Hi, sometimes, need some external info to analyze Windows Event. Try
this one if want. Regards { "displayName": "Search Windows EventID
Description", "cssClasses": [ "reference-id", "reference.id" ],
"description": "", "type":
"UAP.common.contextmenu...
If someone need, i've added custom action for Exposure Iseclab
Search.First by domain name, second by ipaddress.Feel free to
change/modify/ignore everithing. Regards { "displayName": "Exposure
Search By Domain", "cssClasses": [ "domain", "alias-host"...
Hi, Agree with the LUA, but maybe alert.id = account:password-change
maybe better focused on windows eventid 4723 about password change. I'm
wrong? Regards
