Remove or disable users in Cortex XSOAR.
In Cortex XSOAR, you can permanently remove a user, or temporarily disable a user. Users should be permanently removed if they no longer have access to the system.
When you delete users, all their personal information is deleted, including email address, username, phone number, first and last names, and their image. To remove their data from content, such as active incidents and investigations, automations you need to clear the user's data.
Note
You cannot disable or remove the default admin user created at system installation.
When you remove a user, the user’s API keys are automatically revoked and can no longer be used. Any reports the user has created remain available. Reports are not owned by specific users and can be edited or deleted by other users.
Delete the user.
Go to → → .
Select the User you want to delete.
Click .
If the user is a default admin, you need to select and deselect .
Confirm that you want to delete the user.
To clear the user's data, do one of the following: