Alert on if a user object was created and then deleted (4237684)

A new search would need to be created User Object Created and one for User Object Removed" and the alert enabled for each search:

1. Open the CA Client
2. Select Searches
3. Create a new Search
4. Select the What tab
5. Click the down arrow next to Add and select Event Class
6. Select User Object Added and click Add | Add This Event
7. Click OK
8. Select the Alert tab and enable the Alert
9. Repeat the same steps to create a search/alert for the User Object Removed Event Class

This would alert when the User object is created and then alert again when the User object is removed. When a user object is created, an alert would be sent, and subsequently when a user object is removed, another alert would be sent. You would use both alerts to determine if suspicious activity took place based on the short time span between alerts. Current capability cannot correlate between the two events to indicate a potential threat.