NetWitness Community

How can I write a rule w/reference ID 4741 FOLLOWED BY reference ID 5139?

Hello, I'm trying to make a report on one of my rules. I have a GPO Changes rule that has 122 alerts. I'm having trouble making a simple report of these alerts. Can anyone help me with that?

Is this High alert of concern, should I open a case on this? I comes and goes. High Memory Usage on Rabbitmq Message Broker - 61%

How can I make an alert a Report?

How would I convert this rule to Netwitness? logsource: product: windows service: security definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624, a failed logon attempt would trigger an event ID 4...