How do I build a VigilEnt Security Agent for Windows Detect rule to alert on certain user accounts l (NETIQKB31699)

goal
How do I build a VigilEnt Security Agent for Windows Detect rule to alert on certain user accounts logging into Windows NT or 2000 servers?

fact
VigilEnt Security Agent for Windows 2.X

fact
VigilEnt Security Agent for Windows 3.X

fact
VigilEnt Security Agent for Windows 4.0

fix

In the VigilEnt Security Agent for Detect GUI, follow these steps:

1. Click Rule | New.

2. Select Event Log Rule and click Next.

3. Right-click the AND statement and create the rule as shown below:

   AND
   + LogName == Security
   + messageID == 528
   AND
   OR
   + accountName ~= [username] 
   + accountName ~= [username]
   

4. Click Next to set the Actions for the rule.

5. Click Next again and name the rule.

6. Click Finish.

7. Save the detect.xml file by clicking Config File, Save or by clicking the Save button.

Formerly known as NETIQKB31699