AD user groups

[lucasjeff]

I am looking to monitor specific AD user groups and want to create a search that alerts me to when the members of these groups change.

How do I pull that information?

[brooklynotss]

Or a little more robust, create a lookup csv file with the list of groups you care about, your "privileged groups" if you will and refer to it in your search like so:

index=wineventlog tag::host="domaincontroller" eventtype=msad-nt6-groupmembership-changes  NOT "[domainname]\\[serviceaccountthatmakeslotsofchanges]" | eval AdminAccount=upper(replace(mvindex(Security_ID,0), "[domainname]\\\\", "")) | eval ChangedAccount=upper(replace(mvindex(Security_ID,1), "[domainname]\\\\", "")) | eval GroupName=replace(mvindex(Security_ID,2), "[domainname]\\\\", "") | fields _time, host, AdminAccount, ChangedAccount, GroupName, name | search [|inputlookup PriviledgedGroups | fields GroupName] | table _time, host, AdminAccount, ChangedAccount, GroupName, name | rename name as "Action" | sort - _time

Explanation:
We've tagged all our Domaincontrollers
We have only one domain and have both ldap and windows infrastructure app installed so i'm piggy backing off one of those eventtypes.
I'm excluding a service account that makes tons of automated changes we don't care about alerting on.
Then grabbing the account that did the action and the account the action was taken upon, cleaning up the text (removing the domain\ portion since we have only one domain).

Then set schedule and alert parameters as needed. Results in an email like shown in the attached file

[JeremyHagan]

You need to collect the Windows Security Event logs from you domain controllers, then you need to create an alert based on a search similar to this:
(EventCode=4732 OR EventCode=4728 OR EventCode=4756) (Group_Name="Domain Admins" OR Group_Name="Enterprise Admins" OR Group_Name="Schema Admins")