Find devices which a user logged into in Tines

crowdstrike_user_lookup

{"agents":[{"disabled":false,"name":"Search for Hosts in Crowdstrike Falcon","options":"{\"url\":\"https://api.{{RESOURCE.crowdstrike_domain}}/devices/combined/host-group-members/v1\",\"content_type\":\"json\",\"method\":\"get\",\"payload\":{},\"headers\":{\"Authorization\":\"Bearer {{.CREDENTIAL.crowdstrike}}\"}}","position":{"x":-900,"y":75},"type":"httpRequest"},{"disabled":false,"name":"Get Logins for Hosts in Crowdstrike Falcon","options":"{\"url\":\"https://api.{{RESOURCE.crowdstrike_domain}}/devices/combined/devices/login-history/v1\",\"content_type\":\"json\",\"method\":\"post\",\"payload\":{\"ids\":\"{{search_for_hosts_in_crowdstrike_falcon.body.resources | map: 'device_id' | as_object}}\"},\"headers\":{\"Authorization\":\"Bearer {{.CREDENTIAL.crowdstrike}}\"}}","position":{"x":-900,"y":165},"type":"httpRequest"},{"disabled":false,"name":"Find User Hostname Combos","options":"{\"mode\":\"message_only\",\"loop\":false,\"payload\":{\"data\":\"{{get_logins_for_hosts_in_crowdstrike_falcon.body | jsonpath: .create_jsonpath.data | as_object}}\"}}","position":{"x":-900,"y":255},"type":"eventTransformation"},{"disabled":false,"name":"Confirm Webhook in Slack","options":"{\"secret\":\"90ef3c15c1d2d9d8ea38c902bf4cc468\",\"verbs\":\"get,post\",\"response_code\":\"200\",\"response\":\"{\\\"text\\\": \\\"On it!\\\"}\",\"response_headers\":{\"content-type\":\"application/json\"},\"path\":\"75b4072420db52391bb2e788a1d376a0\"}","position":{"x":-900,"y":-75},"type":"webhook"},{"disabled":false,"name":"Create JSONPath","options":"{\"mode\":\"message_only\",\"loop\":false,\"payload\":{\"data\":\"$.resources.[*].[?(@recent_logins.[*].user_name == 'CORP\\\\{{confirm_webhook_in_slack.body.text}}')]\"}}","position":{"x":-900,"y":0},"type":"eventTransformation"},{"disabled":false,"name":"Post Message to a Slack Channel using a Rich Notification","options":"{\"url\":\"https://slack.com/api/chat.postMessage\",\"content_type\":\"json\",\"method\":\"post\",\"payload\":{\"channel\":\"{{.confirm_webhook_in_slack.body.user_id}}\",\"attachments\":[{\"blocks\":[{\"type\":\"section\",\"text\":{\"type\":\"mrkdwn\",\"text\":\"We looked into username {{confirm_webhook_in_slack.body.text}} and found logins on {{search_for_hosts_by_id_in_crowdstrike_falcon.body.resources.first.hostname}}. Here are the details:\\n\\n```\\nDomain: {{search_for_hosts_by_id_in_crowdstrike_falcon.body.resources.first.machine_domain}}\\nExternal IP: {{search_for_hosts_by_id_in_crowdstrike_falcon.body.resources.first.external_ip}}\\nStatus: {{search_for_hosts_by_id_in_crowdstrike_falcon.body.resources.first.status}}\\nMAC Address: {{search_for_hosts_by_id_in_crowdstrike_falcon.body.resources.first.mac_address}}\\nSerial: {{search_for_hosts_by_id_in_crowdstrike_falcon.body.resources.first.serial}}\\n```\"}}]}]},\"headers\":{\"Authorization\":\"Bearer {{.CREDENTIAL.slack_forky}}\"}}","position":{"x":-900,"y":435},"type":"httpRequest"},{"disabled":false,"name":"Search for Hosts by ID in Crowdstrike Falcon","options":"{\"url\":\"https://api.{{RESOURCE.crowdstrike_domain}}/devices/combined/host-group-members/v1\",\"content_type\":\"json\",\"method\":\"get\",\"payload\":{\"ids\":[\"{{find_user_hostname_combos.data.first.device_id}}\"]},\"headers\":{\"Authorization\":\"Bearer {{.CREDENTIAL.crowdstrike}}\"}}","position":{"x":-900,"y":345},"type":"httpRequest"}],"links":[],"diagramNotes":[]}