Hello dear friends.
I wanted to ask you about some logs that from my exchange server which i catch with qradar. They are all with qid: 5000830 or eventid:4624 which is a successful login to a server or anything.
I use a rule which tells me if someone logs in to the exchange server from an...
cybersecurity
data protection
event id
exchange server
external access
false positives
firewalls
fraudulent ip
ip logs
ip quality score
isp tracking
loginevents
microsoft corporation
network security
password management
qradar
security audits
security rules
user management
