Users

The disconnected SCN is not removed from the list of servers to which user rights apply.

Information about changes of the user account that has rights on the disconnected SCN is not sent to the SCN.

User accounts received from the PCN are not deleted.

You can create new user accounts again, as well as disable and change passwords for existing user accounts.

Alerts

Alert information on the disconnected SCN is deleted.

Operation history and all alert information is preserved.

Tasks

Tasks created on the disconnected SCN are deleted.

Tasks created on the PCN are deleted.

Information about users who created tasks on the SCN is preserved.

Reports

All reports created earlier concerning the disconnected SCN are preserved, as well as the ability to filter the report list by this server.

Templates and reports are not modified.

Prevention

Policies created on the disconnected SCN are deleted.

Policies created on the PCN are deleted.

Information about users who created policies on the SCN is preserved.

Storage

All objects related to the disconnected SCN are deleted from Storage.

All objects in the Storage are preserved.

The link to the task stops working in information about objects received as part of tasks created on the PCN.

TAA exclusions

No changes.

No changes.

VIP status

No changes.

No changes.

Notification rules

No changes.

No changes.

Integration with mail sensors

No changes.

No changes.

Threat Hunting

After the search query is processed, events related to the disconnected SCN are not displayed.

No changes.

Custom rules ‑ TAA and IOC

IOC and TAA (IOA) rules of a disconnected SCN are deleted.

IOC and TAA (IOA) rules created on the PCN are deleted.

Backup of the program

Backup of the program remains unavailable.

Backup of the program becomes available.