Hi All!
We are just getting started with SAM and we want to set up a SAM alert for any login to a large subset of our VM servers for any user except a couple. This would be for domain and local accounts. The idea is to exclude the very few accounts that would legit need to perform daily operations from the alert but receive alerts if:
- a local account is added then logged into
- the existing local admin account is used
- a domain user logs into a server (outside of the few currently authorized accounts)
We have other controls in place, such as only allowing login for a minimal set of users and service accounts, but this would be a "fail-safe" in case these controls are defeated/bypassed.
The idea is that if an alert for a server login pops up on the NOC view for a local admin account, unrecognized account, or domain account (outside of the few authorized ones) the System Admin and Help Desk would immediately be able to investigate and remediate.
Any advice on setting this up would be greatly appreciated.
