A new search would need to be created User Object Created and one for User Object Removed" and the alert enabled for each search:
This would alert when the User object is created and then alert again when the User object is removed. When a user object is created, an alert would be sent, and subsequently when a user object is removed, another alert would be sent. You would use both alerts to determine if suspicious activity took place based on the short time span between alerts. Current capability cannot correlate between the two events to indicate a potential threat.
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Feedback Nutzungsbedingungen Datenschutz Cookie Preference Center