Active_Directory_Disable_Account_Dispatch.yml

name: Active Directory Disable Account Dispatch
id: 86320591-1bbd-41ab-8990-602a3968fd99
version: 1
date: '2023-05-23'
author: Teoderick Contreras, Splunk
type: Investigation
description: Automatically dispatches input playbooks with the 'disable_account' tag.
  This will produce a merge report and indicator tag for each inputs.
playbook: Active_Directory_Disable_Account_Dispatch
how_to_implement: This automatic playbook requires "disable_account" tag be present on each input playbook you want to launch.
references: []
app_list: 
  - AD LDAP
  - Azure AD Graph
tags:
  platform_tags:
    - user
    - D3-AL
    - disable_account
  playbook_type: Automation
  vpe_type: Modern
  playbook_fields: []
  product:
  - Splunk SOAR
  use_cases:
  - Phishing
  - Endpoint
  defend_technique_id: 
  - D3-AL