Integrate Active Directory with Google SecOps

This document explains how to integrate Active Directory with Google Security Operations.

Use cases

The Active Directory integration uses Google SecOps capabilities to support the following use cases:

• Activate and deactivate users: Deactivate a potentially compromised user account and prevent further unauthorized access.

• Reset passwords: Automatically reset the user password in Active Directory and notify the user of the change.

• Manage groups: Add new users to the appropriate security groups based on their role and make sure that the users have the correct access permissions.

• Retrieve user information: Retrieve user details such as group memberships, last login time, and contact information about a specific user account.

• Automate offboarding: Disable accounts, remove them from groups, and transfer file ownership when an employee offboards.

Before you begin

Before you configure the Active Directory integration in Google SecOps, verify that your network environment, Active Directory Domain Services (AD DS), and service account credentials satisfy all operational prerequisites.

To prepare your environment for integration, complete the following prerequisites:

1. Verify network connectivity and DNS resolution between your Google SecOps instance (or Remote Agent) and your Active Directory Domain Controllers.

2. Optional: If connecting over LDAPS (port 636, required for password resets) using an internal Certificate Authority, configure the CA certificate by encoding your root or intermediate certificate into a base64 string.

3. Create a dedicated Active Directory service account adhering to the Principle of Least Privilege.

4. Review the required action permissions to determine the attributes and access rights needed for the specific actions you plan to run.

5. Delegate permissions on target Organizational Units for the actions you plan to use (using Active Directory Users and Computers or PowerShell and dsacls), making sure the service account has explicit Read and Write access to the userAccountControl attribute.

Network and DNS requirements

Google SecOps communicates directly with Active Directory Domain Controllers using the Lightweight Directory Access Protocol (LDAP or LDAPS) over TCP.

Make sure your network environment meets the following connectivity rules:

• Port connectivity: Make sure your network firewalls and routing allow outbound communication from Google SecOps (or your Remote Agent) to your Active Directory Domain Controllers on the following ports:

  • LDAP (standard): Open port 389/TCP for unencrypted LDAP communication.
  • LDAPS (recommended - mandatory for passwords): Open port 636/TCP (or your custom SSL/TLS port). LDAPS is required for encrypted directory traffic and is mandatory for password modification actions.

• DNS and hostname resolution: Active Directory requires accurate hostname resolution to match SSL/TLS certificates and directory service bindings. If your domain is resolved by a fully qualified DNS name through your internal DNS setup, no additional host configuration is needed. If DNS resolution isn't available on your remote agent container image, configure the /etc/hosts file.

Configure the /etc/hosts file

This configuration is optional. If your domain controller is already resolved through your internal DNS setup, skip this section. If your remote agent can't resolve the Active Directory domain controller using DNS, map the host manually in the /etc/hosts file to match SSL/TLS certificates and directory service bindings.

To configure the /etc/hosts file, complete the following steps:

1. Open /etc/hosts in a text editor with administrative privileges:

   sudo vi /etc/hosts
   

2. Add an entry mapping the domain controller's IP address to its fully qualified domain name (FQDN):

   192.0.2.195 dc01.example.local
   

3. Save and close the file.

If you don't need a CA certificate for the integration, proceed to configuring the authentication and service account requirements. Otherwise, configure your CA certificate.

Configure the CA certificate

This step is optional. If you connect using standard LDAP (port 389) or use a publicly trusted certificate, skip this section and proceed to Authentication and service account requirements. If you connect over LDAPS (port 636, required for password resets) using a certificate issued by a private or internal CA, provide the base64-encoded certificate string during setup to establish a trusted TLS connection.

To configure and upload the CA certificate, complete the following steps:

1. Encode your PEM-formatted certificate file:

   • Linux: bash base64 -w 0 mycert.crt

   • macOS: bash base64 -i mycert.crt

2. Copy the full output string (including encoded headers) and paste it into the CA Certificate File - parsed into Base64 String field in the Google SecOps integration configuration.

3. Set the Server parameter to the FQDN of the domain controller (not its IP address) so the hostname matches the Common Name (CN) or Subject Alternative Name (SAN) on the certificate.

4. Click Test to validate the TLS handshake.

Authentication and service account requirements

The Active Directory integration authenticates using standard AD DS credentials.

