Splunk - Actions

 


   




Comments

Post a Comment

Popular posts from this blog

Connection Config - STATUS_THRESHOLD_CONFIG

 {   "statusAndThresholdConfig": {    "inactivateAccountsNotInFile": true    "statusColumn":"userlock",    "activeStatus":["0","128","192"],     "accountThresholdValue": 500,     "deleteLinks": false,     "correlateInactiveAccounts": true,        } } ----------------------------------------------------------------------------- When account import run above STATUS_THRESHOLD_CONFIG is used to check. ----------------------------------- inactivateAccountsNotInFile  ==> True/false true ---> Account status 1/2 ( Active/Inactive) Day 1 --> 100 Accounts import Day 2 --> 90 Diff= 10  ( 90= Active , 10 Inactive)  ------------------------------------------------------------------------------ ----------------------------------- inactivateAccountsNotInFile  ==> True/false false ---> Account status 1/SFIS ( Active/SUSPENDED FROM IMPORT SERVICE.) Day 1 --> 100 Ac...
Read more

Enhanced Query - To Update Account Status and Name

select accountkey as accounts__primarykey, 'SUSPENDED FROM IMPORT SERVICE' as accounts__status, CONCAT(name,'-Deleted on-', DATE_FORMAT(NOW(), '%Y-%m-%d %H:%i:%s'))as accounts__name from accounts where endpointkey=527 and name='CN=INRVCH,OU=User Accounts Vista,OU=User Accounts,OU=User Directory,DC=asia-pac,DC=xx,DC=com'  and status not in ('SUSPENDED FROM IMPORT SERVICE') limit 1;
Read more

SQL - Connection table

 select EXTERNALCONNECTIONKEY,CONNECTIONDESCRIPTION,CONNECTIONNAME,CONNECTORMS,CREATEDBY,CREATEDON,CREDENTIALCHANGECONFIG,EMAILTEMPLATE,EXTERNALCONNECTIONTYPE,MSCONNECTORVERSION,NODE_MAC_ID,SSLCERTIFICATE,STATUS s,STATUSFORENABLEDISABLE,TEMPLATE_MANDATORYDATA,TEMPLATENAME,UPDATEDBY,UPDATEDON,VAULTCONFIG,VAULTCREDENTIALCONNECTION,CONNECTORTYPE  from externalconnection  SELECT   eh . connectionname ,         CASE           WHEN   eh . operation   =   'Remove'                AND   (   eh . newvalue   IS   NULL                       OR   eh . newvalue   =   ''   )   THEN   'ROLE_ADMIN'           ELSE   Conca...
Read more