When a user leaves the company, our IT department has a strict policy in place to deactivate the UserAccount instead of deleting it from the AD. This actually leaves a hole for us because Splunk will continue to sync the account as it does not understand the account has been deactivated within our AD. While this Answer post seems to fit my situation, I'd prefer to NOT hide the account, and just ignore it. Anyone know of a workaround to have Splunk ignore disabled accounts?? ... View more

I've disabled the Google search feature in ./SA-ThreatIntelligence/local/workflow_actions.conf and confirmed it is no longer a selectable feature in the ES Search UI and throughout, however, I still see it as an available option in the IR DB (Incident Review dashboard). Am I missing another conf file or setting outside of workflow? current settings: ./SA-ThreatIntelligence/local/workflow_actions.conf [Google] disabled = True display_location = field_menu fields = * label = Google $@field_value$ link.method = get link.uri = http://www.google.com/search?q=$@field_value$ type = link ... View more