User Accounts Activity Report in the multiples machines/Applications/Registry

[brpsingara]

Hi,

I wrote code for " User Account Activity Report " as below. However the result is showing only for accessing/execute the "xxx.exe" files.

Account_Name=* | fields - _raw | fields _time, Account_Name, Security_ID, ComputerName, sourcetype, Process_Name, Message, splunk_server, action | dedup _time Account_Name ComputerName

Could you please help me the code for also "Registry changes , programs installations & other actions like changes in system32 folder ".

Note example: ABC user worked on xyz.exe application for 4 hours. I see more than 500 lines in csv report for this action. Is possible to control this? instead of showing 500 lines will be possible to show 500 count?

Is possible for below conditions?

Schedule report for User Activity report as csv,

• Sheet1 - User account login/logout info/failed info
• Sheet2 - User accessing application info
• Sheet3 - Registry changes by User Info
• Sheet4 - Add/Delete/modify files/folders in System32 folder info

Thanks in advance.

[brpsingara]

Anyone please give suggestions; how to write code for User Account Activity report.

Login activity
Application access/execute/close activity
Logout activity

At least give me a comment, will this possible or not?