HIDS 59240
From Atomicorp Wiki
| Rule 1 | |
|---|---|
| Status | Active |
| Alert Message | Windows audit event |
Contents |
Description
A security enabled group has been created in Active Directory.
What you should do
This means a new group with Security rights has been created in Active Directory. Users in the Security group will have access to audit configuration, and data. Review if this was an authorized change.
For some regulatory frameworks, collecting this for auditing reporting may be required.
Troubleshooting
False Positives
There are no false positives with this rule.
Tuning Guidance
There is no guidance for tuning this rule, this is an auditing event and the rule should not be disabled.
Additional Information
Support
If you are unsure about how to respond to this alert, please contact Atomicorp support. We're here to help you!
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
