Hello,
I need help accessing the value from a specific key within the returned results of a UDM query via a playbook.
I am looking to use the value from the key “isManaged” within a condition.
For example:
- if isManaged == “True” take branch 1
- else, take branch 2
I am struggling to isolate the specific value from that key to use within a conditional action.
Here is an example JSON which is returned from the UDM Query within the playbook:
{
"events": [
{
"name": "[REDACTED_EVENT_NAME]",
"udm": {
"metadata": {
"productLogId": "[REDACTED_PRODUCT_LOG_ID]",
"eventTimestamp": "2025-08-21T14:43:04Z",
"eventType": "USER_LOGIN",
"vendorName": "Microsoft",
"productName": "Azure AD",
"ingestedTimestamp": "2025-08-21T14:49:01.321370Z",
"id": "[REDACTED_METADATA_ID]",
"enrichmentState": "ENRICHED",
"logType": "AZURE_AD",
"baseLabels": { "logTypes": ["AZURE_AD"], "allowScopedAccess": true },
"enrichmentLabels": {
"logTypes": ["AZURE_AD_CONTEXT", "CS_EDR"],
"allowScopedAccess": true
}
},
"additional": {
"riskState": "none",
"conditionalAccessStatus": "notApplied",
"failureReason": "Error validating credentials due to invalid username or password.",
"riskDetail": "none",
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none"
},
"principal": {
"hostname": "[REDACTED_HOSTNAME]",
"assetId": "Device ID:[REDACTED_ASSET_ID]",
"platform": "WINDOWS",
"ip": ["[REDACTED_IP_ADDRESS]"],
"administrativeDomain": "example.com",
"application": "Mobile Apps and Desktop clients",
"platformVersion": "Windows",
"location": {
"city": "[REDACTED_CITY]",
"state": "Haryana",
"countryOrRegion": "IN",
"regionLatitude": 0.0,
"regionLongitude": 0.0,
"regionCoordinates": { "latitude": 0.0, "longitude": 0.0 }
},
"asset": {
"hostname": "[REDACTED_HOSTNAME]",
"assetId": "Device ID:[REDACTED_ASSET_ID]",
"ip": ["[REDACTED_IP_ADDRESS]"],
"hardware": [
{
"manufacturer": "HP",
"model": "HP ProBook 640 G8 Notebook PC"
},
{ "model": "[REDACTED_HOSTNAME]" }
],
"platformSoftware": {
"platform": "WINDOWS",
"platformPatchLevel": "Windows 11"
},
"location": { "city": "[REDACTED_CITY]", "countryOrRegion": "India" },
"networkDomain": "none",
"attribute": {
"labels": [
{ "key": "agent_version", "value": "7.28.20006.0" },
{ "key": "agent_load_flags", "value": "17" },
{ "key": "bios_manufacture", "value": "HP" },
{ "key": "config_build", "value": "1007.3.0020006.11" },
{ "key": "continent", "value": "Asia" },
{ "key": "host_hidden_status", "value": "Visible" },
{ "key": "pointer_size", "value": "8" },
{ "key": "service_pack_major", "value": "none" },
{ "key": "site_name", "value": "none" },
{ "key": "cid", "value": "[REDACTED_CID]" },
{ "key": "isCompliant", "value": "true" },
{ "key": "isManaged", "value": "true" },
{ "key": "trustType", "value": "Azure AD joined" }
]
},
"natIp": ["[REDACTED_IP_ADDRESS]"],
"firstSeenTime": "2025-08-21T12:32:44Z"
},
"ipGeoArtifact": [
{
"ip": "[REDACTED_IP_ADDRESS]",
"location": {
"state": "Haryana",
"countryOrRegion": "India",
"regionLatitude": 0.0,
"regionLongitude": 0.0,
"regionCoordinates": {
"latitude": 0.0,
"longitude": 0.0
}
},
"network": {
"asn": "[REDACTED_ASN]",
"dnsDomain": "redacted-isp.com",
"carrierName": "REDACTED ISP NAME",
"organizationName": "REDACTED ISP NAME"
}
}
]
},
"target": {
"user": {
"userid": "user.name@example.com",
"userDisplayName": "John Doe",
"emailAddresses": [
"user.name@example.com"
],
"employeeId": "[REDACTED_EMPLOYEE_ID]",
"productObjectId": "[REDACTED_USER_OBJECT_ID]",
"attribute": {
"labels": [
{ "key": "accountEnabled", "value": "true" },
{ "key": "IsOnCloudAccount", "value": "true" },
{ "key": "mailNickname", "value": "user.name" },
{
"key": "userPrincipalName",
"value": "user.name@example.com"
},
{
"key": "refreshTokensValidFromDateTime",
"value": "2025-05-12T11:11:43Z"
},
{ "key": "manager_src_usageLocation", "value": "GB" }
],
"roles": [{ "name": "Member" }],
"creationTime": "2022-08-24T08:34:28Z"
},
"firstName": "John",
"lastName": "Doe",
"title": "Technology Specialist",
"department": ["Technology & Product"],
"managers": [
{
"userDisplayName": "Jane Smith",
"emailAddresses": [
"manager.name@example.com"
],
"employeeId": "[REDACTED_MANAGER_ID]",
"productObjectId": "[REDACTED_MANAGER_OBJECT_ID]",
"attribute": {
"labels": [
{ "key": "manager accountEnabled", "value": "true" },
{
"key": "userPrincipalName",
"value": "manager.name@example.com"
},
{
"key": "refreshTokensValidFromDateTime",
"value": "2025-05-12T11:11:43Z"
}
],
"roles": [{ "name": "Member" }]
},
"firstName": "Jane",
"lastName": "Smith",
"title": "Technology Operations Manager",
"department": ["Technology & Product"]
}
],
"userAuthenticationStatus": "ACTIVE"
},
"application": "Windows Sign In",
"resource": {
"id": " [removed by moderator] -c [removed by moderator] 00",
"name": "Windows Azure Active Directory",
"attribute": {
"labels": [
{
"key": "App Id",
"value": "38aa3b87-a06d-4817-b275-7a316988d93b"
}
]
},
"productObjectId": " [removed by moderator] -c [removed by moderator] 00"
}
},
"securityResult": [
{
"category": ["AUTH_VIOLATION"],
"summary": "Failed login occurred",
"description": "The user didn't enter the right credentials. \u00a0It's expected to see some number of these errors in your logs due to users making mistakes.",
"action": ["BLOCK"],
"severity": "ERROR",
"ruleId": "50126",
"detectionFields": [
{ "key": "is_interactive", "value": "true" },
{
"key": "CorrelationId",
"value": "[REDACTED_CORRELATION_ID]"
}
]
}
],
"extensions": {
"auth": { "type": "SSO", "mechanism": ["INTERACTIVE"] }
}
}
}
]
}
Any help on this would be great!
Thanks
