Rules which will alert every login with domain-admin account (built-in local administrator accounts as well)

[ONaqellari]

Dear community, i'm trying to build or to deploy (if possible) rules which will alert every login with domain-admin account (built-in local administrator accounts as well) .

Please can anyone help ?

Thank You

[ChrisIchelson]

Best way I have found to create a rule that is effective is to first find the traffic that you are looking to alert on.  Once you find that data then you can find the appropriate meta that would fire associated with the traffic.  This way you can also include your not statements as well so you don't accidentally create a rule that fires thousands of alerts within seconds on accident.

Username contains "identifier" && Context contains 'privilege escalation' && _____________.  (example not assumed correct)

[ChrisIchelson]

You could also use this methodology and the reporting engine within netwitness as another solution to report against this activity.