Non Domain Controller Active Directory Replication (Windows Security Events/Analytic Rules/NonDCActiveDirectoryReplication)

[jlextremeiro]

In the Solutions/Windows Security Events/Analytic Rules/NonDCActiveDirectoryReplication.yaml
the condition
//| where Computer in (DCServersList)
Shouldn't be
//| where Computer !in (DCServersList).

[v-visodadasi]

Hi @jlextremeiro , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-visodadasi]

Hi @jlextremeiro , Can you please provide more details and In commented query it already defined as //| where Computer in (DCServersList). So, Could you please provide clarification on this.