XSOAR - GET-GPO DisplayName

[tlmarques]

Hi,

I've created a playbook to analyze some alerts related to SOC and GPO, but the alerts come with ObjectGUID and I need to convert the GUID to DisplayName.

In PowerShell, the command is simple: (Get-GPO -Guid "$GUID").DisplayName.

I tried running this command in the war room, but it didn't work... Does anyone know how I can do this?"

[vmikhailov]

Do you use PowerShell Remoting integration to run that PS request? im talking about that https://xsoar.pan.dev/docs/reference/integrations/power-shell-remoting

also I would give a try Active Directory Query v2 integration (Active Directory Query v2) and command ad-search, for attributes I think we need "distinguishedName,displayName", for base-dn should be like "CN=Policies,CN=System,DC=EXAMPLEDOMAIN,DC=LOCAL" and search "(objectClass=groupPolicyContainer)"

[tlmarques]

Hi @vmikhailov ,

I've tried with ADQ v2, but that didn't work :S

I'll try with PowerShell remoting... I don't know if it works because we have firewalls filtering... but I'll try.