User Privilege change status to ADMIN

[Ezzat]

Is there a built in rule in FortiSIEM that shows and trigger an incident when a user privilege changed to admin ?

[Taher11]

Hello, you can try to monitor the rule that triggers when an administration group change