Good morning group, I have been working on a rule that takes failed windows logon attempts and alerts if the failed logon involves a domain administrative account of some form. We use various naming conventions for administrative accounts. One example is sa.*
Currently I'm using <match>sa.</match> to locate the admin account failure. However, this also generates an alert for a regular user account such as lisa.*... I have tried using regular expressions in the form of: <match>^sa.</match> <match>^sa.\.</match> <match>^sa.\.*</match> <match>^sa.\.+</match> <regex>^sa.</regex> <regex>^sa.\.</regex> <regex>^sa.\.*</regex> and so on. I haven't had any luck with getting any alerts to fire with any of these statements. Would someone in this group have any ideas? Thanks! Tyler Ross
