Rules Authentication out of working time

Elastic Security
1

Hello Every body,

I need a rule to detect authentication based on the event id 4624 (Windows authentication) out of working time.
do you have any idea about this?

Thanks,

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.