Users and Groups Users and Groups Activities

Time interval -24h@h now Filter * *

`event_sources` eventtype=windows_account_created $keyword$ | timechart count $interval.earliest$ $interval.latest$ 1 ellipsisNone 0 visible visible visible none linear none linear none 0 inherit column 50 10 area gaps all 0.01 default shiny all 0 0 ellipsisMiddle standard bottom 2 progressbar 0 1 medium `event_sources` name="*currently disabled*" $keyword$ | eval domain=mvindex(Account_Domain,1) | eval source_computer = coalesce(Workstation_Name,src_ip) | eval domain = coalesce(domain,src_nt_domain) | table _time,host,domain,user,source_computer $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue `event_sources` name="A member was added to a security-enabled *" AND ("Enterprise Admins" OR "Domain Admins") $keyword$ | rename dest_nt_domain as domain, EventCode as "event id", Display_Name as "user name",host as server | dedup _time,user | eval added_by=mvindex(Security_ID,0) | eval user=mvindex(Security_ID,1) | table _time, server,domain, user,added_by $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue `event_sources` name="A member was added to a security-enabled local group" AND user_group="Administrators" $keyword$ | rename dest_nt_domain as domain, EventCode as "event id", Display_Name as "user name",host as server | eval added_by=mvindex(Security_ID,0) | eval user=mvindex(Security_ID,1) | table _time, server,domain, user,added_by $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue `event_sources` eventtype=windows_account_created | rename dest_nt_domain as domain, EventCode as "event id", Display_Name as "user name",host as server | dedup _time,user | eval created_by=mvindex(Account_Name,0) | table _time, server,domain, user,"user name", created_by | sort _time $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue `event_sources` AND eventtype=windows_account_deleted $keyword$ | eval deleted_by=mvindex(Account_Name,0) | table _time, host, user,deleted_by | sort _time $interval.earliest$ $interval.latest$ 1 cellprogressbar `event_sources` name="A security-enabled global group was created" | dedup _time,Group_Name | rename dest_nt_domain as domain, EventCode as "event id", user as "created_by",host as server | table _time, server,domain,Group_Name, created_by | sort _time $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue `event_sources` name="A security-enabled global group was deleted" $keyword$ | rename dest_nt_domain as domain, EventCode as "event id", user as "Deleted by",host as server | table _time, server,domain,Group_Name, "Deleted by" | sort _time $interval.earliest$ $interval.latest$ 1 20nonecellfalseprogressbarfalsefalsetrue