Monitoring Active Directory groups, is it possible to send an email alert to the individual who was added or removed from the group?

[8i5]

We'd like to use Splunk to monitor active directory groups but rather than email a fixed address when there are changes, we'd like to send an email alert to the individual who was added or removed from the group.

How would we go about doing this?

[lmyrefelt]

It seems to be an app for that;

https://apps.splunk.com/app/1794/

🙂

[f10353]

Is there a sample search that could be shared for Active Directory Group changes (meaning additions or deletions)?

[jkat54]

There are similar searches in the app for windows infrastructure just need to be a bit inventive and send them to the sendemail command as a token, etc.