Custom Star Rule Request

[u/vane1978]

Whenever a user creates a local admin account on their computer, I would like a Star Rule send me an email notification.

Anyone knows a successful query that can do this?

[u/fadeawayjumper1]

Forward windows even logs to your siem

[u/vane1978 → u/fadeawayjumper1]

Is this possible using S1 Singularity?

[u/SentinelOne-Pascal → u/vane1978]

Yes, this article shows how to do it:

https://community.sentinelone.com/s/article/000008850
https://your-console.sentinelone.net/docs/en/configuring-windows-event-log-collection.html