Splunk Enterprise Security

Splunk Enterprise Security: When a user account is deleted, what happens to Incidents closed or resolved by that user?

Builder

HI

I have to remove a user account in Splunk. What happens to the incidents closed or resolved by that user?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

View solution in original post

Splunk Employee
Splunk Employee

I took a user, assigned notable events to them made some edits and then deleted the user. The audit is intact with the user and the notable events in the ui show them as the owner. Those names are not scrubbed from the kvstore. I would want to maintain some sort of a search to identify terminated employees who have notable events assigned to them so those events don't stay hanging out there.

View solution in original post