Hi all.
First of all I have inherited our Splunk implementation and only have limited experience. Be gentle....
We currently have an alert configured that is monitoring forwarded events for group membership changes.
The query for the alert has the group names to be monitored hard coded. This most definitely does not scale.
What we would ideally like is to monitor any membership changes of all groups under one or more AD organisational units (recursive). By looking over Splunk documentation and this forum I suspect this would mean setting up one or more and AD Monitors and pointing them to the targeted OU's.
1.) Am I on the right track looking at an AD monitor.
2.) If so can someone point me in the general direction for how to set up an alert using the AD Monitor information.
Thanks in advance.
Jason.
... View more