unknown
PaloAltoNetworksXDR.Endpoint.os_typeThe endpoint OS type.unknown
PaloAltoNetworksXDR.Endpoint.ipA list of IP addresses.unknown
PaloAltoNetworksXDR.Endpoint.usersA list of users.unknown
PaloAltoNetworksXDR.Endpoint.domainThe endpoint domain.unknown
PaloAltoNetworksXDR.Endpoint.aliasThe endpoint's aliases.unknown
PaloAltoNetworksXDR.Endpoint.first_seenFirst seen date/time in Epoch (milliseconds).unknown
PaloAltoNetworksXDR.Endpoint.last_seenLast seen date/time in Epoch (milliseconds).unknown
PaloAltoNetworksXDR.Endpoint.content_versionContent version.unknown
PaloAltoNetworksXDR.Endpoint.installation_packageInstallation package.unknown
PaloAltoNetworksXDR.Endpoint.active_directoryActive directory.unknown
PaloAltoNetworksXDR.Endpoint.install_dateInstall date in Epoch (milliseconds).unknown
PaloAltoNetworksXDR.Endpoint.endpoint_versionEndpoint version.unknown
PaloAltoNetworksXDR.Endpoint.is_isolatedWhether the endpoint is isolated.unknown
PaloAltoNetworksXDR.Endpoint.group_nameThe name of the group to which the endpoint belongs.unknown
PaloAltoNetworksXDR.Endpoint.countNumber of endpoints returned.unknown
Endpoint.HostnameThe hostname that is mapped to this endpoint.unknown
Endpoint.IDThe unique ID within the tool retrieving the endpoint.unknown
Endpoint.IPAddressThe IP address of the endpoint.unknown
Endpoint.DomainThe domain of the endpoint.unknown
Endpoint.OSThe endpoint's operation system.unknown
Endpoint.StatusThe endpoint's status.unknown
Endpoint.IsIsolatedThe endpoint's isolation status.unknown
Endpoint.MACAddressThe endpoint's MAC address.unknown
Endpoint.VendorThe integration name of the endpoint vendor.unknown
MicrosoftATP.UserMachine.UsernameThe username.unknown
MicrosoftATP.UserMachine.Machines.IDThe machine ID.unknown
MicrosoftATP.UserMachine.Machines.ComputerDNSNameThe machine DNS name.unknown
MicrosoftATP.UserMachine.Machines.FirstSeenThe first date and time the machine was observed by Microsoft Defender ATP.unknown
MicrosoftATP.UserMachine.Machines.LastSeenThe last date and time the machine was observed by Microsoft Defender ATP.unknown
MicrosoftATP.UserMachine.Machines.OSPlatformThe operating system platform.unknown
MicrosoftATP.UserMachine.Machines.OSVersionThe operating system version.unknown
MicrosoftATP.UserMachine.Machines.OSProcessorThe operating system processor.unknown
MicrosoftATP.UserMachine.Machines.LastExternalIPAddressThe last IP through which the machine accessed the internet.unknown
MicrosoftATP.UserMachine.Machines.OSBuildThe operating system build number.unknown
MicrosoftATP.UserMachine.Machines.HealthStatusThe machine health status.unknown
MicrosoftATP.UserMachine.Machines.RBACGroupIDThe machine RBAC group ID.unknown
MicrosoftATP.UserMachine.Machines.RBACGroupNameThe machine RBAC group name.unknown
MicrosoftATP.UserMachine.Machines.RiskScoreThe machine risk score.unknown
MicrosoftATP.UserMachine.Machines.ExposureLevelThe machine exposure level.unknown
MicrosoftATP.UserMachine.Machines.IsAADJoinedTrue if machine is AAD joined, False otherwise.unknown
MicrosoftATP.UserMachine.Machines.AADDeviceIDThe AAD device ID.unknown
MicrosoftATP.UserMachine.Machines.MachineTagsSet of machine tags.unknown
MicrosoftATP.v.Machines.LastIPAddressThe last IP on the machine.unknown
ServiceNow.Computer.IDComputer system ID.unknown
ServiceNow.Computer.AssetTagComputer asset tag.unknown
ServiceNow.Computer.NameComputer name.unknown
ServiceNow.Computer.DisplayNameComputer display name.unknown
ServiceNow.Computer.SupportGroupComputer support group.unknown
ServiceNow.Computer.OperatingSystemComputer operating system.unknown
ServiceNow.Computer.CompanyComputer company system ID.unknown
ServiceNow.Computer.AssignedToComputer assigned to user system ID.unknown
ServiceNow.Computer.StateComputer state.unknown
ServiceNow.Computer.CostComputer cost.unknown
ServiceNow.Computer.CommentsComputer comments.unknown
UserDevicesDevices retrieved by this playbook.unknown
UserDevices.NameDevices names retrieved by this playbook.unknown
UserDevices.SerialNumberDevices serial numbers retrieved by this playbook.unknown
UserDevices.IDDevices IDs retrieved by this playbook.unknown
UserDevices.ModelDevices models retrieved by this playbook.unknown
UserDevices.OSDevices operating systems retrieved by this playbook.unknown
UserDevices.IntegrationThe integration which retrieved the devices.unknown
UserDevices.MACAddressDevices MAC address retrieved by this playbook.unknown

Playbook Image#


Get User Devices by Username - Generic