Cisco Secure Endpoint - Find Duplication GUIDs

This workflow will list duplicate GUIDs in Cisco Secure Endpoint for validation and review. The workflow will create variable table type that contains columns "GUID, OS, Name, Version, Lastseen, mac, policy". The duplicate GUIDs information will list and update into output variable "Duplicate_GUIDs_Output" and the output of "Python" that you can copy and paste as json format then import into Microsoft Excel or Google Sheet.

Description

The target has been provided by the Secure Endpoint Integration Module and does not require an Account Key selection.

Information about duplicate GUIDs will be listed and stored in the output variable Duplicate_GUIDs_Output. Also, listed in the output of the python execution. The output is in JSON format and can be easily copied and pasted into Microsoft Excel or Google Sheets for further analysis.

This workflow requires the following targets to be available before it can be run.

Integration targets

Secure Endpoint

Author

Teerapong Chamnankitmongkol

Version

v1.0

Integration

Secure Endpoint

Average rating

No ratings yet

Authorship

Community

tchamnan@cisco.com

Content Licensing

Developer Community

Cisco Managed

This incident response workflow allows you to add hashes involved in an incident to a simple custom detection list in Cisco Secure Endpoint through a playbook or using an automation rule.

Community

# Cisco Secure Endpoint Exclusion List Export Workflow The Workflow will list exclusion lists of Cisco Secure Endpoint for validating and review.

Community

This workflow will list duplicate GUIDs in Cisco Secure Endpoint for validation and review.

Cisco Managed

This incident response workflow fetches vulnerability information from Cisco Secure Endpoint for assets involved in an incident when triggered from a playbook or using an automation rule.

Cisco Managed

This workflow appears in the pivot menu and allows you to request approval to isolate a host using Cisco Secure Endpoint.

Cisco Managed

This incident response workflow allows you to isolate hosts involved in an incident using Cisco Secure Endpoint from a playbook or using an automation rule.

Cisco Managed

This workflow appears in the pivot menu and will move the endpoint identified by the provided observable to a device group in Cisco Secure Endpoint.

Cisco Managed

This incident response workflow allows you to move computers to a group in Cisco Secure Endpoint from a playbook or using an automation rule.