HIDS 18259
From Atomicorp Wiki
| Rule 1 | |
|---|---|
| Status | Active |
| Alert Message | Windows audit event |
Contents |
Description
Windows Terminal Server has indicated that a user has disconnected.
What you should do
This means that an active (not attempted) user connection to terminal services has disconnected. It can be an element of the Incident Response chain to identify when a malicious user ceased connectivity with the Terminal Server.
For some regulatory frameworks, logon and logoff data is expected to be tracked.
Troubleshooting
False Positives
There are no false positives with this rule.
Tuning Guidance
There is no guidance for tuning this rule, this is a generic Windows event and the rule should not be disabled.
Additional Information
Support
If you are unsure about how to respond to this alert, please contact Atomicorp support. We're here to help you!
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
