XQL insert group into active directory

[cylusaragao]

Hi team,

Does anyone have xql that sends the log when I add a user to a group in the active directory?

[nsinghvirk · Accepted solution]

Hello @cylusaragao 

Thanks for reaching out on LiveCommunity!

Below is a reference query which you can use to build correlation rule to generate alert.

dataset = xdr_data
| filter event_id contains "4728"
| fields action_evtlog_description , event_timestamp , action_evtlog_normalized_user

Correlation rules - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Correlation-rule-deta...

Notification forwarding - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Configure-notificatio...

 Please click Accept as Solution to acknowledge that the answer to your question has been provided.