Develop Response Action RA3601: Lock user account

[yugoslavskiy]

We are seeking for a help with Response Actions development. You are very welcome to contribute. Please use the existing placeholder for the RA3601: Lock user account, as well as the Response Action template and our contrib guide.

[dtclayton]

@yugoslavskiy is it possible to split "Lock user account" into 2 different actions? One for "Lock user account in AD" and then another for "Lock user account"...

The reason for this is that the response actions differ quite drastically whether the account is an AD account, or whether it is an account for a web service or something else.

[Karneades]

I think keeping lock user account is better than having a lock user account for each service/platform, lock user account on a cloud system is different again from a web service or AD. Then Azure AD vs on-prem AD, ... Response actions should be more generic (tool agnostic).

[yugoslavskiy]

Hello @dtclayton ! Sorry for the late reply, I missed this discussion completely. I agree with @Karneades . This is something that could be defined later as a sub-action. Will keep it in mind! Thank you for your proposal (: