PS C:\Users\BlueTeam>

SIEM Alerting Essentials: Server Local Groups and Users

Question: How often does your Local Group membership for Servers change? Question: How often does a local user account get created on a Server? Answer: Very Rare to never in most enterprise organizations For that reason these two events are prime SIEM Alert candidates for BlueTeams that offer a low false positive rate paired withContinue reading “SIEM Alerting Essentials: Server Local Groups and Users”


Something went wrong. Please refresh the page and/or try again.

Subscribe for Updates

Get new content delivered directly to your inbox.

%d bloggers like this: