Getting Data In

I am trying to create an alert specific to domain admins being added or removed from the Admin group

Explorer

As the question stated I am trying to create an alert that lets me know when Domain admins were added or removed from the
Domain group. I also need the alert to create a table that displays the Domain, User, and Workstation.

This is the search I am currently using.

index=* Group_Name=Administrators Administrators* EventCode=4732

| eval delta=now()-latest
| rangemap default=missing field=delta current=0-90000
| convert ctime(latest) AS "Last Indexed"
| table user, sourcetype, host | rename host as Workstation

0 Karma