SentinelOne Star Rule Detect New Local Administrator User Account

I would like a Star Rule that can alert me if a new local Administrator user account was created on a domain-joined computer. Anyone knows the query?

Reply to Post