We had a client request for notification when GPO policies were created, edited, or deleted. When studied, these actions cause multiple event log entries. Because of the multiple event log entries, we determined that we needed to use the ESA engine for correlation. The EPL rules we created in ESA are below. They may not be exactly what you need, but they may get you started.
======
module GPOCreated;
@Name('GPO Created')
@RSAAlert
SELECT window(*) FROM Event(
medium = 32
AND
reference_id IN ('5137',’5136’)
AND
obj_type = 'grouppolicycontainer'
AND
(ec_activity = 'create' OR cast(action, string) LIKE '%Value Deleted%'))
.std:groupwin(obj_type).win:time_batch(20 seconds)
GROUP BY obj_type;
======
module GPOEdited;
@Name('GPO Edited')
@RSAAlert
SELECT window(*) FROM Event(
medium = 32
AND
reference_id = '5136'
AND
obj_type = 'grouppolicycontainer'
AND
cast(action, string) LIKE '%Value Deleted%')
.std:groupwin(reference_id, obj_type).win:time_batch(20 seconds)
GROUP BY reference_id, obj_type;
======
module GPODeleted;
@Name('GPO Deleted')
@RSAAlert
SELECT window(*) FROM Event(
medium = 32
AND
reference_id = '5141'
AND
obj_type = 'grouppolicycontainer'
AND
cast(action, string) LIKE '%Tree Delete%')
.std:groupwin(reference_id, obj_type).win:time_batch(20 seconds)
GROUP BY reference_id, obj_type;
