Filter Out computer name in some Rules

benybb over 3 years ago

Hello,

I wish to filter out the computer name in some rules.

The rules makes False alerts with the computer name as user name.

How exactely can i do that ?

Thanks in advance

*********

Rule (I) : Member added to an administrative group

Member DOMAIN\JCT_Level_1_Support added to group Builtin\Administrators by DOMAIN\ELEC-403-111$.

Alert was generated on computer ELEC-403-111.DOMAIN.COM.

***************
Rule (I) : Change Password Attempt on Administrative Account

There was administrative account password change attempt by DOMAIN\LAU106-54-90$ user. Target account: LAU106-54-90\admin.

Alert was generated on computer LAU106-54-90.DOMAIN.COM.

****************
Rule (A) : User Account enabled by unauthorized personnel

Account T-LEC-9205\Ladmin enabled by DOMAIN\T-LEC-9205$.

Alert was generated on computer t-lec-9205.DOMAIN.COM

****************
Rule (A) : Multiple failed logons by the same user

There were 5 failed logons by user ADMIN\SAFECOM-LEV-ADM$ from workstation SAFECOM-LEV-ADM.

Alert was generated on computer p-baruch.DOMAIN.COM.

Parents

0 Igor.Ilyin over 3 years ago

The second one, "Change password attempt on administrative account with computer account filtering"

Change password attempt on administrative account with computer account filtering.xml

<?xml version="1.0" encoding="utf-8" ?>

<!--
==============================================================================

Copyright 2020 Quest Software Inc. ALL RIGHTS RESERVED.

$Workfile: Change password attempt on administrative account with computer account filtering.xml $
$Revision: 0 $
$Modtime: 7/1/2020 9:02:47 AM $

==============================================================================
THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
==============================================================================
-->

