Thanks, Nicole
yea, I like to incorporate much of the DISA STIG report into my filters and rules. I figured out must of it now. I just didn't make sinces to me at first. I figured how to do it now except a couple of the AD filters. i.e. Windows/Active Directory Domains: Machine Events - Account Disabled