Security group

5actions

5reasons

1sources

Livestatus

A security group, both the group itself and who belongs to it.

Identified by: sparklogs.config_change.target, which carries a name.

Action	Reported by	What that reason says
created	security_group_created on Windows Security event log	A security group was created. Creation of a privileged group (Administrators, Domain Admins, and similar) carries a higher band.
deleted	security_group_deleted on Windows Security event log	A security group was deleted. Deletion of a privileged group (Administrators, Domain Admins, and similar) carries a higher band.
member_added	group_member_added on Windows Security event log	A member was added to a security-enabled group. Adds to privileged groups (Administrators, Domain Admins, and similar) carry the highest band, because they grant rights nothing takes back on its own.
member_removed	group_member_removed on Windows Security event log	A member was removed from a security-enabled group. Removals from privileged groups carry a higher band than ordinary group churn, because losing the last administrator or leaving Protected Users weakens the host in ways nothing else reports.
updated	security_group_changed on Windows Security event log	A security group's scope, type, or attributes changed. Changes to privileged groups (Administrators, Domain Admins, and similar) carry a higher band.

Example

A member was added to a security-enabled local group.

channel: Security
provider_name: Microsoft-Windows-Security-Auditing
event_id: 4732
event_data.TargetUserName: Administrators
event_data.TargetSid: S-1-5-32-544
event_data.MemberSid: S-1-5-21-1111111111-2222222222-3333333333-1001
event_data.MemberName: -
event_data.SubjectUserName: ExampleAdmin

SparkLogs: group_member_added, Error, group_member_added: NOTABLE: member added to security group | actor=ExampleAdmin target=Administrators