<ITRTProcessingRule original_parent="\Configuration\Objects\{F81E88B8-5629-4698-AEB7-38731A4B1520}\RuleGroups\{C54162A9-E4D0-4747-97A1-8B0FFF7E0B85}\Rules">
	<LimitEventsCount>10</LimitEventsCount>
	<SuppressBySeverity>0</SuppressBySeverity>
	<Description><![CDATA[This rule is matched when there is a successful or unsuccessful attempt to change the password of an administrative account.
The rule's parameters are the list of users (Accounts List) and the list of groups the users are member of (Groups List). When specifying parameters, include groups with whose members password changes you want to monitor.
The rule has no response actions.]]></Description>
	<GenerateAlert>1</GenerateAlert>
	<AlertInitialState>0</AlertInitialState>
	<Name>Change password attempt on administrative account, with computer account filtering</Name>
	<Guid>{F026F480-6DF5-45A4-BE42-FF67098476AB}</Guid>
	<MatchCondition>010000005D0B00003C003F0078006D006C002000760065007200730069006F006E003D00220031002E00300022003F003E000D000A003C00720075006C006500200074007900700065003D002200520045004C0022002000760065007200730069006F006E003D00220031002E00300022003E000D000A003C0061007200670075006D0065006E00740073003E000D000A0020002000200020003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D0022004100630063006F0075006E007400730020004C00690073007400220020006E0061006D0065003D0022004100630063006F0075006E007400730020004C006900730074002200200063006C006100730073003D0022004C00690073007400220020006400650073006300720069007000740069006F006E003D002200410020006C0069007300740020006F00660020007400610072006700650074002000610064006D0069006E0069007300740072006100740069007600650020006100630063006F0075006E007400730020006E0061006D006500730022003E000D000A00200020002000200020002000200020003C00760061006C00750065003E0022002A005C005C00410064006D0069006E006900730074007200610074006F00720022003C002F00760061006C00750065003E000D000A0020002000200020003C002F0061007200670075006D0065006E0074003E000D000A0020002000200020003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D002200470072006F0075007000730020004C00690073007400220020006E0061006D0065003D002200470072006F0075007000730020004C006900730074002200200063006C006100730073003D0022004C00690073007400220020006400650073006300720069007000740069006F006E003D002200410020006C0069007300740020006F00660020007400610072006700650074002000670072006F00750070007300200066006F00720020006D0061006E006100670069006E006700200070006F006C0069006300690065007300200069006E00200061006E0020006F007200670061006E0069007A006100740069006F006E0022003E000D000A00200020002000200020002000200020003C00760061006C00750065003E00220044006F006D00610069006E002000410064006D0069006E00730022002C0020002200470072006F0075007000200050006F006C006900630079002000430072006500610074006F00720020004F0077006E006500720022002C0020002200410064006D0069006E006900730074007200610074006F007200730022002C002000220045006E00740065007200700072006900730065002000410064006D0069006E00730022003C002F00760061006C00750065003E000D000A0020002000200020003C002F0061007200670075006D0065006E0074003E000D000A0020002000200020003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D00220043006F006E007300690064006500720020004F00700065007200610074006F007200200043006F006D007000750074006500720020004100630063006F0075006E0074007300220020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E0074007300220020006400650073006300720069007000740069006F006E003D002200300020002D0020006500780063006C0075006400650020006F00700065007200610074006F007200200063006F006D007000750074006500720020006100630063006F0075006E00740073002000660072006F006D00200063006F006E00730069006400650072006100740069006F006E002C002000310020002D00200063006F006E007300690064006500720020006F00700065007200610074006F007200200063006F006D007000750074006500720020006100630063006F0075006E00740073002E002200200063006C006100730073003D0022004E0075006D0062006500720022003E000D000A00200020002000200020002000200020003C00760061006C00750065003E0030003C002F00760061006C00750065003E000D000A0020002000200020003C002F0061007200670075006D0065006E0074003E000D000A003C002F0061007200670075006D0065006E00740073003E000D000A003C00700072006500660069006C007400650072003E000D000A004500760065006E0074004900440020003D002000340037003200330020006F00720020004500760065006E0074004900440020003D00200034003700320034003B000D000A003C002F00700072006500660069006C007400650072003E000D000A003C0062006F00640079003E000D000A000D000A006400650066002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E007400280070006100720061006D002C0020007300740072004E00290020003A003D000D000A007B000D000A0020002000200020006E006F007400280070006100720061006D0020003D0020003000200061006E0064002000730075006200730074007200280020007300740072004E002C0020007300740072006C0065006E0028007300740072004E00290020002D00200031002C00200031002000290020003D00200022002400220029000D000A007D000D000A000D000A006400650066002000760061006C00690064006100740065005200650073006F006C007600650064005400610072006700650074004100630063006F0075006E0074002800290020003A003D000D000A007B000D000A002000200020002000630068006F006F0073006500280028004500760065006E0074004900440020003D002000340037003200330029002C000D000A002000200020002000200020002000200020002000200069006E002800200053007400720069006E006700310031002C00200022007700690022002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004100630063006F0075006E007400730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E00290029000D000A00200020002000200020002000200020002000200020006F0072000D000A00200020002000200020002000200020002000200020006D0065006D006200650072005F006F0066002800200053007400720069006E006700310031002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D002200470072006F0075007000730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E0029002C0020007400720075006500200029002C000D000A002000200020002000200020002000200020002000200069006E002800200053007400720069006E006700310030002C00200022007700690022002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004100630063006F0075006E007400730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E00290029000D000A00200020002000200020002000200020002000200020006F0072000D000A00200020002000200020002000200020002000200020006D0065006D006200650072005F006F0066002800200053007400720069006E006700310030002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D002200470072006F0075007000730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E0029002C0020007400720075006500200029000D000A00200020002000200020002000200020002000200029000D000A007D000D000A000D000A006400650066002000760061006C00690064006100740065005200650073006F006C007600650064004F00700065007200610074006F0072004