After removing a user, use server configurations to clear the user's data and replace the user in active incidents.
After you Remove a User from Cortex XSOAR, you need to delete the user's data. You can remove the data manually by using the CLI, or automate the process through a playbook, or through server configurations. Using server configurations can be used in multi-tenant environments (as the other methods are not available).
Note
When clearing users data, only active incidents and incidents are cleared. Incidents that have been closed are not changed.
Any invitation created by a deleted user is removed. If the deleted user is the invitee, the invite remains in the Invites table.
You can configure when you want to remove user's data, define the replacement user, whether to delete the list of deleted users, etc.
Create a list of users you want to remove.
Select
→ → → .Add a name for the list.
In the Content Type field, select Text.
Add the names of the users.
If adding multiple names use separate lines for each name.
Add the permission level.
For example, for
, you may want only read-only users to be able to see the list but for , you may want both analyst and administrator to be able to edit.Save the list.
Add the following server configurations by selecting
→ → → .Key
Description
clear.users.data.job.enabled
Set to
true
to clear the user's data. Default isfalse
.clear.users.data.job.time
Sets the time to run in Cron format to clear the users data. Default is every Sunday at 12AM. For example to run every minute, enter
*/1 * * * *
.clear.users.data.job.userslist
The name of the list you created in step 1.
clear.users.data.job.clear.list
Set to
true
to delete the list after the data is cleared. Default isfalse
.clear.users.data.job.username
The name of the replacement user. Default is
admin
.server.mask.git.commits
Set to
true
to remove the users data from the git commit version that the user created (version control). For an example of version control in a playbook, see Version Control.Default is
false
.Restart the Cortex XSOAR server, by running the following command.
systemctl restart demisto