Make sure your authentication setup complies with the following security practices:

• Dedicated service account: Create a dedicated service account (such as svc_secops_ad) specifically for Google SecOps automated playbooks. Avoid using interactive user accounts or built-in domain administrator accounts.

• Username format: The username can be provided as a User Principal Name (UPN) (such as svc_secops@example.local) or as a Down-Level Logon Name (EXAMPLE\svc_secops).

• PoLP: Don't add the service account to privileged built-in groups such as Domain Admins, Enterprise Admins, or Account Operators. Instead, grant granular permissions on specific OUs where user, computer, or group objects reside.

Configure action permissions (least privilege)

Grant the authenticating service account only the Active Directory permissions and LDAP attribute access required for the specific actions you plan to run.

Refer to the minimal permissions for Active Directory actions in the following table:

Delegating permissions in Active Directory

To enforce the PoLP without granting broad administrative rights, delegate permissions on target OUs using either the graphical ADUC console or the PowerShell and dsacls command-line tools. You only need to use one of these methods, and you only need to delegate the permissions required for the specific actions you plan to run.

Delegate control using ADUC

If you prefer using a graphical interface, use the Delegation of Control Wizard in ADUC to delegate object and property-specific permissions.

Run the wizard on the target OU to grant the object and property permissions required for the actions you plan to use (such as reading and writing account control flags, resetting passwords, or unlocking accounts).

For step-by-step guidance on running the wizard, see the Microsoft documentation on Delegation of Control in AD DS.

Delegate control using PowerShell and dsacls

If you prefer a command-line approach or want to automate permission assignments, use PowerShell with the built-in dsacls.exe utility instead of ADUC.

Run only the command examples that apply to the actions you plan to use on an administrative workstation or Domain Controller, substituting your target OU and service account name:

• Grant Read and Write permissions on userAccountControl for user objects (to enable or disable user accounts and prevent enrichment errors): powershell dsacls.exe "OU=Users,DC=example,DC=local" /I:S /G "EXAMPLE\svc_secops_ad:RPWP;userAccountControl;user"
• Grant Read and Write permissions on userAccountControl for computer objects (to enable or disable computers): powershell dsacls.exe "OU=Computers,DC=example,DC=local" /I:S /G "EXAMPLE\svc_secops_ad:RPWP;userAccountControl;computer"
• Grant unlock account permissions (lockoutTime): powershell dsacls.exe "OU=Users,DC=example,DC=local" /I:S /G "EXAMPLE\svc_secops_ad:RPWP;lockoutTime;user"
• Grant force password change permissions (pwdLastSet): powershell dsacls.exe "OU=Users,DC=example,DC=local" /I:S /G "EXAMPLE\svc_secops_ad:RPWP;pwdLastSet;user"
• Grant password reset rights (Reset Password extended right): powershell dsacls.exe "OU=Users,DC=example,DC=local" /I:S /G "EXAMPLE\svc_secops_ad:CA;Reset Password;user"
• Grant membership modification rights on a security group: powershell dsacls.exe "CN=SecOps-Quarantine,OU=Groups,DC=example,DC=local" /G "EXAMPLE\svc_secops_ad:RPWP;member;group"

For more details on syntax and parameter switches, see the Microsoft documentation on dsacls.

Integration parameters

The Active Directory integration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations.

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances.

Actions

For more information about actions, see Respond to pending actions from your workdesk and Run a manual action in your case.

Add User To Group

Use the Add User To Group action to add users from the case to one or more Active Directory groups, such as adding an account to a restricted access group during an investigation. The action automatically identifies the target users from the case and adds them to the specified groups.

This action runs on the Google SecOps User entity.

Action inputs

The Add User To Group action requires the following parameters:

Action outputs

The Add User To Group action provides the following outputs:

Output messages

The Add User To Group action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add User To Group action:

Change Host OU

Use the Change Host OU action to move computers in the case to a different Organizational Unit in Active Directory, such as moving a compromised machine to a quarantine OU with restricted policies. The action automatically identifies the target computers from the case and moves them to the specified destination OU.

This action runs on the Google SecOps Hostname entity.

Action inputs

The Change Host OU action requires the following parameters:

Action outputs

The Change Host OU action provides the following outputs:

Output messages

The Change Host OU action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Change Host OU action:

Change User OU

Use the Change User OU action to move users in the case to a different Organizational Unit in Active Directory, such as moving an account to a restricted OU during an incident or offboarding workflow. The action automatically identifies the target users from the case and moves them to the specified destination OU.

