i am trying to run the canned correlation rule NIC026 for workstation logins from same user. I need to have this rule run only against my domain controllers and also filter out some user accounts. I am new to correlation rules. I do not have an option to set a filter when this is loaded.
any help would be great