RSA Admin

Help with canned rue NIC026

Discussion created by RSA Admin Employee on Feb 25, 2010
Latest reply on Mar 11, 2010 by RSA Admin

i am trying to run the canned correlation rule NIC026 for workstation logins from same user.  I need to have this rule run only against my domain controllers and also filter out some user accounts.  I am new to correlation rules.  I do  not have an option to set a filter when this is loaded.

any help would be great

Outcomes