https://community.splunk.com/t5/Getting-Data-In/Looking-to-find-all-group-changes-for-a-specific-user/m-p/460884#M79552 <P>I'm relatively new to splunk, and am working to do some auditing of sensitive groups within our active directory. </P> <P>I've tried a few variation of this: <CODE>sourcetype=WinEventLog:Security (EventCode=4728 OR EventCode=4729 OR EventCode=4732 OR EventCode=4733 OR EventCode=4756 OR EventCode=4757) user=userID</CODE></P> <P>I was able to find all changes to these cgroups using: <CODE>sourcetype=WinEventLog:Security (EventCode=4728 OR EventCode=4729 OR EventCode=4732 OR EventCode=4733 OR EventCode=4756 OR EventCode=4757) (user_group="secure_group_alpha" OR user_group="secure_group_beta)" | table EventCode, EventCodeDescription, user_group, user, src_user | rename EventCodeDescription as "Description", user_group as "Group Changed", user as "User Added/Removed", src_user as "Changed By"</CODE></P> <P>But I'm hoping to get more specific</P> Fri, 23 Aug 2019 20:37:23 GMT pprice21 2019-08-23T20:37:23Z https://community.splunk.com/t5/Getting-Data-In/Looking-to-find-all-group-changes-for-a-specific-user/m-p/460884#M79552 <P>I'm relatively new to splunk, and am working to do some auditing of sensitive groups within our active directory. </P> <P>I've tried a few variation of this: <CODE>sourcetype=WinEventLog:Security (EventCode=4728 OR EventCode=4729 OR EventCode=4732 OR EventCode=4733 OR EventCode=4756 OR EventCode=4757) user=userID</CODE></P> <P>I was able to find all changes to these cgroups using: <CODE>sourcetype=WinEventLog:Security (EventCode=4728 OR EventCode=4729 OR EventCode=4732 OR EventCode=4733 OR EventCode=4756 OR EventCode=4757) (user_group="secure_group_alpha" OR user_group="secure_group_beta)" | table EventCode, EventCodeDescription, user_group, user, src_user | rename EventCodeDescription as "Description", user_group as "Group Changed", user as "User Added/Removed", src_user as "Changed By"</CODE></P> <P>But I'm hoping to get more specific</P> Fri, 23 Aug 2019 20:37:23 GMT https://community.splunk.com/t5/Getting-Data-In/Looking-to-find-all-group-changes-for-a-specific-user/m-p/460884#M79552 pprice21 2019-08-23T20:37:23Z