https://community.splunk.com/t5/Security/Which-capabilities-has-a-user-used/m-p/693187#M17984 <P>Trying to create a search that will show which capabilities a user has used within the last year.</P> Fri, 12 Jul 2024 13:04:27 GMT Moldy 2024-07-12T13:04:27Z https://community.splunk.com/t5/Security/Which-capabilities-has-a-user-used/m-p/693187#M17984 <P>Trying to create a search that will show which capabilities a user has used within the last year.</P> Fri, 12 Jul 2024 13:04:27 GMT https://community.splunk.com/t5/Security/Which-capabilities-has-a-user-used/m-p/693187#M17984 Moldy 2024-07-12T13:04:27Z https://community.splunk.com/t5/Security/Which-capabilities-has-a-user-used/m-p/693190#M17985 <P>Capability use is not logged.&nbsp; Actions performed by users are logged in _audit.&nbsp; It would be up to you map those actions to the associated capabilities.</P> Fri, 12 Jul 2024 13:32:08 GMT https://community.splunk.com/t5/Security/Which-capabilities-has-a-user-used/m-p/693190#M17985 richgalloway 2024-07-12T13:32:08Z https://community.splunk.com/t5/Security/Which-capabilities-has-a-user-used/m-p/693191#M17986 <P>Thank you!</P> Fri, 12 Jul 2024 13:35:48 GMT https://community.splunk.com/t5/Security/Which-capabilities-has-a-user-used/m-p/693191#M17986 Moldy 2024-07-12T13:35:48Z