100630063006F0075006E0074002800290020003A003D000D000A007B000D000A002000200020002000630068006F006F0073006500280028004500760065006E0074004900440020003D002000340037003200330029002C000D000A0020002000200020002000200020002000200020002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E00740028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E007400730022003E003C002F0070006100720061006D0065007400650072003E002C00200053007400720069006E0067003100320029002C000D000A0020002000200020002000200020002000200020002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E00740028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E007400730022003E003C002F0070006100720061006D0065007400650072003E002C00200053007400720069006E0067003100310029000D000A00200020002000200020002000200020002000200029000D000A007D000D000A000D000A0064006500660020007300650074004F00700065007200610074006F0072004100630063006F0075006E0074004600690065006C00640073002800290020003A003D000D000A007B000D000A0020002000200020007300650074005F0061006C006500720074005F006600690065006C006400280022004F00700065007200610074006F00720044006F006D00610069006E0022002C00200053007400720069006E00670036002C002000740072007500650029000D000A00200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022004F00700065007200610074006F0072004E0061006D00650022002C00200053007400720069006E00670035002C002000740072007500650029000D000A007D000D000A000D000A0064006500660020007300650074005400610072006700650074004100630063006F0075006E0074004600690065006C00640073002800290020003A003D000D000A007B000D000A002000200020002000630068006F006F00730065002800280053007400720069006E0067003100200021003D0020002200220029002C000D000A00200020002000200020002000200020002000200020007300650074005F0061006C006500720074005F006600690065006C0064002800220054006100720067006500740044006F006D00610069006E0022002C00200053007400720069006E00670032002C002000740072007500650029000D000A002000200020002000200020002000200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022005400610072006700650074004E0061006D00650022002C00200053007400720069006E00670031002C002000740072007500650029002C000D000A0020002000200020002000200020002000200020002000630068006F006F0073006500280028004500760065006E0074004900440020003D002000340037003200330029002C000D000A0020002000200020002000200020002000200020002000200020002000200020007300650074005F0061006C006500720074005F006600690065006C0064002800220054006100720067006500740044006F006D00610069006E0022002C002000730075006200730074007200280053007400720069006E006700310031002C00200030002C002000730074007200730074007200280053007400720069006E006700310031002C00200022005C005C002200290029002C002000740072007500650029000D000A00200020002000200020002000200020002000200020002000200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022005400610072006700650074004E0061006D00650022002C002000730075006200730074007200280053007400720069006E006700310031002C002000730074007200730074007200280053007400720069006E006700310031002C00200022005C005C002200290020002B00200031002C0020002D00310029002C002000740072007500650029002C000D000A0020002000200020002000200020002000200020002000200020002000200020007300650074005F0061006C006500720074005F006600690065006C0064002800220054006100720067006500740044006F006D00610069006E0022002C002000730075006200730074007200280053007400720069006E006700310030002C00200030002C002000730074007200730074007200280053007400720069006E006700310030002C00200022005C005C002200290029002C002000740072007500650029000D000A00200020002000200020002000200020002000200020002000200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022005400610072006700650074004E0061006D00650022002C002000730075006200730074007200280053007400720069006E006700310030002C002000730074007200730074007200280053007400720069006E006700310030002C00200022005C005C002200290020002B00200031002C0020002D00310029002C002000740072007500650029000D000A002000200020002000200020002000200020002000200029000D000A00200020002000200020002000200020002000200029000D000A007D000D000A000D000A0028004500760065006E0074004900440020003D002000340037003200330020006F00720020004500760065006E0074004900440020003D002000340037003200340029000D000A0061006E0064002000760061006C00690064006100740065005200650073006F006C007600650064005400610072006700650074004100630063006F0075006E007400280029000D000A0061006E0064002000760061006C00690064006100740065005200650073006F006C007600650064004F00700065007200610074006F0072004100630063006F0075006E007400280029000D000A0061006E0064002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E00740028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E007400730022003E003C002F0070006100720061006D0065007400650072003E002C00200053007400720069006E006700350029000D000A0061006E00640020007300650074004F00700065007200610074006F0072004100630063006F0075006E0074004600690065006C0064007300280029000D000A0061006E00640020007300650074005400610072006700650074004100630063006F0075006E0074004600690065006C0064007300280029003B000D000A000D000A003C002F0062006F00640079003E000D000A003C002F00720075006C0065003E000D000A00</MatchCondition>
	<AlertSeverity>48</AlertSeverity>
	<Enabled>1</Enabled>
	<SuppressByAlertCode>0</SuppressByAlertCode>
	<Schedule>FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00</Schedule>
	<VendorKnowledgeBase>01000000900000004300680061006E00670065007300200074006F0020007400680065002000700061007300730077006F0072006400730020006F0066002000610064006D0069006E0069007300740072006100740069007600650020006100630063006F0075006E00740073002000730068006F0075006C00640020006200650020006D006F006E00690074006F0072006500640020006300610072006500660075006C006C007900200073006F00200079006F0075002000630061006E002000700072006F006D00700074006C007900200072006500610063007400200074006F00200061006E007900200075006E00770061007200720061006E007400650064002000700061007300730077006F007200640020006300680061006E006700650073002E00</VendorKnowledgeBase>
	<ConditionType>{E00EE0F1-B3DF-4122-89B4-738EF5EC1C52}</ConditionType>
	<SuppressByName>0</SuppressByName>
	<AlertSuppression>0</AlertSuppression>
	<CustomerKnowledgeBase>0100000000000000</CustomerKnowledgeBase>
	<Distribution></Distribution>
	<AlertName>There was administrative account %Target Domain%\%Target Name% password change attempt by %Operator Domain%\%Operator Name% user</AlertName>
	<SuppressByRuleID>0</SuppressByRuleID>
	<DoNotSaveEvents>0</DoNotSaveEvents>
	<SuppressByHostName>0</SuppressByHostName>
	<Condition></Condition>
	<AlertComment></AlertComment>
	<FilterCondition>0100000000000000</FilterCondition>
	<AlertDescription></AlertDescription>
	<ScheduleEnabled>0</ScheduleEnabled>
	<SuppressBySiteID>0</SuppressBySiteID>
	<AlertAssignment></AlertAssignment>
