|Alert Message||Windows audit event|
A security enabled group has been created in Active Directory.
What you should do
This means a new group with Security rights has been created in Active Directory. Users in the Security group will have access to audit configuration, and data. Review if this was an authorized change.
For some regulatory frameworks, collecting this for auditing reporting may be required.
There are no false positives with this rule.
There is no guidance for tuning this rule, this is an auditing event and the rule should not be disabled.
If you are unsure about how to respond to this alert, please contact Atomicorp support. We're here to help you!
Knowledge Base Articles