Cisco Duo - Change User Status

This incident response workflow allows you to change the status of one or more users in Cisco Duo from a playbook or using an automation rule. When using this workflow in a playbook, the user selects which users to change the status of. When using this workflow with an incident automation rule, all users involved in the incident are updated. Supported observables: user, email

Targets: Cisco Duo

Steps:

• Detect the start type and extract the supported observables
• Check if any supported observables were found (if not, end the workflow)
• Split up the observables
• For each observable:
  • Split the observable type and value
  • Set the appropriate local variable based on the observable type
  • Search for a matching user in Duo (if not found, update the workflow results)
  • Attempt the change the user's status
  • Check if the user's status was updated and update the workflow result