Hi,
I wrote code for " User Account Activity Report " as below. However the result is showing only for accessing/execute the "xxx.exe" files.
Account_Name=* | fields - _raw | fields _time, Account_Name, Security_ID, ComputerName, sourcetype, Process_Name, Message, splunk_server, action | dedup _time Account_Name ComputerName
Could you please help me the code for also "Registry changes , programs installations & other actions like changes in system32 folder ".
Note example: ABC user worked on xyz.exe application for 4 hours. I see more than 500 lines in csv report for this action. Is possible to control this? instead of showing 500 lines will be possible to show 500 count?
Is possible for below conditions?
Schedule report for User Activity report as csv,
Thanks in advance.
Anyone please give suggestions; how to write code for User Account Activity report.
Login activity
Application access/execute/close activity
Logout activity
At least give me a comment, will this possible or not?