Active_Directory_Disable_Account_Dispatch.yml

name: Active Directory Disable Account Dispatch
id: 86320591-1bbd-41ab-8990-602a3968fd99
version: 2
creation_date: '2023-05-23'
modification_date: '2026-05-19'
author: Teoderick Contreras, Splunk
type: Investigation
description: Automatically dispatches input playbooks with the 'disable_account' tag. This will produce a merge report and indicator tag for each inputs.
playbook: Active_Directory_Disable_Account_Dispatch
how_to_implement: This automatic playbook requires "disable_account" tag be present on each input playbook you want to launch.
references: []
app_list:
    - AD LDAP
    - Azure AD Graph
platform_tags:
    - user
    - D3-AL
    - disable_account
playbook_type: Automation
vpe_type: Modern
playbook_fields: []
product:
    - Splunk SOAR
use_cases:
    - Phishing
    - Endpoint
defend_technique_id:
    - D3-AL