Hello,
The sensitive logons rule uses the security log and as I have experienced and see in other posts here that you have to do some crazy fine tuning. Well, I've fine tuned it, and results are always inconsistent and generates a lot of false positives.
There is another datasource, Intrust User Session Tracking, which I have very successfully recording all logon events (103, which is basically the summary of a session). Unfortunately, I want to compare the username to the workstation name so it only alerts on anomalous connections like it should work in the sensitive logons rule.
I've looked at the xml on both my rule and the sensitive logons rule, but as I'm not a coder, I can't make heads or tails. Also I assume the inputs from the different datasources would make a huge difference in what fields need to be called. A colleague of mine who's a developer was wondering if an instring comparison could be made between the username and the computer name.
Anyone have any thoughts on this?
Thanks!