This action runs on the Google SecOps User entity.

Action inputs

The Change User OU action requires the following parameters:

Action outputs

The Change User OU action provides the following outputs:

Output messages

The Change User OU action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Change User OU action:

Disable Account

Use the Disable Account action to deactivate user accounts in Active Directory. This action automatically targets the users attached to the case.

This action runs on the Google SecOps User entity.

Action inputs

None.

Action outputs

The Disable Account action provides the following outputs:

Output messages

The Disable Account action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Disable Account action:

Disable Computer

Use the Disable Computer action to deactivate computer accounts in Active Directory to prevent compromised or unauthorized machines from authenticating to the domain. The action automatically targets the hostnames attached to the case.

This action runs on the Google SecOps Hostname entity.

Action inputs

None.

Action outputs

The Disable Computer action provides the following outputs:

Output messages

The Disable Computer action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Disable Computer action:

Enable Account

Use the Enable Account action to re-enable disabled user accounts in Active Directory. The action automatically targets the users attached to the case.

This action runs on the Google SecOps User entity.

Action inputs

None.

Action outputs

The Enable Account action provides the following outputs:

Output messages

The Enable Account action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Enable Account action:

Enable Computer

Use the Enable Computer action to re-enable disabled computer accounts in Active Directory so the machines can authenticate to the domain again. The action automatically targets the hostnames attached to the case.

This action runs on the Google SecOps Hostname entity.

Action inputs

None.

Action outputs

The Enable Computer action provides the following outputs:

Output messages

The Enable Computer action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Enable Computer action:

Enrich Entities

Use the Enrich Entities action to retrieve Active Directory profile details, account status, and group memberships for users and computers in the case. You can enrich entities with all available directory information or limit the results and case wall table to specific attributes.

This action is asynchronous. Adjust the script timeout value in the Google SecOps IDE for the action, if needed.

The Enrich Entities action runs on the following Google SecOps entities:

• User
• Hostname

Action inputs

The Enrich Entities action requires the following parameters:

Action outputs

The Enrich Entities action provides the following outputs:

Case wall table

The Enrich Entities action provides the following table on the Case Wall when Create Case Wall Table is selected:

• Table name: Report for: <var class="readonly">ENTITY_ID</var>
• Columns: Active Directory attribute names and values retrieved for the entity (or filtered by the Specific Attribute Names To Enrich With parameter if Should Case Wall Table be filtered by the specified Attributes? is selected).

Entity enrichment

The Enrich Entities action supports the following entity enrichment:

JSON result

The following example shows the JSON result output received when using the Enrich Entities action:

[
    {
        "EntityResult": {
            "primaryGroupID": [513],
            "logonCount": [6505],
            "cn": ["user name"],
            "countryCode": [0],
            "objectClass": ["top", "person", "organizationalPerson"],
            "userPrincipalName": ["user@example.com"],
            "adminCount": [1],
            "lastLogonTimestamp": ["2019-01-09 08:42:03.540783+00:00"],
            "manager": ["CN=user name,OU=R&D,OU=TLV,OU=host name,DC=domain,DC=LOCAL"],
            "instanceType": [4],
            "distinguishedName": ["CN=user name,OU=R&D,OU=TLV,OU=host,DC=domain,DC=LOCAL"],
            "dSCorePropagationData": ["2019-01-14 14:39:16+00:00"],
            "msDS-SupportedEncryptionTypes": [0],
            "objectSid": ["ID"],
            "whenCreated": ["2011-11-07 08:00:44+00:00"],
            "uSNCreated": [7288202],
            "lockoutTime": ["1601-01-01 00:00:00+00:00"],
            "badPasswordTime": ["date"],
            "pwdLastSet": ["date"],
            "sAMAccountName": ["example"],
            "objectCategory": ["CN=Person,CN=Schema,CN=Configuration,DC=host,DC=LOCAL"],
            "lastLogon": ["2019-01-14 17:13:54.463070+00:00"],
            "objectGUID": ["GUID"],
            "whenChanged": ["2019-01-14 16:49:01+00:00"],
            "badPwdCount": [1],
            "accountExpires": ["9999-12-31 23:59:59.999999"],
            "displayName": ["example user"],
            "name": ["user"],
            "memberOf": ["CN=\\\\u05e7\\\\u05d1\\\\u05d5\\\\u05e6\\\\u05d4 \\\\u05d1\\\\u05e2\\\\u05d1\\\\u05e8\\\\u05d9\\\\u05ea,OU=TEST,OU=QA,OU=IT,OU=TLV,OU=host,DC=domain,DC=LOCAL", "CN=Organization Management,OU=Microsoft Exchange Security Groups,DC=domain,DC=LOCAL", "CN=Local Admin,OU=Groups,OU=IT,OU=TLV,OU=host,DC=domain,DC=LOCAL"],
            "codePage": [0],
            "userAccountControl": [111],
            "sAMAccountType": [805306368],
            "uSNChanged": [15301168],
            "sn": ["example"],
            "givenName": ["user"],
            "lastLogoff": ["1601-01-01 00:00:00+00:00"]
        },
        "Entity": "user@example.com"
    }
]

