cancel
Showing results for 
Search instead for 
Did you mean: 

Collect SIEM report on domain activity

Fist time creating an alert - Need to report on dis-joining and new servers joining to the domain from McAfee SIEM.  Please share the steps if anyone has done this.

Regards,

Zahid

2 Replies

Re: Collect SIEM report on domain activity

use the signature id 43-211006450 to get the new system joining to the domain.

Re: Collect SIEM report on domain activity

Thanks Maria for the help.  I am also looking for the systems being decommission.  Is there a built in list of signature IDs in SIEM