Splunk Search

Active Directory Group Memberships

Inthegetto
Observer

I am new to splunk and trying to determine how to setup an alert when a user in active directory is in two different AD groups. For example if a user is in group A and B alert. Anyone have some direction on how to achieve this?

Labels (3)
0 Karma

tscroggins
Influencer

@Inthegetto 

Splunk Supporting Add-on for Active Directory includes the ldapsearch command. When properly configured for your AD domain(s), you can search for users in both groups with an appropriate LDAP filter:

| ldapsearch search="(&(objectCategory=person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=GroupA,ou=Groups,DC=example,DC=com)(memberOf:1.2.840.113556.1.4.1941:=cn=GroupB,ou=Groups,DC=example,DC=com))"

Running as a scheduled search, you can trigger an alert when the result count is greater than 0.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...