Getting Data In

How to investigate Domain Local (DL) and Windows group membership?

ambyadav
New Member

Team,

If we have Windows events and Active Directory (AD) is synced with Splunk, how can I search/investigate who modified a DL or who was added in an AD group and who added?

Is there any query? or how can I investigate this matter?

Appreciate any help.

Ambris.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are several event codes that are generated when a group is modified. Look for 4728, 4729, 4732, 4733, 4756, or 4757.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...