Orbital - Alert on New Local User
Details
When triggered, this workflow will review the Secure Endpoint machines and local admin users in Orbital and send a Webex Alert on new non-approved admin user. There are 2 input variables which you can edit: - approved accounts and the Webex room name. The approved accounts variable expects a python list format, like this: ["admin", "guest"] while Webex room name is a string. This workflow should be run on a schedule, therefore after importing this workflow, be sure to add it to the Triggers/ Other Rules automation rule.
Description
This workflow requires Orbital and Webex integration modules.
Please verify these settings prior to execution.
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- Orbital
- Webex
About
Contact and support information
External links
Related workflows
Cisco Managed
This workflow works with an incident automation rule or playbook task to execute an Orbital query on an XDR incident's assets.
Cisco Managed
This workflow works with an incident response playbook to execute an Orbital query on user-selected assets from an XDR incident.
Cisco Managed
This workflow works with an incident automation rule or playbook task to execute an Orbital script on an XDR incident's assets.
Cisco Managed
This workflow works with an incident response playbook to execute an Orbital script on user-selected assets from an XDR incident.
Community
This incident response workflow consumes one or more users (user or process_username) and attempts to disable the local account on endpoints running windows, mac or linux.
Community
This incident response workflow consumes one or more users (user or process_username) and attempts to force a logout from endpoints running windows, mac or linux.
Community
This incident response workflow consumes one or more users (user or process_username) and attempts to re-enable the local account on endpoints running windows, mac or linux
This workflow is intended for use in a playbook during the recovery stage.
Cisco Managed
This workflow initiates a Cisco Orbital forensic snapshot for the endpoint identified by the provided observable.