topic How to create a search to alert me when a user is part of one or more groups in a specific OU? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449286#M127236 <P>I'm having trouble writing a query in splunk to notify me when a user has been added to one or more groups in a specific ou. Here is what is in place and it was recommended to me to move it to splunk.</P> <OL> <LI><P>A batch file is run to query the users of the specific secure OU<BR /> dsquery group <CODE>"OU=Secure,OU=Folder,,DC=Domaint" |dsget group -members -expand|dsget user -samid -office -display</CODE> </P></LI> <LI><P>This is exported out as a csv and cosume by a stanging table that runs a stored procedure to check for duplicate samid</P></LI> <LI><P>From here SQL reporter emails out</P></LI> </OL> <P>Since all the groups start with the same name i.e. Secure* I can search and find a lot of usual information in the logs of splunk. <BR /> My Current search:</P> <PRE><CODE>secure EventCode=4627 </CODE></PRE> Tue, 19 Mar 2019 14:24:09 GMT loza176 2019-03-19T14:24:09Z How to create a search to alert me when a user is part of one or more groups in a specific OU? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449286#M127236 <P>I'm having trouble writing a query in splunk to notify me when a user has been added to one or more groups in a specific ou. Here is what is in place and it was recommended to me to move it to splunk.</P> <OL> <LI><P>A batch file is run to query the users of the specific secure OU<BR /> dsquery group <CODE>"OU=Secure,OU=Folder,,DC=Domaint" |dsget group -members -expand|dsget user -samid -office -display</CODE> </P></LI> <LI><P>This is exported out as a csv and cosume by a stanging table that runs a stored procedure to check for duplicate samid</P></LI> <LI><P>From here SQL reporter emails out</P></LI> </OL> <P>Since all the groups start with the same name i.e. Secure* I can search and find a lot of usual information in the logs of splunk. <BR /> My Current search:</P> <PRE><CODE>secure EventCode=4627 </CODE></PRE> Tue, 19 Mar 2019 14:24:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449286#M127236 loza176 2019-03-19T14:24:09Z Re: How to create a search to alert me when a user is part of one or more groups in a specific OU? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449287#M127237 <P>Do you just want an alert/report daily/weekly etc to give you a list of the groups membership? <BR /> -or- <BR /> Do you just want the report if the membership changes?</P> Tue, 19 Mar 2019 15:16:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449287#M127237 nickhills 2019-03-19T15:16:39Z Re: How to create a search to alert me when a user is part of one or more groups in a specific OU? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449288#M127238 <P>@nickhillscpl Just an alert if the membership changes. </P> Tue, 19 Mar 2019 19:20:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449288#M127238 loza176 2019-03-19T19:20:41Z Re: How to create a search to alert me when a user is part of one or more groups in a specific OU? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449289#M127239 <P>Have you looked at additional event codes, like 4728, 4732, 4756? Those logs would identify when a user is being added to a group. The only thing is that you will need the group names in a lookup. </P> Fri, 25 Oct 2019 00:52:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449289#M127239 begleyj1 2019-10-25T00:52:28Z Re: How to create a search to alert me when a user is part of one or more groups in a specific OU? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449290#M127240 <P>look for those event codes: 4728 4729 4732 4735 4737 4378 4756 4757<BR /> then write your own logic ...<BR /> i think there are plenty of answers in this forum regarding changes in groups with windows event codes<BR /> see here to get an idea of use cases and how to work with the event codes data:<BR /> <A href="https://answers.splunk.com/answers/222668/monitor-ad-group-changes.html">https://answers.splunk.com/answers/222668/monitor-ad-group-changes.html</A><BR /> <A href="https://answers.splunk.com/answers/558526/find-out-who-changed-an-ad-account-password.html">https://answers.splunk.com/answers/558526/find-out-who-changed-an-ad-account-password.html</A><BR /> <A href="https://answers.splunk.com/answers/132146/ad-user-groups.html">https://answers.splunk.com/answers/132146/ad-user-groups.html</A></P> <P>hope it helps</P> Mon, 28 Oct 2019 01:46:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-search-to-alert-me-when-a-user-is-part-of-one-or/m-p/449290#M127240 adonio 2019-10-28T01:46:57Z