alert to monitor my system admins

[Farnsworth, Robert]

How would I go about writing a rule to capture my system administrators when they make a change to any user related function such as adding users, changing groups and so on, either on domains or locally.

 

I would assume the rule would need to be ID specific.

 

So if admin_A and/or admin_B adds a user I need to get an alert for that.  

 

Thanks

 

Robert

[Brent Morris]

(I'm assuming you're referencing Microsoft products)

check out the msauth_rules.xml - that has all the rules that you're looking for.   For instance, 18111 for user account changes.  Group changes are in there also.  You might have to change the levels on some of them in your local_rules.xml depending on your alert threshold set in your ossec.conf

-Brent