I am looking for a way to track local admin accounts on local PC and how often they are used, does Graylog have a menu to do this or a widget? If so can someone point me to it? I am using 2.5 version
he @TechAdmin
nothing “build in” - you need to ingest your windows event log an when that happens you can search for the event id for that. So you could create a widget out of that.
That is a shame; one would think that all Admins would want a report of elevated privileges being used and for what.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.