	<RuleDistribution>0</RuleDistribution>
	<AlertCode>AE_AD_ATP_0055 (2)</AlertCode>
	<NotificationFormats>
		<ITRTNotificationFormat>
			<Guid>{1F0E5507-19CA-4523-9544-379577240A55}</Guid>
			<ComposerTemplate>01000000F834885B1C14B949960CC37CE508B1D02100000049006E005400720075007300740020002500530065007600650072006900740079002500200061006C0065007200740020002D00200025004E0061006D0065002500050000007500740066002D003800ED01000025004400650073006300720069007000740069006F006E0025000D000A000A000A0041006C0065007200740020007700610073002000670065006E0065007200610074006500640020006F006E00200063006F006D00700075007400650072002000250041006C006500720074002E0048006F00730074004E0061006D00650025002E000A0041006C0065007200740020007700610073002000670065006E006500720061007400650064002000610074002000250041006C006500720074002E00540069006D006500470065006E006500720061007400650064004C006F00630061006C00250020002800250041006C006500720074002E00540069006D006500470065006E006500720061007400650064002500200047004D00540029002E000D000A000A000A0046006F007200200061006C00650072007400200069006E0066006F0072006D006100740069006F006E002C00200066006F006C006C006F007700200074006800650020006C0069006E006B00200074006F0020004D006F006E00690074006F00720069006E006700200043006F006E0073006F006C0065003A00200025006F007200670070006100720061006D003A005700450042004D004F004E00490054004F005200550052004C002500250061006C006500720074002E0061006C006500720074006900640025000D000A000A0046006F00720020006500760065006E007400200061006E0061006C0079007300690073002C00200066006F006C006C006F007700200074006800650020006C0069006E006B00200074006F0020004900540020005300650063007500720069007400790020005300650061007200630068003A002000220025006F007200670070006100720061006D003A0049005400530065006100720063006800410064006400720065007300730025002F0023002F007300650061007200630068002F006500760065006E00740073003F0071003D004500760065006E00740049004400250025003300440025004500760065006E007400490044002500250025003200300041004E004400250025003200300049006E00730065007200740069006F006E0053007400720069006E006700310025002500330044002500250032003200250053007400720069006E006700310025002500250032003200250025003200300041004E0044002500250032003000570068006F00250025003300440025002500320032002500570068006F0025002500250032003200250025003200300041004E00440025002500320030005700680065007200650025002500330044002500250032003200250057006800650072006500250025002500320032002200</ComposerTemplate>
			<ComposerId>{C40DBB2E-DF56-43AC-8392-EFB2D0DDCC5A}</ComposerId>
			<Enabled>1</Enabled>
			<NotificationType>{E01E93C2-938C-4BBD-88D9-0FD3B0E631E4}</NotificationType>
		</ITRTNotificationFormat>
	</NotificationFormats>
	<DataSources>
		<ITRTRuleDataSource>
			<Guid>{F8F6F35D-800C-441E-BA0E-77485E4A66A2}</Guid>
			<DataSourceId>{A8CFC803-CDAD-47C5-B195-4C043A4F4BC7}</DataSourceId>
		</ITRTRuleDataSource>
	</DataSources>
	<ResponseActions>
		<ITRTResponseAction>
			<ProviderConfig>010000000F0000003200350035002E003200350035002E003200350035002E00320035003500060000007000750062006C006900630001000000360003000000310030003000100000000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000001000000060F000000250061006C006500720074002E0041006C006500720074004900640025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000A000000060E000000250061006C006500720074002E00520075006C0065004900440025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000B0000000610000000250061006C006500720074002E00520075006C0065004E0061006D00650025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000C0000000610000000250061006C006500720074002E0048006F00730074004E0061006D00650025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000D0000000612000000250061006C006500720074002E005300650072007600650072004E0061006D00650025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000E0000000613000000250061006C006500720074002E00470065006E006500720061007400650064004F006E0025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000F0000000611000000250061006C006500720074002E0041006C0065007200740043006F006400650025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000020000000615000000250061006C006500720074002E00540069006D006500470065006E0065007200610074006500640025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000003000000061A000000250061006C006500720074002E00540069006D006500470065006E006500720061007400650064004C006F00630061006C0025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000004000000060D000000250061006C006500720074002E005300740061007400650025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000005000000060C000000250061006C006500720074002E004E0061006D00650025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000060000000613000000250061006C006500720074002E004400650073006300720069007000740069006F006E0025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000070000000610000000250061006C006500720074002E005300650076006500720069007400790025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000008000000060F000000250061006C006500720074002E0043006F006D006D0065006E00740025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000090000000612000000250061006C006500720074002E00410073007300690067006E006500640054006F0025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000010000000062700000025006F007200670070006100720061006D003A005700450042004D004F004E00490054004F005200550052004C002500250061006C006500720074002E0061006C00650072007400690064002500</ProviderConfig>
			<Guid>{85711607-36E4-49F1-99A2-BE64696F8223}</Guid>
			<Timeout>0</Timeout>
			<Distribution></Distribution>
			<Enabled>0</Enabled>
			<ProviderId>{C3DFC923-4037-4C1B-A652-77767EBAF710}</ProviderId>
			<ExecutionOrder>0</ExecutionOrder>
			<Destination>0</Destination>
		</ITRTResponseAction>
	</ResponseActions>
	<AlertFields>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{02F9E93F-B840-4EFF-9F28-50AF93DD0059}</Guid>
			<FieldValue>%TargetDomain%</FieldValue>
			<FieldName>Target Domain</FieldName>
		</ITRTAlertField>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{303C6431-1187-418C-A23A-35C866A98B44}</Guid>
			<FieldValue>%OperatorDomain%</FieldValue>
			<FieldName>Operator Domain</FieldName>
		</ITRTAlertField>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{FF48C2E0-2C66-4B00-B708-B600C92908EB}</Guid>
			<FieldValue>%TargetName%</FieldValue>
			<FieldName>Target Name</FieldName>
		</ITRTAlertField>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{C591135F-51D9-4D53-A9FB-8CA6D3FE7485}</Guid>
			<FieldValue>%OperatorName%</FieldValue>
			<FieldName>Operator Name</FieldName>
		</ITRTAlertField>
	</AlertFields>
</ITRTProcessingRule>

