https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-alerts-for-changes-made-to-the-Administrators/m-p/673890#M112812 <P>Hello,</P><P><SPAN>One of our MF Local Administrative Group Member rule is generating a significant number of alerts because sccmadmin group removed from MF member server, assistance is needed in refining this search to minimize unnecessary alerts.</SPAN></P><P>&nbsp;</P><P><SPAN>index=foo sourcetype=XmlWinEventLog (EventCode=4732) dest="mf" user!="nt service"<BR />NOT (EventCode="4732" src_user="root" MemberSid="Domain Admins" Group_Name="Administrators")<BR />NOT (EventCode="4732" MemberSid="NT SERVICE\\*" (Group_Name="Administrators" OR Group_Name="Remote Desktop Users"))<BR />| eval user=lower(MemberSid)<BR />| eval src_user=lower(src_user)<BR />| stats values(user) as user, values(Group_Domain) as Group_Domain, values(dest) as dest by src_user,Group_Name,EventCode,signature _time</SPAN></P><P><SPAN>Thanks...</SPAN></P> Thu, 11 Jan 2024 07:19:58 GMT smith_ 2024-01-11T07:19:58Z https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-alerts-for-changes-made-to-the-Administrators/m-p/673890#M112812 <P>Hello,</P><P><SPAN>One of our MF Local Administrative Group Member rule is generating a significant number of alerts because sccmadmin group removed from MF member server, assistance is needed in refining this search to minimize unnecessary alerts.</SPAN></P><P>&nbsp;</P><P><SPAN>index=foo sourcetype=XmlWinEventLog (EventCode=4732) dest="mf" user!="nt service"<BR />NOT (EventCode="4732" src_user="root" MemberSid="Domain Admins" Group_Name="Administrators")<BR />NOT (EventCode="4732" MemberSid="NT SERVICE\\*" (Group_Name="Administrators" OR Group_Name="Remote Desktop Users"))<BR />| eval user=lower(MemberSid)<BR />| eval src_user=lower(src_user)<BR />| stats values(user) as user, values(Group_Domain) as Group_Domain, values(dest) as dest by src_user,Group_Name,EventCode,signature _time</SPAN></P><P><SPAN>Thanks...</SPAN></P> Thu, 11 Jan 2024 07:19:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-optimize-alerts-for-changes-made-to-the-Administrators/m-p/673890#M112812 smith_ 2024-01-11T07:19:58Z