Hello,
Looking to get a filter created which will fall over into a rule that will detect any attempted logon to one of our adm accounts from an IP outside of the UK?
From my own thoughts this would involve me gaining a CSV list of UK IP addresses adding them to a user defined group *uk IP* and creating the rule to trigger if detection IP is not equal.
Anyone had experience doing something similar?
The first thing I would do is create or modify user defined groups, https://documentation.solarwinds.com/en/success_center/sem/content/admin_guide/6.5-sem_groups/sem-configuring-user-defined-groups.htm#:~:text=In%20a%20rule%2C%20user%2Ddefined,that%20belong%20to%20the%20group. For my example I simply modified the existing Admin Accounts group as well as the Trusted IPs group to include my trusted IPs, you can use wildcards as opposed to having to type out all the IPs, for example, 192.168.*. You can google the IP Address Ranges assigned to the UK so you can add them to your Trusted IPs group. Once you have the groups you can create the filter as shown below.
If the filter shows the information you were interested in seeing you can then turn the filter into a rule and add an action.
