Solved: Re: Report setup

ish · ‎09-22-2021

Hi

I want to set up a report on Splunk server to detect when a user is added to a security group

Can you please help what steps I have to take

Thanks

richgalloway · ‎09-23-2021

Your domain controllers must be sending Windows security events to Splunk. Then you can search the wineventlog (or whatever you call it) index for events 4728, 4732, and 4756.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

ish · ‎09-27-2021

Thanks very much

richgalloway · ‎09-23-2021

Your domain controllers must be sending Windows security events to Splunk. Then you can search the wineventlog (or whatever you call it) index for events 4728, 4732, and 4756.

---
If this reply helps you, Karma would be appreciated.

Report setup

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Join the Conversation