topic How do I add a CIM Change Model and EventCode 4732 (A member was added to a security-enabled local group) in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-add-a-CIM-Change-Model-and-EventCode-4732-A-member-was/m-p/589771#M10681 <P>Running CIM 5.0 and was looking to do some reporting on users/groups added to security groups (information provided by the Windows Security Log event 4732 - but when I look in the Change datamodel, I cannot see the target group of the add in any of the fields.</P> <P>We are using out of the box Splunk_TA_windows, and Splunk Add-on for Microsoft Windows and I would have hoped that the data model would have been automatically filled with the relevant fields. Am I missing something obvious, or is there something I need to setup myself to get this working?</P> <P>Thanks</P> <P>Simon</P> Mon, 21 Mar 2022 14:38:46 GMT beano501 2022-03-21T14:38:46Z How do I add a CIM Change Model and EventCode 4732 (A member was added to a security-enabled local group) https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-add-a-CIM-Change-Model-and-EventCode-4732-A-member-was/m-p/589771#M10681 <P>Running CIM 5.0 and was looking to do some reporting on users/groups added to security groups (information provided by the Windows Security Log event 4732 - but when I look in the Change datamodel, I cannot see the target group of the add in any of the fields.</P> <P>We are using out of the box Splunk_TA_windows, and Splunk Add-on for Microsoft Windows and I would have hoped that the data model would have been automatically filled with the relevant fields. Am I missing something obvious, or is there something I need to setup myself to get this working?</P> <P>Thanks</P> <P>Simon</P> Mon, 21 Mar 2022 14:38:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-do-I-add-a-CIM-Change-Model-and-EventCode-4732-A-member-was/m-p/589771#M10681 beano501 2022-03-21T14:38:46Z