I'm trying to write a simple search/alert in the Splunk app for Sophos Central where it will alert on any machines which have not been allocated to a Group in the Sophos console.
I've trawled through the Events and Fields, but I can't see anything that looks likely. It's perfectly possible that I'm missing something incredibly obvious, but I was hoping that someone else had ran up against something similar?