Reply

0 Igor.Ilyin over 3 years ago

The second one, "Change password attempt on administrative account with computer account filtering"

Change password attempt on administrative account with computer account filtering.xml

<?xml version="1.0" encoding="utf-8" ?>

<!--
==============================================================================

Copyright 2020 Quest Software Inc. ALL RIGHTS RESERVED.

$Workfile: Change password attempt on administrative account with computer account filtering.xml $
$Revision: 0 $
$Modtime: 7/1/2020 9:02:47 AM $

==============================================================================
THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
==============================================================================
-->

<ITRTProcessingRule original_parent="\Configuration\Objects\{F81E88B8-5629-4698-AEB7-38731A4B1520}\RuleGroups\{C54162A9-E4D0-4747-97A1-8B0FFF7E0B85}\Rules">
	<LimitEventsCount>10</LimitEventsCount>
	<SuppressBySeverity>0</SuppressBySeverity>
	<Description><![CDATA[This rule is matched when there is a successful or unsuccessful attempt to change the password of an administrative account.
The rule's parameters are the list of users (Accounts List) and the list of groups the users are member of (Groups List). When specifying parameters, include groups with whose members password changes you want to monitor.
The rule has no response actions.]]></Description>
	<GenerateAlert>1</GenerateAlert>
	<AlertInitialState>0</AlertInitialState>
	<Name>Change password attempt on administrative account, with computer account filtering</Name>
	<Guid>{F026F480-6DF5-45A4-BE42-FF67098476AB}</Guid>
	<MatchCondition>010000005D0B00003C003F0078006D006C002000760065007200730069006F006E003D00220031002E00300022003F003E000D000A003C00720075006C006500200074007900700065003D002200520045004C0022002000760065007200730069006F006E003D00220031002E00300022003E000D000A003C0061007200670075006D0065006E00740073003E000D000A0020002000200020003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D0022004100630063006F0075006E007400730020004C00690073007400220020006E0061006D0065003D0022004100630063006F0075006E007400730020004C006900730074002200200063006C006100730073003D0022004C00690073007400220020006400650073006300720069007000740069006F006E003D002200410020006C0069007300740020006F00660020007400610072006700650074002000610064006D0069006E0069007300740072006100740069007600650020006100630063006F0075006E007400730020006E0061006D006500730022003E000D000A00200020002000200020002000200020003C00760061006C00750065003E0022002A005C005C00410064006D0069006E006900730074007200610074006F00720022003C002F00760061006C00750065003E000D000A0020002000200020003C002F0061007200670075006D0065006E0074003E000D000A0020002000200020003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D002200470072006F0075007000730020004C00690073007400220020006E0061006D0065003D002200470072006F0075007000730020004C006900730074002200200063006C006100730073003D0022004C00690073007400220020006400650073006300720069007000740069006F006E003D002200410020006C0069007300740020006F00660020007400610072006700650074002000670072006F00750070007300200066006F00720020006D0061006E006100670069006E006700200070006F006C0069006300690065007300200069006E00200061006E0020006F007200670061006E0069007A006100740069006F006E0022003E000D000A00200020002000200020002000200020003C00760061006C00750065003E00220044006F006D00610069006E002000410064006D0069006E00730022002C0020002200470072006F0075007000200050006F006C006900630079002000430072006500610074006F00720020004F0077006E006500720022002C0020002200410064006D0069006E006900730074007200610074006F007200730022002C002000220045006E00740065007200700072006900730065002000410064006D0069006E00730022003C002F00760061006C00750065003E000D000A0020002000200020003C002F0061007200670075006D0065006E0074003E000D000A0020002000200020003C0061007200670075006D0065006E007400200064006900730070006C00610079006E0061006D0065003D00220043006F006E007300690064006500720020004F00700065007200610074006F007200200043006F006D007000750074006500720020004100630063006F0075006E0074007300220020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E0074007300220020006400650073006300720069007000740069006F006E003D002200300020002D0020006500780063006C0075006400650020006F00700065007200610074006F007200200063006F006D007000750074006500720020006100630063006F0075006E00740073002000660072006F006D00200063006F006E00730069006400650072006100740069006F006E002C002000310020002D00200063006F006E007300690064006500720020006F00700065007200610074006F007200200063006F006D007000750074006500720020006100630063006F0075006E00740073002E002200200063006C006100730073003D0022004E0075006D0062006500720022003E000D000A00200020002000200020002000200020003C00760061006C00750065003E0030003C002F00760061006C00750065003E000D000A0020002000200020003C002F0061007200670075006D0065006E0074003E000D000A003C002F0061007200670075006D0065006E00740073003E000D000A003C00700072006500660069006C007400650072003E000D000A004500760065006E0074004900440020003D002000340037003200330020006F00720020004500760065006E0074004900440020003D00200034003700320034003B000D000A003C002F00700072006500660069006C007400650072003E000D000A003C0062006F00640079003E000D000A000D000A006400650066002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