RSA Admin

crl-00103 will not fire - no alerts/views.

Discussion created by RSA Admin Employee on May 3, 2012
Latest reply on Jul 16, 2012 by securitysavy
Hi I do not get any alarms/alerts when adding a local user to local group administrators when using CRL-00103. My copy of the correlation rule is as the original. I have manually set up a rule for all windows machines. Here I do get alerts for same behavior on windows machines. In my system CRL-00103 only has one circut with one statement. Value: "User.Management.Groups.Modifications.User Added" I figure that it might be wrong setup. How do I get a "fresh" copy of the correlation rule? Thank you

Outcomes