diff --git a/playbooks/AWS_IAM_Account_Locking.json b/playbooks/AWS_IAM_Account_Locking.json index 2840dda35b..2df2c985c2 100644 --- a/playbooks/AWS_IAM_Account_Locking.json +++ b/playbooks/AWS_IAM_Account_Locking.json @@ -4,7 +4,7 @@ "category": "Account Locking", "coa": { "data": { - "description": "Accepts user name that needs to be disabled in AWS IAM Active Directory. Generates an observable output based on the status of account locking or disabling.", + "description": "Accepts user name that needs to be disabled in AWS IAM Active Directory. Disabling an account involves deleting their login profile which will clear the user's password. Generates an observable output based on the status of account locking or disabling.", "edges": [ { "id": "port_0_to_port_2", diff --git a/playbooks/AWS_IAM_Account_Locking.yml b/playbooks/AWS_IAM_Account_Locking.yml index 689f62789b..9430bcf0e1 100644 --- a/playbooks/AWS_IAM_Account_Locking.yml +++ b/playbooks/AWS_IAM_Account_Locking.yml @@ -4,7 +4,7 @@ version: 1 date: '2023-05-08' author: Teoderick Contreras, Splunk type: Investigation -description: "Accepts user, to be disabled using AWS IAM connector. This playbook produces a normalized observables output for each user and device." +description: "Accepts user name that needs to be disabled in AWS IAM Active Directory. Disabling an account involves deleting their login profile which will clear the user's password. Generates an observable output based on the status of account locking or disabling." playbook: AWS_IAM_Account_Locking how_to_implement: This input playbook requires the AWS IAM connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style.