Fist time creating an alert - Need to report on dis-joining and new servers joining to the domain from McAfee SIEM. Please share the steps if anyone has done this.
use the signature id 43-211006450 to get the new system joining to the domain.
Thanks Maria for the help. I am also looking for the systems being decommission. Is there a built in list of signature IDs in SIEM