E007400280070006100720061006D002C0020007300740072004E00290020003A003D000D000A007B000D000A0020002000200020006E006F007400280070006100720061006D0020003D0020003000200061006E0064002000730075006200730074007200280020007300740072004E002C0020007300740072006C0065006E0028007300740072004E00290020002D00200031002C00200031002000290020003D00200022002400220029000D000A007D000D000A000D000A006400650066002000760061006C00690064006100740065005200650073006F006C007600650064005400610072006700650074004100630063006F0075006E0074002800290020003A003D000D000A007B000D000A002000200020002000630068006F006F0073006500280028004500760065006E0074004900440020003D002000340037003200330029002C000D000A002000200020002000200020002000200020002000200069006E002800200053007400720069006E006700310031002C00200022007700690022002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004100630063006F0075006E007400730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E00290029000D000A00200020002000200020002000200020002000200020006F0072000D000A00200020002000200020002000200020002000200020006D0065006D006200650072005F006F0066002800200053007400720069006E006700310031002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D002200470072006F0075007000730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E0029002C0020007400720075006500200029002C000D000A002000200020002000200020002000200020002000200069006E002800200053007400720069006E006700310030002C00200022007700690022002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004100630063006F0075006E007400730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E00290029000D000A00200020002000200020002000200020002000200020006F0072000D000A00200020002000200020002000200020002000200020006D0065006D006200650072005F006F0066002800200053007400720069006E006700310030002C0020006100720072006100790028003C0070006100720061006D00650074006500720020006E0061006D0065003D002200470072006F0075007000730020004C0069007300740022003E003C002F0070006100720061006D0065007400650072003E0029002C0020007400720075006500200029000D000A00200020002000200020002000200020002000200029000D000A007D000D000A000D000A006400650066002000760061006C00690064006100740065005200650073006F006C007600650064004F00700065007200610074006F0072004100630063006F0075006E0074002800290020003A003D000D000A007B000D000A002000200020002000630068006F006F0073006500280028004500760065006E0074004900440020003D002000340037003200330029002C000D000A0020002000200020002000200020002000200020002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E00740028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E007400730022003E003C002F0070006100720061006D0065007400650072003E002C00200053007400720069006E0067003100320029002C000D000A0020002000200020002000200020002000200020002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E00740028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E007400730022003E003C002F0070006100720061006D0065007400650072003E002C00200053007400720069006E0067003100310029000D000A00200020002000200020002000200020002000200029000D000A007D000D000A000D000A0064006500660020007300650074004F00700065007200610074006F0072004100630063006F0075006E0074004600690065006C00640073002800290020003A003D000D000A007B000D000A0020002000200020007300650074005F0061006C006500720074005F006600690065006C006400280022004F00700065007200610074006F00720044006F006D00610069006E0022002C00200053007400720069006E00670036002C002000740072007500650029000D000A00200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022004F00700065007200610074006F0072004E0061006D00650022002C00200053007400720069006E00670035002C002000740072007500650029000D000A007D000D000A000D000A0064006500660020007300650074005400610072006700650074004100630063006F0075006E0074004600690065006C00640073002800290020003A003D000D000A007B000D000A002000200020002000630068006F006F00730065002800280053007400720069006E0067003100200021003D0020002200220029002C000D000A00200020002000200020002000200020002000200020007300650074005F0061006C006500720074005F006600690065006C0064002800220054006100720067006500740044006F006D00610069006E0022002C00200053007400720069006E00670032002C002000740072007500650029000D000A002000200020002000200020002000200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022005400610072006700650074004E0061006D00650022002C00200053007400720069006E00670031002C002000740072007500650029002C000D000A0020002000200020002000200020002000200020002000630068006F006F0073006500280028004500760065006E0074004900440020003D002000340037003200330029002C000D000A0020002000200020002000200020002000200020002000200020002000200020007300650074005F0061006C006500720074005F006600690065006C0064002800220054006100720067006500740044006F006D00610069006E0022002C002000730075006200730074007200280053007400720069006E006700310031002C00200030002C002000730074007200730074007200280053007400720069006E006700310031002C00200022005C005C002200290029002C002000740072007500650029000D000A00200020002000200020002000200020002000200020002000200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022005400610072006700650074004E0061006D00650022002C002000730075006200730074007200280053007400720069006E006700310031002C002000730074007200730074007200280053007400720069006E006700310031002C00200022005C005C002200290020002B00200031002C0020002D00310029002C002000740072007500650029