Playbook Disable

[argwfm]

Is there a global.sls flag or some other way to disable Playbook functionality?

[InfosecGoon]

You could disable anonymous accounts, which would keep analysts from being able to log into it.

https://docs.securityonion.net/en/2.3/playbook.html#disable-anonymous-access-and-create-user-accounts

[argwfm]

Was able to disable by modifying the manager pillar w/ playbook: 0.
Then updated so-status.conf and commented out #so-playbook and #so-mysql.