On Wed, Jul 5, 2017 at 11:27 AM, Bob Boklewski
wrote:
> In the OSSEC.conf file I have level 3 logging set. I can't seem to get this
> rule to fire that is a predefined rule in the msauth_rules.xml file. I can
> see in the windows log event id: 4624, but it won't fire.
>
>
>
>
> 18104
>
In the OSSEC.conf file I have level 3 logging set. I can't seem to get
this rule to fire that is a predefined rule in the msauth_rules.xml file.
I can see in the windows log event id: 4624, but it won't fire.
18104
^528$|^540$|^673$|^4624$|^4769$
Windows Logon Success.
aut