Output messages

The Enrich Entities action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Enrich Entities action:

Force Password Update

Use the Force Password Update action to require users to change their password the next time they sign in. The action automatically targets the users attached to the case.

This action runs on the Google SecOps User entity.

Action inputs

None.

Action outputs

The Force Password Update action provides the following outputs:

Output messages

The Force Password Update action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Force Password Update action:

Get Group Members

Use the Get Group Members action to list the users, computers, or both that belong to a specific Active Directory group. You can optionally narrow the search to a specific Organizational Unit or parent group and include members from nested subgroups.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Group Members action requires the following parameters:

Action outputs

The Get Group Members action provides the following outputs:

Case wall table

The Get Group Members action provides the following table on the Case Wall:

• Table name: Members of Active Directory group: <var class="readonly">GROUP_NAME</var>
• Columns:
  • Distinguished Name
  • SAM Account Name
  • User Principal Name
  • Type

JSON result

The following example shows the JSON result output received when using the Get Group Members action:

[
  {
    "dn": "CN=Example User1,OU=User Accounts,DC=example,DC=local",
    "sAMAccountName": "ExampleUser1",
    "userPrincipalName": "user1@example.local",
    "type": "CN=Person,CN=Schema,CN=Configuration,DC=example,DC=local"
  },
  {
    "dn": "CN=Example User2,CN=Users,DC=example,DC=local",
    "sAMAccountName": "ExampleUser2",
    "userPrincipalName": "user2@example.local",
    "type": "CN=Person,CN=Schema,CN=Configuration,DC=example,DC=local"
  }
]

Output messages

The Get Group Members action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Group Members action:

Get Manager Contact Details

Use the Get Manager Contact Details action to look up the manager of a user in Active Directory and retrieve the manager's contact information. The action automatically targets the users attached to the case.

This action runs on the Google SecOps User entity.

Action inputs

None.

Action outputs

The Get Manager Contact Details action provides the following outputs:

Case wall table

The Get Manager Contact Details action provides the following table on the Case Wall:

• Table name: Manager Contact: <var class="readonly">ENTITY_ID</var>
• Columns:
  • Manager Name
  • Manager Phone

Entity enrichment

The Get Manager Contact Details action supports the following entity enrichment:

JSON result

The following example shows the JSON result output received when using the Get Manager Contact Details action:

[
   {
        "EntityResult":
        {
            "primaryGroupID": [513],
            "logonCount": [6505],
            "cn": ["user name"],
            "countryCode": [0],
            "objectClass": ["top", "person", "organizationalPerson"],
            "userPrincipalName": ["user@example.com"],
            "adminCount": [1],
            "lastLogonTimestamp": ["2019-01-09 08:42:03.540783+00:00"],
            "manager": ["CN=user name,OU=R&D,OU=TLV,OU=host name,DC=domain,DC=LOCAL"],
            "instanceType": [4],
            "distinguishedName": ["CN=user name,OU=R&D,OU=TLV,OU=host,DC=domain,DC=LOCAL"],
            "dSCorePropagationData": ["2019-01-14 14:39:16+00:00"],
            "msDS-SupportedEncryptionTypes": [0],
            "objectSid": ["ID"],
            "whenCreated": ["2011-11-07 08:00:44+00:00"],
            "uSNCreated": [7288202],
            "lockoutTime": ["1601-01-01 00:00:00+00:00"],
            "badPasswordTime": ["date"],
            "pwdLastSet": ["date"],
            "sAMAccountName": ["example"],
            "objectCategory": ["CN=Person,CN=Schema,CN=Configuration,DC=host,DC=LOCAL"],
            "lastLogon": ["2019-01-14 17:13:54.463070+00:00"],
            "objectGUID": ["GUID"],
            "whenChanged": ["2019-01-14 16:49:01+00:00"],
            "badPwdCount": [1],
            "accountExpires": ["9999-12-31 23:59:59.999999"],
            "displayName": ["example"],
            "name": ["user"],
            "memberOf": ["CN=\\\\u05e7\\\\u05d1\\\\u05d5\\\\u05e6\\\\u05d4 \\\\u05d1\\\\u05e2\\\\u05d1\\\\u05e8\\\\u05d9\\\\u05ea,OU=TEST,OU=QA,OU=IT,OU=TLV,OU=host,DC=domain,DC=LOCAL", "CN=Organization Management,OU=Microsoft Exchange Security Groups,DC=domain,DC=LOCAL", "CN=Local Admin,OU=Groups,OU=IT,OU=TLV,OU=host,DC=domain,DC=LOCAL"],
            "codePage": [0],
            "userAccountControl": [111],
            "sAMAccountType": [805306368],
            "uSNChanged": [15301168],
            "sn": ["example"],
            "givenName": ["user"],
            "lastLogoff": ["1601-01-01 00:00:00+00:00"]
        },
        "Entity": "user@example.com"
    }
]

Output messages

The Get Manager Contact Details action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Manager Contact Details action:

Is User In Group

Use the Is User In Group action to check whether specific users belong to a given Active Directory group. By default, the action checks the User entities in the case, or you can enter a comma-separated list of usernames in the User Name parameter to check specific accounts directly.

This action runs on the Google SecOps User entity.

Action inputs

The Is User In Group action requires the following parameters:

Action outputs

The Is User In Group action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Is User In Group action:

[
    {
        "EntityResult": true,
        "Entity": "USER1@EXAMPLE.COM"
    }, {
        "EntityResult": false,
        "Entity": "USER2@EXAMPLE.COM"
    }, {
        "EntityResult": true,
        "Entity": "USER3@EXAMPLE.COM"
    }
]

Output messages

The Is User In Group action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Is User In Group action:

List User Groups

Use the List User Groups action to retrieve a list of all Active Directory groups that a user belongs to. The action automatically targets the users attached to the case.

This action runs on the Google SecOps User entity.

Action inputs

None.

Action outputs

The List User Groups action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the List User Groups action:

[
    {
        "EntityResult": ["Domain Users"],
        "Entity": "user@example.com"
    }
]

Output messages

The List User Groups action can return the following output messages:

Script result

The following table lists the value for the script result output when using the List User Groups action:

Ping

Use the Ping action to verify that Google SecOps can connect and authenticate to your Active Directory server using the configured integration settings.

This action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Ping action provides the following outputs:

Output messages

The Ping action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Ping action:

Release Locked Account

Use the Release Locked Account action to unlock user accounts in Active Directory that were locked out after too many failed sign-in attempts. The action automatically targets the users attached to the case.

This action runs on the Google SecOps User entity.

Action inputs

None.

Action outputs

The Release Locked Account action provides the following outputs:

Output messages

The Release Locked Account action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Release Locked Account action:

Remove User From Group

Use the Remove User From Group action to remove users in the case from one or more Active Directory groups, such as revoking elevated group access during an incident. The action automatically identifies the target users from the case and removes them from the specified groups.

This action runs on the Google SecOps User entity.

Action inputs

The Remove User From Group action requires the following parameters:

Action outputs

The Remove User From Group action provides the following outputs:

Output messages

The Remove User From Group action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Remove User From Group action:

Search Active Directory

Use the Search Active Directory action to search your directory for users, computers, groups, or Organizational Units using built-in search conditions or a custom query. You can also filter the search by specific Organizational Units and choose which directory fields to include in the results.

This action doesn't run on Google SecOps entities.

Action inputs

The Search Active Directory action requires the following parameters:

Action outputs

The Search Active Directory action provides the following outputs:

Case wall table

The Search Active Directory action provides the following table on the Case Wall:

• Table name: Active Directory Search Results
• Columns: Active Directory attributes returned for the matching directory entries (based on Include Default Search Fields and Custom Fields).

