Hi,
I wrote code for " User Account Activity Report " as below. However the result is showing only for accessing/execute the "xxx.exe" files.
Account_Name=* | fields - _raw | fields _time, Account_Name, Security_ID, ComputerName, sourcetype, Process_Name, Message, splunk_server, action | dedup _time Account_Name ComputerName
Could you please help me the code for also "Registry changes , programs installations & other actions like changes in system32 folder ".
Note example: ABC user worked on xyz.exe application for 4 hours. I see more than 500 lines in csv report for this action. Is possible to control this? instead of showing 500 lines will be possible to show 500 count?
Is possible for below conditions?
Schedule report for User Activity report as csv,
- Sheet1 - User account login/logout info/failed info
- Sheet2 - User accessing application info
- Sheet3 - Registry changes by User Info
- Sheet4 - Add/Delete/modify files/folders in System32 folder info
Thanks in advance.
