Alerting

Active Directory - How to alert upon new group member?

mcrawford44
Communicator

Per the title, How would one go about creating an alert that triggered on a new group member in Active Directory.

I understand you can trigger on event counts, however can you trigger on an addition over historical counts?

I'm currently playing around with a query that will display records within a short window of time behind the current time ( say 1-10 minutes ), and if the count of this > 1 it would trigger an email alert.

I'm curious if there is a better way to do this.

Thanks!

0 Karma

scottsavaresevi
Path Finder

Do a google search for microsoft event 4728 (I don't have enough Karma to post external links... sorry). Its the event for new users to security groups. If you send your AD logs into splunk you should be able to search for those events in Splunk. Then create an alert based on the appearance of that action. I found these instructions that can help you set an alert up. http://docs.splunk.com/Documentation/Splunk/6.1.3/Alert/Alertexamples

Hope that helps.

mcrawford44
Communicator

I should have specified we are only indexing the active directory structure with admon. There are no forwarders on the domain controllers.

0 Karma

brooklynotss
Path Finder
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...