Add/Delete User Information

[adem_netsys]

Hello,

We request that users who have just logged in or out of the company be removed from AD and that this be e-mailed to the necessary people. Has anyone written a playbook on this subject before?

Thanks in advance

[anerot-forti]

Hi,

That's not really clear for me what you want to achieve. Are you looking for a temporary AD account solution that removes a user account after a logout AD event and send an email to a specific email list?

Any way, login/out has to ba catched by a SIEM. The SOAR has the email list with corresponding AD group.

You buit a playbook triggered when the logout event is catched by the SIEM via an external API call or via a dedicated SIEM event pulled by FortiSOAR

Regards

[adem_netsys]

Hi @anerot-forti 

To explain, a new employee came to the company and a mail account will be opened on the Active Directory of this employee, and if this can be done through SOAR and informing the relevant people, managers, user notification by sms, etc. The reverse of this example should also be for a person who leaves the job. The e-mail address should be removed from the AD and the persons concerned should be informed of this. I can also query manually at the end of the day.

[anerot-forti]

Hi,

lucky you are, that's the "Automated Employee Onboarding" Solution Pack purpose. You have to adapt it a little bit but you will have everything you need.

Regards

[adem_netsys]

Hi @anerot-forti,

Thank you for response.