HIDS 18259

From Atomicorp Wiki
Jump to: navigation, search
Rule 1
Status Active
Alert Message Windows audit event


[edit] Description

Windows Terminal Server has indicated that a user has disconnected.

[edit] What you should do

This means that an active (not attempted) user connection to terminal services has disconnected. It can be an element of the Incident Response chain to identify when a malicious user ceased connectivity with the Terminal Server.

For some regulatory frameworks, logon and logoff data is expected to be tracked.

[edit] Troubleshooting

[edit] False Positives

There are no false positives with this rule.

[edit] Tuning Guidance

There is no guidance for tuning this rule, this is a generic Windows event and the rule should not be disabled.

[edit] Additional Information

[edit] Support

If you are unsure about how to respond to this alert, please contact Atomicorp support. We're here to help you!

[edit] Similar Rules


[edit] Knowledge Base Articles


[edit] Outside References


[edit] Notes

Personal tools