Configure Users Data Using Server Configurations - Administrator Guide - 6.11 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.11
Creation date
2022-12-12
Last date published
2024-03-28
Category
Administrator Guide
Abstract

After removing a user, use server configurations to clear the user's data and replace the user in active incidents.

After you Remove a User from Cortex XSOAR, you need to delete the user's data. You can remove the data manually by using the CLI, or automate the process through a playbook, or through server configurations. Using server configurations can be used in multi-tenant environments (as the other methods are not available).

Note

  • When clearing users data, only active incidents and incidents are cleared. Incidents that have been closed are not changed.

  • Any invitation created by a deleted user is removed. If the deleted user is the invitee, the invite remains in the Invites table.

You can configure when you want to remove user's data, define the replacement user, whether to delete the list of deleted users, etc.

  1. Create a list of users you want to remove.

    1. Select SettingsADVANCEDListsAdd a List.

    2. Add a name for the list.

    3. In the Content Type field, select Text.

    4. Add the names of the users.

      If adding multiple names use separate lines for each name.

    5. Add the permission level.

      For example, for Read Only, you may want only read-only users to be able to see the list but for Read and edit, you may want both analyst and administrator to be able to edit.

    6. Save the list.

  2. Add the following server configurations by selecting SettingsABOUTTroubleshootingAdd Server Configuration.

    Key

    Description

    clear.users.data.job.enabled

    Set to true to clear the user's data. Default is false.

    clear.users.data.job.time

    Sets the time to run in Cron format to clear the users data. Default is every Sunday at 12AM. For example to run every minute, enter */1 * * * *.

    clear.users.data.job.userslist

    The name of the list you created in step 1.

    clear.users.data.job.clear.list

    Set to true to delete the list after the data is cleared. Default is false.

    clear.users.data.job.username

    The name of the replacement user. Default is admin.

    server.mask.git.commits

    Set to true to remove the users data from the git commit version that the user created (version control). For an example of version control in a playbook, see Version Control.

    Default is false.

  3. Restart the Cortex XSOAR server, by running the following command.

    systemctl restart demisto