I am trying to make a search that will fire only when an admin makes a change to their own account.
I want to know if a-johndoe gives multiple permissions to a-johndoe and NOT if a-johndoe gives permissions to a-janedoe.
would i use an IF statement for this?
Thank you
apologies, this will be for windows event logs and Ivanti logs.
What data are you talking about?
Splunk account changes? Windows Event Logs? Some (what) Linux audit logs?
If your data is CIM-normalized, you should use Change.Account_Management dataset.
was able to figure it out!
needed to just use an IF statement.
| eval testuser=if(admin=target,1,0) | where testuser=1
