Other Usage

Report setup

ish
Explorer

Hi

I want to set up a report on Splunk server to detect when a user is added to a security group

Can you please  help what steps I have to take 

Thanks

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your domain controllers must be sending Windows security events to Splunk.  Then you can search the wineventlog (or whatever you call it) index for events 4728, 4732, and 4756.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

ish
Explorer

Thanks very much 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your domain controllers must be sending Windows security events to Splunk.  Then you can search the wineventlog (or whatever you call it) index for events 4728, 4732, and 4756.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...