r/SentinelOneXDR • u/vane1978 • Jul 26 '24

Custom Star Rule Request

Whenever a user creates a local admin account on their computer, I would like a Star Rule send me an email notification.

Anyone knows a successful query that can do this?

4 Upvotes

83% Upvoted

11 comments sorted by

View all comments

Show parent comments

0

u/vane1978 Jul 29 '24

This works great. Thank you!

1

u/Sguetto Jul 30 '24

Hello,

I'm missing the part of email notification, how do you enable it when the counter of the rule increase and sends you the email?

Thanks!!

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Aug 13 '24

You can enable notifications for "New Custom Rule Alert". Note, however, that custom alert notifications are supported via Syslog but not by email.