AD user modification

[risingflight143]

Hi All

I have an AD Account how can i know what modifications has been done in last one month on this account from splunk and who has modified. i want to export this information to csv file.

[risingflight143]

lets say i have user1 for which i need to check who has modified, i have many groups so i cannot give them, will the below syntax work for me.

index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now
| rename user1 AS "Actioned By", user1_first AS "First Name" user1_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g"
| rex mode=sed field="Account_Name" "s/\\//g"
| table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time

[pruthvikrishnap]

try this.
index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now (Group_Name="Domain Admins" OR Group_Name="Group2")
| rename src_user AS "Actioned By", src_user_first AS "First Name" src_user_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g"
| rex mode=sed field="Account_Name" "s/\\//g"
| table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time

https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorActiveDirectory

[risingflight143]

lets say i have user1 for which i need to check who has modified, i have many groups so i cannot give them, will the below syntax work for me.

index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now
| rename user1 AS "Actioned By", user1_first AS "First Name" user1_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g"
| rex mode=sed field="Account_Name" "s/\\//g"
| table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time