What might be a strange or perhaps obvious question... I have rules set on several event IDs labeled with a tag called "EventSecurityAudit".
A request came in to provide a report or other output showing the event IDs with the EventSecurityAudit tag.
Poking around I can't figure out how to do that.
I welcome any inputs from the community on how to list which rules apply a particular tag.
Thanks!