topic Re: Help with AD computers extract and group validation in Cortex XSOAR Discussions

Help with AD computers extract and group validation

MartinCimone — Thu, 29 Jul 2021 18:01:33 GMT

Hi !

I am trying to use XSoar to extract all computers from a specific "OU" in my AD and validate if those computers are members of a group and if they are not, add the missing computers to the said group.

Servers OS needs to be excluded from this extract since I do not want servers to be added to the AD group.

The "ad-get-computer" from the Task Library is not working very well since filling the "dn" field does not permit to target a specific "OU" and want a full path to a computer.

Does anyone have an idea of how I can achieve this?

Thanks.

Re: Help with AD computers extract and group validation

atullo — Thu, 29 Jul 2021 19:30:25 GMT

Perhaps you could try using the ad-search command to filter on the computer's OU and then the ad-add-to-group command to add the missing computers to the group: Active Directory Query v2 Integration Documentation

Use the !ad-search command to run a query for Active Directory objects (users, contacts, computers, and so on). This command enables you to determine which data fields should be returned for the objects.

. . .

Add or remove a computer from a group using the following commands:

ad-add-to-group

Re: Help with AD computers extract and group validation

MartinCimone — Fri, 30 Jul 2021 11:57:57 GMT

That could be a way to do it. I'll check the documentation and see if I can do what I need.

Thanks for the hint 😉

Re: Help with AD computers extract and group validation

MartinCimone — Tue, 03 Aug 2021 16:34:00 GMT

Hi @atullo,

FYI, I have been able to achieve what I wanted to do with the information you gave me.

I used the !ad-search command filtering with LDAP query format.

Thanks for pointing me out in the right direction.

Re: Help with AD computers extract and group validation

atullo — Tue, 03 Aug 2021 20:20:21 GMT

Happy to help and thanks for marking as a solution.