Splunk Search

AD user modification

risingflight143
Explorer

Hi All

I have an AD Account how can i know what modifications has been done in last one month on this account from splunk and who has modified. i want to export this information to csv file.

0 Karma

risingflight143
Explorer

lets say i have user1 for which i need to check who has modified, i have many groups so i cannot give them, will the below syntax work for me.

index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now
| rename user1 AS "Actioned By", user1_first AS "First Name" user1_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g"
| rex mode=sed field="Account_Name" "s/\\//g"
| table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time

0 Karma

pruthvikrishnap
Contributor

try this.
index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now (Group_Name="Domain Admins" OR Group_Name="Group2")
| rename src_user AS "Actioned By", src_user_first AS "First Name" src_user_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g"
| rex mode=sed field="Account_Name" "s/\\//g"
| table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time

https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorActiveDirectory

0 Karma

risingflight143
Explorer

lets say i have user1 for which i need to check who has modified, i have many groups so i cannot give them, will the below syntax work for me.

index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now
| rename user1 AS "Actioned By", user1_first AS "First Name" user1_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g"
| rex mode=sed field="Account_Name" "s/\\//g"
| table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...