Password Reset via Chatbot

Details
Content
Dependencies
Version History

Automates the process of resetting user passwords through a Slack or Teams message request to a chatbot.

Remember that time when you couldn't log in to your system because you forgot your password? Ever needed the help of IT just after they left for lunch?
Does a Slack channel full of messages asking to reset passwords sound familiar?

Well, this pack provides you with the perfect solution - resetting passwords automatically using a chatbot.
Resetting passwords through chatbots and automation can provide numerous benefits to organizations.
First, it can reduce the workload on IT departments by allowing users to reset their passwords quickly and easily without needing assistance. This can improve efficiency and reduce costs.
Additionally, using chatbots and automation for password resets can enhance the security of the organization by allowing for multifactor authentication and real-time monitoring of login attempts.
Furthermore, it can improve the user experience by providing a simple and intuitive interface for resetting passwords, which can help to reduce frustration and improve productivity.
By automating password resets, organizations can also ensure that password policies are consistently enforced, reducing the risk of security breaches.

What does this pack do?

Ingests an incident created by a user message on Slack or Microsoft Teams to reset their password.
Seeks approval for password resets from the relevant stakeholder.
Verifies the user using 2-factor authentication.
Creates a new password for the user, meeting the password complexity criteria of the organization.
Sets the new password for the user, requiring the user to change their password on next login.
Sends the new password to the user in a protected ZIP file, by email.
Sends the password to the ZIP file, containing the user's new password, to the user through Slack or Teams.

As part of this pack, you will also get an out-of-the-box layout to monitor and track the password resets in your organization.

What does this pack do?

Ingests an incident created by a user message on Slack or Microsoft Teams to reset their password.
Seeks approval for password resets from the relevant stakeholder.
Verifies the user using 2-factor authentication.
Creates a new password for the user, meeting the password complexity criteria of the organization.
Sets the new password for the user, requiring the user to change their password on next login.
Sends the new password to the user in a protected ZIP file, by email.
Sends the password to the ZIP file, containing the user's new password, to the user through Slack or Teams.

As part of this pack, you will also get an out-of-the-box layout to monitor and track the password resets in your organization.

Layouts

Name	Description
Password Reset via Chatbot

Incident Types

Name	Description
Password Reset via Chatbot

Playbooks

Name	Description
Reset User Password via Chatbot	This playbook resets the password of an Active Directory or Okta user. The process is as follows: A user requests a password reset using a chatbot in Slack or in Microsoft Teams. The playbook optionally seeks approval to reset the user's password from the relevant stakeholder, or from the user's manager. The request will be available for approval/disapproval for 1 hour. If not processed within that time, it will be disapproved. If the reset was approved, the playbook optionally verifies the user using 2-factor authentication, from the user's available 2FA methods on Okta. If the reset is verified, a new password will be created while meeting the complexity requirements of the organization. The user's password will be reset and set to the newly generated password. The user will be forced to change their password on next login. The new user's password will be placed inside a password-protected ZIP (protected by a different password). The encrypted ZIP file that contains the new password for the user will be sent to the user via email. The password for the ZIP file that contains the new user's password, will be sent to the requesting user through Slack or Teams. This playbook is intended for use with Slack or Teams. In order to use it, please make sure that you have a classifier and mapper in place. The classifier should create a Password Reset via Chatbot incident, while the mapper should map the email of the user to the Reporter Email Address field. This playbook assumes that the user requesting the password reset has the same email in Slack / Teams, and in Active Directory / Okta.

Name

Description

Reset User Password via Chatbot

This playbook resets the password of an Active Directory or Okta user. The process is as follows:

A user requests a password reset using a chatbot in Slack or in Microsoft Teams.
The playbook optionally seeks approval to reset the user's password from the relevant stakeholder, or from the user's manager. The request will be available for approval/disapproval for 1 hour. If not processed within that time, it will be disapproved.
If the reset was approved, the playbook optionally verifies the user using 2-factor authentication, from the user's available 2FA methods on Okta.
If the reset is verified, a new password will be created while meeting the complexity requirements of the organization.
The user's password will be reset and set to the newly generated password. The user will be forced to change their password on next login.
The new user's password will be placed inside a password-protected ZIP (protected by a different password).
The encrypted ZIP file that contains the new password for the user will be sent to the user via email.
The password for the ZIP file that contains the new user's password, will be sent to the requesting user through Slack or Teams.

This playbook is intended for use with Slack or Teams. In order to use it, please make sure that you have a classifier and mapper in place. The classifier should create a Password Reset via Chatbot incident, while the mapper should map the email of the user to the Reporter Email Address field.
This playbook assumes that the user requesting the password reset has the same email in Slack / Teams, and in Active Directory / Okta.

Incident Types

Name	Description
Password Reset via Chatbot

Playbooks

Name	Description
Reset User Password via Chatbot	This playbook resets the password of an Active Directory or Okta user. The process is as follows: A user requests a password reset using a chatbot in Slack or in Microsoft Teams. The playbook optionally seeks approval to reset the user's password from the relevant stakeholder, or from the user's manager. The request will be available for approval/disapproval for 1 hour. If not processed within that time, it will be disapproved. If the reset was approved, the playbook optionally verifies the user using 2-factor authentication, from the user's available 2FA methods on Okta. If the reset is verified, a new password will be created while meeting the complexity requirements of the organization. The user's password will be reset and set to the newly generated password. The user will be forced to change their password on next login. The new user's password will be placed inside a password-protected ZIP (protected by a different password). The encrypted ZIP file that contains the new password for the user will be sent to the user via email. The password for the ZIP file that contains the new user's password, will be sent to the requesting user through Slack or Teams. This playbook is intended for use with Slack or Teams. In order to use it, please make sure that you have a classifier and mapper in place. The classifier should create a Password Reset via Chatbot alert, while the mapper should map the email of the user to the Reporter Email Address field. This playbook assumes that the user requesting the password reset has the same email in Slack / Teams, and in Active Directory / Okta.

Name

Description

Reset User Password via Chatbot

This playbook resets the password of an Active Directory or Okta user. The process is as follows:

A user requests a password reset using a chatbot in Slack or in Microsoft Teams.
The playbook optionally seeks approval to reset the user's password from the relevant stakeholder, or from the user's manager. The request will be available for approval/disapproval for 1 hour. If not processed within that time, it will be disapproved.
If the reset was approved, the playbook optionally verifies the user using 2-factor authentication, from the user's available 2FA methods on Okta.
If the reset is verified, a new password will be created while meeting the complexity requirements of the organization.
The user's password will be reset and set to the newly generated password. The user will be forced to change their password on next login.
The new user's password will be placed inside a password-protected ZIP (protected by a different password).
The encrypted ZIP file that contains the new password for the user will be sent to the user via email.
The password for the ZIP file that contains the new user's password, will be sent to the requesting user through Slack or Teams.

This playbook is intended for use with Slack or Teams. In order to use it, please make sure that you have a classifier and mapper in place. The classifier should create a Password Reset via Chatbot alert, while the mapper should map the email of the user to the Reporter Email Address field.
This playbook assumes that the user requesting the password reset has the same email in Slack / Teams, and in Active Directory / Okta.

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Okta	By: Cortex XSOAR
Common Types	By: Cortex XSOAR

All level dependencies (5)

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	April 19, 2023
Last Release	April 19, 2023

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.