topic Re: XSOAR - GET-GPO DisplayName in Cortex XSOAR Discussions

XSOAR - GET-GPO DisplayName

tlmarques — Thu, 18 Apr 2024 13:59:40 GMT

Hi,

I've created a playbook to analyze some alerts related to SOC and GPO, but the alerts come with ObjectGUID and I need to convert the GUID to DisplayName.

In PowerShell, the command is simple: (Get-GPO -Guid "$GUID").DisplayName.

I tried running this command in the war room, but it didn't work... Does anyone know how I can do this?"

Re: XSOAR - GET-GPO DisplayName

vmikhailov — Fri, 19 Apr 2024 12:16:28 GMT

Do you use PowerShell Remoting integration to run that PS request? im talking about that https://xsoar.pan.dev/docs/reference/integrations/power-shell-remoting

also I would give a try Active Directory Query v2 integration (Active Directory Query v2) and command ad-search, for attributes I think we need "distinguishedName,displayName", for base-dn should be like "CN=Policies,CN=System,DC=EXAMPLEDOMAIN,DC=LOCAL" and search "(objectClass=groupPolicyContainer)"

Re: XSOAR - GET-GPO DisplayName

tlmarques — Tue, 23 Apr 2024 15:02:33 GMT

Hi @vmikhailov ,

I've tried with ADQ v2, but that didn't work :S

I'll try with PowerShell remoting... I don't know if it works because we have firewalls filtering... but I'll try.