When a user leaves the company, our IT department has a strict policy in place to deactivate the UserAccount instead of deleting it from the AD. This actually leaves a hole for us because Splunk will continue to sync the account as it does not understand the account has been deactivated within our AD. While this Answer post seems to fit my situation, I'd prefer to NOT hide the account, and just ignore it. Anyone know of a workaround to have Splunk ignore disabled accounts?? ... View more

I've disabled the Google search feature in ./SA-ThreatIntelligence/local/workflow_actions.conf and confirmed it is no longer a selectable feature in the ES Search UI and throughout, however, I still see it as an available option in the IR DB (Incident Review dashboard). Am I missing another conf file or setting outside of workflow? current settings: ./SA-ThreatIntelligence/local/workflow_actions.conf [Google] disabled = True display_location = field_menu fields = * label = Google $@field_value$ link.method = get link.uri = http://www.google.com/search?q=$@field_value$ type = link ... View more

Anyone know if it is possible to send out alerts to either of these carriers via Splunk alerting? We've discontinued our BBM service and have migrated to the more popular providers. *We'd use email (obviously), but we've only been allocated up to 2GB of data per share plan. (\__/) (='.'=) (")_(") ... View more