Alerting dashboard update

[ddiabe]

#

🗣 Description

Testing purposes

• Enable win event logs
• Enable pre-built elastic rules
• on the client computer or domain controller go to event viewer and click on windows logs.
• after clicking on windows logs click on security and on the left panel, click clear logs
• Click refresh.
• Go back to dashboard and make sure you select the correct time (usually just select today).
• An alert will be created on the dashboard showing/ the cleared security logs that was done on either the client computer or domain computer.

How to test for windows cleared security logs on either domain controller or client computer.

• on the security panel at the left-hand side of the alerting dashboard, click the alert option.
• Later click on manage rule. From manage rule search and enable "cleared windows security logs".
• After clear windows security log has been enabled, go back to the domain controller or client computer and clear the security logs from the event viewer.
• The clearing of the security logs will be captured by the alerting dashboard.

[rgbrow1949]

Worked as intended. Approved.

[mitchelbaker-cisa]

Looks good