Deactivate a User - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
8
Creation date
2024-02-14
Last date published
2024-04-24
Category
Administrator Guide
Solution
Cloud
Abstract

Deactivate users.

You can deactivate a user in Cortex XSOAR usually if they need access again at a later date. All user information is maintained for deactivated users. Users should be permanently removed if they should no longer have access to the system through Customer Support Portal.

Note

You cannot deactivate Account Admin users.

If the user is assigned to incidents or tasks or is the owner of a dashboard, these assignments do not automatically change when the user is removed or disabled. We recommend changing incident and task assignments manually before removing or deactivating users.

Any reports the user has created remain available. Reports are not owned by specific users and can be edited or deleted by other users.

Note

When you remove a role, the role associated with the API keys is deleted.

  • If more than one role was associated with the API key, a yellow warning symbol appears next to the API key in the API key table. When you hover over the symbol, a message indicates that some of the roles associated with the API key had been deleted.

  • If all roles associated with the API key are removed, a red warning symbol appears appears next to the API key in the API key table. When you hover over that symbol, a message indicates that the key is no longer usable because it does not have a role associated with it. The API key is still visible in the API table but it cannot be assigned.

When a user is deactivated, API keys that the user created are not revoked.

To reassign incidents and tasks and disable or remove users:

  1. Go to the Incidents page and search for -status:closed owner:user_name to find any incidents the user is assigned to. Reassign any open incidents to another user.

  2. Go to the Incidents page and search for -status:closed investigation.users:user_name. Reassign tasks to another user.

    When a user is assigned a task in an incident, the user is added to the incident. This search finds all incidents where the user is a participant.

  3. Go to Settings & Info → Settings → Access Management → Users and select the user.

  4. Right-click the user and then select Deactivate User and then Deactivate to confirm.