Alerting

Monitoring Active Directory groups, is it possible to send an email alert to the individual who was added or removed from the group?

8i5
Engager

We'd like to use Splunk to monitor active directory groups but rather than email a fixed address when there are changes, we'd like to send an email alert to the individual who was added or removed from the group.

How would we go about doing this?

lmyrefelt
Builder

It seems to be an app for that;

https://apps.splunk.com/app/1794/

🙂

0 Karma

f10353
New Member

Is there a sample search that could be shared for Active Directory Group changes (meaning additions or deletions)?

0 Karma

jkat54
SplunkTrust
SplunkTrust

There are similar searches in the app for windows infrastructure just need to be a bit inventive and send them to the sendemail command as a token, etc.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...