correlation rule for windows login

Hey,

I've attached a rule which meets your use case (kudos to curtisi​ for the rule). You can import it into your existing rule set & edit if required.

Any questions let me know.

Thanks Jhynds/curtisi. ...Actually I tried but its not firing any rule. I would request if could you explain this rule first? actually I tried to minimize the time window.response window by 1 minute , just for testing and in action I removed the email action because I don't have mail server just want to see this rule alert in console so added incident alert..

Can you share a printscreen with us of what you've set up in the rule conditions?

I would suggest first thing first -> create a filter with the exact same conditions that you have in your rule, then see....what events are appearing in that filter? It could be that it's not the right condition mix. But actively seeing it in a filter (where youll see events coming in real time) will help see what events those conditions catch.