Security Compliance

SEM Rule to Disable Local User Account

This article provides steps on how to configure a SEM rule to disable local user account on agent nodes (Windows) for a "UserLogonFailure" event. This method can be used to add "Disable local user account" action.

First published date

1/5/2022 7:56 AM

Last published date

1/26/2022 5:37 AM

Overview

This article provides steps on how to configure the SEM rule to trigger an alert email for Failed Login attempts and  "Disable Local User Account" on an agent node (Windows). Here will be working on EventType = "UserLogonFailure" event. 

Product section

Security Event Manager

Cause

NA

Resolution

Pre-requisites: 

  • SEM agent should be installed on the node and SEM is receiving the events from the node(s).
  • "Windows Active Response" connector should be added and running on the node(s). 
  • User account should be available on the agent node.

 

A) Creating the base rule: 

You can create rules in 3 ways.
1) From Rules tab ➤"Create new rule"
2) Or Using "Create rule from template"
image.png
3) Sending existing or custom filter to rule ➤"Send Filter to Rule" 
image.png
 


B) Rule Definition: 

1.  Select the EventType you want to create a rule against and drag it to the "Rule definition" on the right. image.png

2. Set correlation parameters like rule occurrence "X" times in "Y" duration window. Save and click next.
image.png

C) Add Email active response action(s) to the rue under "Details and Actions":

  1. Under "Details and Actions, click "Add new actions". Search for "Disable Local User Account" and select it and click next. 
  2. On the next step, use the available attributes for the event based on the EventType selected in the rule definition. You can drop down to see the available options. For agent "DestinationMachine" and "DestinationAccount" for the account you plan to monitor and send the user disable action to. 
image.png

D) How to Validate if Rule is working correctly or not: 

  1. In SEM web console we can validate if the rule has triggered or not under Live Filters tab ➤"Rules Activity" and "SEM Internal Events" Filter(s).  
image.png
2. Under SEM Internal Events Filter, you should see following sequence of InternalEvents to confirm that Rule is fired and Disable Local User Account Action is also completed.
image.png