topic Re: Report setup in Other Usage

Report setup

ish — Wed, 22 Sep 2021 13:52:09 GMT

I want to set up a report on Splunk server to detect when a user is added to a security group

Can you please help what steps I have to take

Thanks

Re: Report setup

richgalloway — Thu, 23 Sep 2021 14:02:25 GMT

Your domain controllers must be sending Windows security events to Splunk. Then you can search the wineventlog (or whatever you call it) index for events 4728, 4732, and 4756.

Re: Report setup

ish — Mon, 27 Sep 2021 13:36:12 GMT

Thanks very much