disable savedsearches by default

Author: romain-filigran

TA-opencti-for-splunk-enterprise/package/default/savedsearches.conf

@@ -8,7 +8,8 @@ search = | inputlookup opencti_markings \
 | outputlookup append=true opencti_markings
 description = Updates the opencti_markings lookup with new and updated marking definitions
 schedule = */15 * * * *
-enabled = 1
+enableSched = 1
+disabled = 1
 dispatch.earliest_time = -15m
 dispatch.latest_time = now
 cron_schedule = */15 * * * *
@@ -44,9 +45,8 @@ search = `opencti_index` sourcetype="opencti:indicator" (event="create" OR event
     | outputlookup append=t opencti_indicators
 description = Incrementally upserts OpenCTI indicators into the opencti_indicators KV Store using the latest modified event per id.
 schedule = */5 * * * *
-enabled = 1
-disabled = 0
-is_scheduled = 1
+enableSched = 1
+disabled = 1
 dispatch.earliest_time = -15m
 dispatch.latest_time = now
 cron_schedule = */5 * * * *
@@ -81,9 +81,8 @@ search = `opencti_index` sourcetype="opencti:indicator" (event="create" OR event
     | outputlookup opencti_indicators
 description = Nightly full rebuild of the OpenCTI Indicators KV store. Ensures only the latest version per id remains and clears stale entries.
 schedule = 30 2 * * *
-enabled = 1
-disabled = 0
-is_scheduled = 1
+enableSched = 1
+disabled = 1
 dispatch.earliest_time = 0
 dispatch.latest_time = now
 cron_schedule = 30 2 * * *
@@ -111,7 +110,8 @@ search = | inputlookup opencti_reports \
 | outputlookup opencti_reports
 description = Updates the opencti_reports lookup with new and updated reports, while flagging deleted ones.
 schedule = 0 * * * *
-enabled = 1
+enableSched = 1
+disabled = 1
 dispatch.earliest_time = -60m
 dispatch.latest_time = now
 cron_schedule = 0 * * * *
@@ -143,9 +143,8 @@ search = | inputlookup opencti_indicators \
             threat_confidence threat_weight \
     | outputlookup opencti_threatintel
 description = Rebuilds the ES Threat Intelligence KV from the enriched opencti_indicators KV.
-is_scheduled = 1
 cron_schedule = */5 * * * *
-disabled = 0
+disabled = 1
 dispatch.earliest_time = 0
 dispatch.latest_time = now
 alert.suppress = 0