Reporting

Report setup

ish
Explorer

Hi

I want to set up a report on Splunk server to detect when a user is added to a security group

Can you please  help what steps I have to take 

Thanks

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your domain controllers must be sending Windows security events to Splunk.  Then you can search the wineventlog (or whatever you call it) index for events 4728, 4732, and 4756.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

ish
Explorer

Thanks very much 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your domain controllers must be sending Windows security events to Splunk.  Then you can search the wineventlog (or whatever you call it) index for events 4728, 4732, and 4756.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...