Add Discovery Method of Internal > Deprovisioning

[swidup]

include a discovery method of Internal> Exit interview and decommissioning (or something like that) for when the breach is found as part of process for offboarding an employee. We've encountered this before where the employees who have access to sensitive data routinely have their devices sent for investigation as part of the off boarding process. Many breaches have been found after the fact this way.

[gdbassett]

discovery_method.internal.variety.Offboarding: "Use when the incident is discovered during the exit interview or offboarding/decommissioning of an employee."