I want to monitor a specific account if it gets locked out.
Any idea how to add filter's in the available script? or is there any template available already to monitor specific account.
Thanks.
I have configured this, thanks for your reply.
The only way I can think to do this would be to have the SAM event log monitor looking for that account's specific SID or username. I was asked by our App team to do this for a specific service account.
Solarwinds is not an SIEM. I would leverage another tool personally as this could get unmanagable quick depending on the size of the organization