002C000D000A0020002000200020002000200020002000200020002000200020002000200020007300650074005F0061006C006500720074005F006600690065006C0064002800220054006100720067006500740044006F006D00610069006E0022002C002000730075006200730074007200280053007400720069006E006700310030002C00200030002C002000730074007200730074007200280053007400720069006E006700310030002C00200022005C005C002200290029002C002000740072007500650029000D000A00200020002000200020002000200020002000200020002000200020002000200061006E00640020007300650074005F0061006C006500720074005F006600690065006C006400280022005400610072006700650074004E0061006D00650022002C002000730075006200730074007200280053007400720069006E006700310030002C002000730074007200730074007200280053007400720069006E006700310030002C00200022005C005C002200290020002B00200031002C0020002D00310029002C002000740072007500650029000D000A002000200020002000200020002000200020002000200029000D000A00200020002000200020002000200020002000200029000D000A007D000D000A000D000A0028004500760065006E0074004900440020003D002000340037003200330020006F00720020004500760065006E0074004900440020003D002000340037003200340029000D000A0061006E0064002000760061006C00690064006100740065005200650073006F006C007600650064005400610072006700650074004100630063006F0075006E007400280029000D000A0061006E0064002000760061006C00690064006100740065005200650073006F006C007600650064004F00700065007200610074006F0072004100630063006F0075006E007400280029000D000A0061006E0064002000760061006C006900640061007400650043006F006D00700075007400650072004100630063006F0075006E00740028003C0070006100720061006D00650074006500720020006E0061006D0065003D0022004F00700065007200610074006F00720043006F006D00700075007400650072004100630063006F0075006E007400730022003E003C002F0070006100720061006D0065007400650072003E002C00200053007400720069006E006700350029000D000A0061006E00640020007300650074004F00700065007200610074006F0072004100630063006F0075006E0074004600690065006C0064007300280029000D000A0061006E00640020007300650074005400610072006700650074004100630063006F0075006E0074004600690065006C0064007300280029003B000D000A000D000A003C002F0062006F00640079003E000D000A003C002F00720075006C0065003E000D000A00</MatchCondition>
	<AlertSeverity>48</AlertSeverity>
	<Enabled>1</Enabled>
	<SuppressByAlertCode>0</SuppressByAlertCode>
	<Schedule>FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00FFFFFF00</Schedule>
	<VendorKnowledgeBase>01000000900000004300680061006E00670065007300200074006F0020007400680065002000700061007300730077006F0072006400730020006F0066002000610064006D0069006E0069007300740072006100740069007600650020006100630063006F0075006E00740073002000730068006F0075006C00640020006200650020006D006F006E00690074006F0072006500640020006300610072006500660075006C006C007900200073006F00200079006F0075002000630061006E002000700072006F006D00700074006C007900200072006500610063007400200074006F00200061006E007900200075006E00770061007200720061006E007400650064002000700061007300730077006F007200640020006300680061006E006700650073002E00</VendorKnowledgeBase>
	<ConditionType>{E00EE0F1-B3DF-4122-89B4-738EF5EC1C52}</ConditionType>
	<SuppressByName>0</SuppressByName>
	<AlertSuppression>0</AlertSuppression>
	<CustomerKnowledgeBase>0100000000000000</CustomerKnowledgeBase>
	<Distribution></Distribution>
	<AlertName>There was administrative account %Target Domain%\%Target Name% password change attempt by %Operator Domain%\%Operator Name% user</AlertName>
	<SuppressByRuleID>0</SuppressByRuleID>
	<DoNotSaveEvents>0</DoNotSaveEvents>
	<SuppressByHostName>0</SuppressByHostName>
	<Condition></Condition>
	<AlertComment></AlertComment>
	<FilterCondition>0100000000000000</FilterCondition>
	<AlertDescription></AlertDescription>
	<ScheduleEnabled>0</ScheduleEnabled>
	<SuppressBySiteID>0</SuppressBySiteID>
	<AlertAssignment></AlertAssignment>
	<RuleDistribution>0</RuleDistribution>
	<AlertCode>AE_AD_ATP_0055 (2)</AlertCode>
	<NotificationFormats>
		<ITRTNotificationFormat>
			<Guid>{1F0E5507-19CA-4523-9544-379577240A55}</Guid>
			<ComposerTemplate>01000000F834885B1C14B949960CC37CE508B1D02100000049006E005400720075007300740020002500530065007600650072006900740079002500200061006C0065007200740020002D00200025004E0061006D0065002500050000007500740066002D003800ED01000025004400650073006300720069007000740069006F006E0025000D000A000A000A0041006C0065007200740020007700610073002000670065006E0065007200610074006500640020006F006E00200063006F006D00700075007400650072002000250041006C006500720074002E0048006F00730074004E0061006D00650025002E000A0041006C0065007200740020007700610073002000670065006E006500720061007400650064002000610074002000250041006C006500720074002E00540069006D006500470065006E006500720061007400650064004C006F00630061006C00250020002800250041006C006500720074002E00540069006D006500470065006E006500720061007400650064002500200047004D00540029002E000D000A000A000A0046006F007200200061006C00650072007400200069006E0066006F0072006D006100740069006F006E002C00200066006F006C006C006F007700200074006800650020006C0069006E006B00200074006F0020004D006F006E00690074006F00720069006E006700200043006F006E0073006F006C0065003A00200025006F007200670070006100720061006D003A005700450042004D004F004E00490054004F005200550052004C002500250061006C006500720074002E0061006C006500720074006900640025000D000A000A0046006F00720020006500760065006E007400200