XQL insert group into active directory

cylusaragao — Mon, 09 Sep 2024 11:54:55 GMT

Hi team,

Does anyone have xql that sends the log when I add a user to a group in the active directory?

Re: XQL insert group into active directory

nsinghvirk — Mon, 09 Sep 2024 15:19:04 GMT

Thanks for reaching out on LiveCommunity!

Below is a reference query which you can use to build correlation rule to generate alert.

dataset = xdr_data
| filter event_id contains "4728"
| fields action_evtlog_description , event_timestamp , action_evtlog_normalized_user

Please click Accept as Solution to acknowledge that the answer to your question has been provided.