Getting Data In

How to monitor specifics AD groups using Account_Name?

marceloamorim
New Member

Hello Guys, I would like your help.

I need to monitor specifics AD Security Groups when someone is add to those groups, however, when I perform the following search using "Group_name", I have no results.
index=main (EventCode=4756 OR EventCode=4728 OR EventCode=4732) Group_name:"Group_A"

When I perform a search using "Account_Name" I receive the results, however, Account_Name is used not only for group name, but for user who added the user account on the group and the user who was added. I cant create a table if one columm shows 3 kind of diferents results.
index=main (EventCode=4756 OR EventCode=4728 OR EventCode=4732) Account_Name=Group_A

Look details below: You can notice that there are three differents values for Account_Name:

Subject:
Security ID: S-1-5-21-1659001184-1614895754-725345543-1010
Account Name: User who take action to add user account on the group
**Account Domain: XYZ

Logon ID: 0x30315A0B

Member:
Security ID: S-1-5-21-1659001184-1614895754-725345543-62020
Account Name: CN=UserX,OU=XYZ,OU=XYZ,OU=XYZ,OU=XYZ,DC=XYZ,DC=XYZ

Group:
Security ID: S-1-5-21-1659001184-1614895754-725345543-423030
Account Name: Group_A
Account Domain: XYZ

thx

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...