Monitor Active Directory Group Memberships

Comments

1 comment

  • Avatar
    Piotr Woch

    Hi Marc!

    This query will give you the list contractor users created in the past 30 days:

    https://service.sumologic.com/ui/#/search/OOxwieA2iNTG0Ul55unUktXEK6dzXOhTyjxlOma3

    This is the query syntax I composed to get you the results:

    _sourceCategory=security/prod/windows/domaincontroller*
    | parse regex "CN=(?<MemberName>[^,]*),OU=(?<OU1>[^,]*),OU=(?<OU2>[^,]*),DC=omada,DC=me"
    | where [subquery:
    _sourceCategory=security/prod/windows/domaincontroller*
    | parse "Display Name:*\n" as MemberName
    | trim(MemberName) as MemberName
    | parse "Message = \"*\n" as message
    | parse "CategoryString = \"*\";" as category
    | where message matches "A user account was created.*" and category = "User Account Management"
    | compose MemberName]
    | where OU1 matches "*Contractor*"
    | fields -_raw

    Feel free to take it further and expand as your find useful.

    Do not hesitate to let me know if you have any questions I could help answer.

    Best regards,

    Piotr Woch

    Customer Success Manager

    0
    Comment actions Permalink

Please sign in to leave a comment.