061006E0061006C0079007300690073002C00200066006F006C006C006F007700200074006800650020006C0069006E006B00200074006F0020004900540020005300650063007500720069007400790020005300650061007200630068003A002000220025006F007200670070006100720061006D003A0049005400530065006100720063006800410064006400720065007300730025002F0023002F007300650061007200630068002F006500760065006E00740073003F0071003D004500760065006E00740049004400250025003300440025004500760065006E007400490044002500250025003200300041004E004400250025003200300049006E00730065007200740069006F006E0053007400720069006E006700310025002500330044002500250032003200250053007400720069006E006700310025002500250032003200250025003200300041004E0044002500250032003000570068006F00250025003300440025002500320032002500570068006F0025002500250032003200250025003200300041004E00440025002500320030005700680065007200650025002500330044002500250032003200250057006800650072006500250025002500320032002200</ComposerTemplate>
			<ComposerId>{C40DBB2E-DF56-43AC-8392-EFB2D0DDCC5A}</ComposerId>
			<Enabled>1</Enabled>
			<NotificationType>{E01E93C2-938C-4BBD-88D9-0FD3B0E631E4}</NotificationType>
		</ITRTNotificationFormat>
	</NotificationFormats>
	<DataSources>
		<ITRTRuleDataSource>
			<Guid>{F8F6F35D-800C-441E-BA0E-77485E4A66A2}</Guid>
			<DataSourceId>{A8CFC803-CDAD-47C5-B195-4C043A4F4BC7}</DataSourceId>
		</ITRTRuleDataSource>
	</DataSources>
	<ResponseActions>
		<ITRTResponseAction>
			<ProviderConfig>010000000F0000003200350035002E003200350035002E003200350035002E00320035003500060000007000750062006C006900630001000000360003000000310030003000100000000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000001000000060F000000250061006C006500720074002E0041006C006500720074004900640025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000A000000060E000000250061006C006500720074002E00520075006C0065004900440025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000B0000000610000000250061006C006500720074002E00520075006C0065004E0061006D00650025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000C0000000610000000250061006C006500720074002E0048006F00730074004E0061006D00650025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000D0000000612000000250061006C006500720074002E005300650072007600650072004E0061006D00650025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000E0000000613000000250061006C006500720074002E00470065006E006500720061007400650064004F006E0025000C010000000300000006000000010000000400000001000000850F0000010000000200000001000000010000000F0000000611000000250061006C006500720074002E0041006C0065007200740043006F006400650025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000020000000615000000250061006C006500720074002E00540069006D006500470065006E0065007200610074006500640025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000003000000061A000000250061006C006500720074002E00540069006D006500470065006E006500720061007400650064004C006F00630061006C0025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000004000000060D000000250061006C006500720074002E005300740061007400650025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000005000000060C000000250061006C006500720074002E004E0061006D00650025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000060000000613000000250061006C006500720074002E004400650073006300720069007000740069006F006E0025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000070000000610000000250061006C006500720074002E005300650076006500720069007400790025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000008000000060F000000250061006C006500720074002E0043006F006D006D0065006E00740025000C010000000300000006000000010000000400000001000000850F000001000000020000000100000001000000090000000612000000250061006C006500720074002E00410073007300690067006E006500640054006F0025000C010000000300000006000000010000000400000001000000850F00000100000002000000010000000100000010000000062700000025006F007200670070006100720061006D003A005700450042004D004F004E00490054004F005200550052004C002500250061006C006500720074002E0061006C00650072007400690064002500</ProviderConfig>
			<Guid>{85711607-36E4-49F1-99A2-BE64696F8223}</Guid>
			<Timeout>0</Timeout>
			<Distribution></Distribution>
			<Enabled>0</Enabled>
			<ProviderId>{C3DFC923-4037-4C1B-A652-77767EBAF710}</ProviderId>
			<ExecutionOrder>0</ExecutionOrder>
			<Destination>0</Destination>
		</ITRTResponseAction>
	</ResponseActions>
	<AlertFields>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{02F9E93F-B840-4EFF-9F28-50AF93DD0059}</Guid>
			<FieldValue>%TargetDomain%</FieldValue>
			<FieldName>Target Domain</FieldName>
		</ITRTAlertField>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{303C6431-1187-418C-A23A-35C866A98B44}</Guid>
			<FieldValue>%OperatorDomain%</FieldValue>
			<FieldName>Operator Domain</FieldName>
		</ITRTAlertField>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{FF48C2E0-2C66-4B00-B708-B600C92908EB}</Guid>
			<FieldValue>%TargetName%</FieldValue>
			<FieldName>Target Name</FieldName>
		</ITRTAlertField>
		<ITRTAlertField>
			<Suppression>0</Suppression>
			<Guid>{C591135F-51D9-4D53-A9FB-8CA6D3FE7485}</Guid>
			<FieldValue>%OperatorName%</FieldValue>
			<FieldName>Operator Name</FieldName>
		</ITRTAlertField>
	</AlertFields>
</ITRTProcessingRule>

Children

No Data