HIDS 60702
| Rule 1 | |
|---|---|
| Status | Active |
| Alert Message | Windows audit failure event |
Contents |
Description
This indicates that the VSS service has gone idle. It would indicate that a process before it (backup, restore, etc) has completed.
The Volume Shadow Copy Service (VSS) provides the ability to create a point in time image (shadow copy) of one or more volumes that can be used to perform backups. The service is also used during restores of applications.
What you should do
This is an auditing event, indicating that an action has completed. Some auditing frameworks may require this data to be collected. Otherwise, this rule requires no action and could be set to not log.
Troubleshooting
False Positives
There are no false positives with this rule.
Tuning Guidance
If it is not required, this rule can be set to not log or otherwise be disabled safely.
Additional Information
Support
If you are unsure about how to respond to this alert, please contact Atomicorp support. We're here to help you!
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
