This article explain the default correlation rules included in SGBox Package Windows Audit [toggle title=”10079 – Win Audit – A disabled user was enabled and fails to logon” color=”Accent-Color” id=”b1″] [SGA][4722] Account Enabled > [SGA][4625] Logon Failed = TargetUserName (300sec) [/toggle] [toggle title=”10080 – Win Audit – A disabled user was enabled and logged on […]