JSON result

The following example shows the JSON result output received when using the Search Active Directory action:

[
      {
        "primaryGroupID": [
          513
        ],
        "logonCount": [
          6505
        ],
        "cn": [
          "user name"
        ],
        "countryCode": [
          0
        ],
        "objectClass": [
          "top",
          "person",
          "organizationalPerson"
        ],
        "userPrincipalName": [
          "user@example.com"
        ],
        "adminCount": [
          1
        ],
        "lastLogonTimestamp": [
          "2019-01-09 08:42:03.540783+00:00"
        ],
        "manager": [
          "CN=user name,OU=R&D,OU=TLV,OU=host name,DC=domain,DC=LOCAL"
        ],
        "instanceType": [
          4
        ],
        "distinguishedName": [
          "CN=user name,OU=R&D,OU=TLV,OU=host,DC=domain,DC=LOCAL"
        ],
        "dSCorePropagationData": [
          "2019-01-14 14:39:16+00:00"
        ],
        "msDS-SupportedEncryptionTypes": [
          0
        ],
        "objectSid": [
          "ID"
        ],
        "whenCreated": [
          "2011-11-07 08:00:44+00:00"
        ],
        "uSNCreated": [
          7288202
        ],
        "lockoutTime": [
          "1601-01-01 00:00:00+00:00"
        ],
        "badPasswordTime": [
          "date"
        ],
        "pwdLastSet": [
          "date"
        ],
        "sAMAccountName": [
          "example"
        ],
        "objectCategory": [
          "CN=Person,CN=Schema,CN=Configuration,DC=host,DC=LOCAL"
        ],
        "lastLogon": [
          "2019-01-14 17:13:54.463070+00:00"
        ],
        "objectGUID": [
          "GUID"
        ],
        "whenChanged": [
          "2019-01-14 16:49:01+00:00"
        ],
        "badPwdCount": [
          1
        ],
        "accountExpires": [
          "9999-12-31 23:59:59.999999"
        ],
        "displayName": [
          "example"
        ],
        "name": [
          "user"
        ],
        "memberOf": [
          "CN=\\\\u05e7\\\\u05d1\\\\u05d5\\\\u05e6\\\\u05d4 \\\\u05d1\\\\u05e2\\\\u05d1\\\\u05e8\\\\u05d9\\\\u05ea,OU=TEST,OU=QA,OU=IT,OU=TLV,OU=host,DC=domain,DC=LOCAL",
          "CN=Organization Management,OU=Microsoft Exchange Security Groups,DC=domain,DC=LOCAL",
          "CN=Local Admin,OU=Groups,OU=IT,OU=TLV,OU=host,DC=domain,DC=LOCAL"
        ],
        "codePage": [
          0
        ],
        "userAccountControl": [
          111
        ],
        "sAMAccountType": [
          805306368
        ],
        "uSNChanged": [
          15301168
        ],
        "sn": [
          "example"
        ],
        "givenName": [
          "user"
        ],
        "lastLogoff": [
          "1601-01-01 00:00:00+00:00"
        ]
      }
    ]

Output messages

The Search Active Directory action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Search Active Directory action:

Set User Password

Use the Set User Password action to reset the password for users in the case to a new password. Make sure the integration is connected over SSL (LDAPS) and that the new password meets your domain's password complexity rules.

This action runs on the Google SecOps User entity.

Action inputs

The Set User Password action requires the following parameters:

Action outputs

The Set User Password action provides the following outputs:

Output messages

The Set User Password action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Set User Password action:

Update attributes of an AD Host

Use the Update attributes of an AD Host action to update a specific directory property on computer accounts in the case, such as updating a computer's Description field with incident notes. The action automatically identifies the target computers from the case and applies the new value.

This action runs on the Google SecOps Hostname entity.

Action inputs

The Update attributes of an AD Host action requires the following parameters:

Action outputs

The Update attributes of an AD Host action provides the following outputs:

Output messages

The Update attributes of an AD Host action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Update attributes of an AD Host action:

Update attributes of an AD User

Use the Update attributes of an AD User action to update a specific directory property on user accounts in the case, such as updating a user's Description, title, or department field. The action automatically identifies the target users from the case and applies the new value.

This action runs on the Google SecOps User entity.

Action inputs

The Update attributes of an AD User action requires the following parameters:

Action outputs

The Update attributes of an AD User action provides the following outputs:

Output messages

The Update attributes of an AD User action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Update attributes of an AD User action:

Need more help? Get answers from Community members and Google SecOps professionals.