Hi there,  I'd like to create a search to look for group membership changes in active directory.  So far I've created this search: | tstats dc(All_Changes.user) as Useraccounts from datamodel=Change where All_Changes.result_id="4732" OR All_Changes.result_id="4733" by All_Changes.dest All_Changes.action All_Changes.result  which provides me results: user account blabla added to group  user account blabla removed from group   etc However, I'd like to refine this search more to actually be able to determine if a user has been added to a particular privileged group and removed from that same group within a specific time frame, for instance within an hour.    Thanks in advance Erik     ... View more

Hi there,  The situation is as follows. We've a scheduled search running which is doing LDAP query on Active directory and putting all computer objects into one lookup file. The lookup file is being used by Enterprise security asset and identy managment.  We desire to put in priority for these assets. Now when we do this manually, via lookup editor, next time the scheduled search runs the priority is overwritten again with "nothing" Therefore we created a different csv file with only the prioritized assets in (And contained the same headers as in the "master" file). We would like to overwrite the "master" lookup file from asset&Identy management with the content of that new "prio" csv. After the schedule has run. How can you we achieve that?  Thanks in advance Erik ... View more