Getting Data In

How to optimize alerts for changes made to the Administrators group in "MF Local Admin Group Member Changes"

AL3Z
Builder

Hello,

One of our MF Local Administrative Group Member rule is generating a significant number of alerts because sccmadmin group removed from MF member server, assistance is needed in refining this search to minimize unnecessary alerts.

 

index=foo sourcetype=XmlWinEventLog (EventCode=4732) dest="mf" user!="nt service"
NOT (EventCode="4732" src_user="root" MemberSid="Domain Admins" Group_Name="Administrators")
NOT (EventCode="4732" MemberSid="NT SERVICE\\*" (Group_Name="Administrators" OR Group_Name="Remote Desktop Users"))
| eval user=lower(MemberSid)
| eval src_user=lower(src_user)
| stats values(user) as user, values(Group_Domain) as Group_Domain, values(dest) as dest by src_user,Group_Name,EventCode,signature _time

Thanks...

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...