Security

Identify admins being added to multiple groups in ad?

mihall
Path Finder

My search is as follows:
(EventCode=4728 OR EventCode=4732 OR EventCode=4756) a_* (Group_Name= OR Group_Name= OR Group_Name=Group_Name3>

This search works well to identify when any admin account has been added to these groups. I want to know if I can extend this search to identify when 1 admin has been added to more than 1 of these groups. Any help would be appreciated.

0 Karma

cmerriman
Super Champion

try |stats dc(Group_Name) by account to count how many groups belong to the account types.

woodcock
Esteemed Legend

Or maybe:

| stats values(Group_Name) AS Group_Names dc(Group_Name) AS Group_Name_count | where Group_Name_count>1
0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...