I have a job that ran that disabled an Active Directory account. I don’t yet have any of my workflows enabled yet so I’ve been trying without success to figure out what how that happened or what triggered it but cannot see anything in the details of the job. Where would I see that?
Thx,
Craig
Was it part of the active response snippets? Are any snippets enabled on the workflow page? You should see from the first action in the job details what fired it off. If it was snippets you should also see an artifact in the IDR investigation from which it was executed.
Could it have been a test run? These can run without the Workflow being enabled