Hello,
I am attempting to get LEM to log AD Auditing. So far I have created a rule and it is working. However, I am wanting more information.
Currently, it shows what happened (ex. new user created, account modified, etc..) and I am wanting to see who created the new user account or who modified the account.
Does anyone know what I need to add to my rule to allow this information?
Here is a screenshot of what my rule looks like:
