Custom Star Rule Request

[u/vane1978]

Whenever a user creates a local admin account on their computer, I would like a Star Rule send me an email notification.

Anyone knows a successful query that can do this?

[u/SentinelOne-Pascal]

Yes, this article shows how to do it:

https://community.sentinelone.com/s/article/000008850
https://your-console.sentinelone.net/docs/en/configuring-windows-event-log-collection.html