This article explain the default correlation rules included in SGBox Package Windows Audit [toggle title=”10079 – Win Audit – A disabled user was enabled and fails to logon” color=”Accent-Color” id=”b1″] [SGA][4722] Account Enabled > [SGA][4625] Logon Failed = TargetUserName (300sec) [/toggle] [toggle title=”10080 – Win Audit – A disabled user was enabled and logged on […]
The multi-events correlation rules A correlation rule is used to alert the admin when an event, or a series of events, occur in a specified time range. In order to create a multi-events rule following requirements are needed: Requirements: A mail server must be configured. Look this section to see how to configure a mail […]