topic Re: Adding endpoint list to an AD group in Cortex XSOAR Discussions

Adding endpoint list to an AD group

MartinCimone — Fri, 14 May 2021 18:59:43 GMT

Hi,

I am currently building a new PlayBook and in one part of that PlayBook, I am trying to add computers, in an XSoar List, to a specific AD group.

- I Created a List that contains 2 endpoints separated with a comma ","

- My Playbook is using the Active Directory Query v2: ad-add-to-group

- Field "computer-name" is filled with the query referencing my XSoar List: ${lists.MyListName}

The problem I am facing is that it is not working with multiple values in my list. If only 1 computer name is in the list, I have no problem adding that computer to the specified AD group in my PlayBook. As soon as there is 2 or more value in my list, the task failed. All value in the list is comma "," separated

Here's the full error seen in the War Room:

Active Directory Query v2 returned an error

#7: ad-add-to-group

Command:

!ad-add-to-group computer-name="COMPUTER1,COMPUTER2" group-cn="MyADGroup"(Active Directory Query v2)

Reason

Could not get full DN for computer with name 'COMPUTER1,COMPUTER2' Last connection result: {"result": 0, "description": "success", "dn": "", "message": "", "referrals": null, "type": "searchResDone"} Last error from LDAP server: None

Thanks for your help.

Re: Adding endpoint list to an AD group

DougCouch — Mon, 14 Jun 2021 17:54:18 GMT

Hey Martin!

I think the part that is creating an issue is the way the list is returning the values. Basically the list can store a chunk of data in almost any format. You can comma separate it or use newlines or whatever you want. You may have to parse the output though. Our commands can usually iterate over lists but it's going to expect something more like a json or python style list being handed to it. Use the Split transformer to break up the output to the command before it processes it. Here's an example:

Created the list as a comma separated value

If I try to print it out now you get basically a single string with all of the values. You can tell because our Print statement processed it in one command instead of iterating through each of them.

If you create a small playbook, add in the command you want to run and use a transformer like this:

Then your output will break up into an actual list and process each item individually.

I hope that helps!

Re: Adding endpoint list to an AD group

MartinCimone — Mon, 14 Jun 2021 20:56:10 GMT

Hi @DougCouch,

Thanks for your help here. I fixed my problem a couple of weeks ago using the exact same method using a transformer "Split" and using a comma as a delimiter.

Thanks for having taken the time to help me out.

Have a great day !