Breadcrumbs

EVID 4727...4760 : Account Management (Part 2) (XML - Security)

Event Details

Event Type

Audit Security Group Management

Event Description

  • 4727(S)

    : A security-enabled global group was created.

  • 4731(S)

    : A security-enabled local group was created.

  • 4734(S)

      : A security-enabled local group was deleted.

  • 4737 : A security-enabled global group was changed.

  • 4759(S) : A security-disabled universal group was created.

  • 4760(S) : A security-disabled universal group was changed.

Event IDs

4727 ,4731, 4734, 4737, 4759, 4760

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

N/A

N/A

Level

<severity>

<severity>

Task

N/A

<vendorinfo>

Opcode

N/A

N/A

Keywords

<tag1>

<result>

TimeCreated

N/A

N/A

EventRecordID

N/A

N/A

Correlation

N/A

N/A

Execution

N/A

N/A

Channel

N/A

N/A

Computer

<dname>

<dname>

TargetUserName

<account>, <group>

<group>

TargetDomainName

<domainimpacted>

<domainimpacted>

TargetSid

N/A

N/A

SubjectUserSid

N/A

N/A

SubjectUserName

<login>

<login>

SubjectDomainName

N/A

<domainorigin>

SubjectLogonId

<session>

<session>

PrivilegeList

N/A

N/A

SamAccountName

N/A

N/A

SidHistory

N/A

N/A

MemberName

N/A

<account>

GroupTypeChange

N/A

<action>

CallerProcessId

N/A

<processid>

CallerProcessName

N/A

<process>

AccountExpires

<objectname>

N/A

UserAccountControl

<objectname>

N/A

OldTargetUserName

<object>

N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Event

Classification

1007832

EVID 4720 : User Account Created

Sub Rule

User Account Created

Account Created

EVID 4726 : User Account Deleted

Sub Rule

User Account Deleted

Account Deleted

EVID 4725 : User Account Disabled

Sub Rule

Account Disabled

Access Revoked

EVID 4722 : User Account Enabled

Sub Rule

Account Enabled

Access Granted

EVID 4765 : SID History Added To Account

Sub Rule

Configuration Modified : System

Configuration

EVID 4766 : SID History Add To Account Failed

Sub Rule

SID History Add Failed

Critical

EVID 4724 : Failed Password Change Attempt

Sub Rule

Password Change Attempted

Other Audit Failure

EVID 4723 : Failed Password Change Attempt

Sub Rule

Password Change Attempted

Other Audit Failure

EVID 4781 : Account Name Changed

Sub Rule

User Account Name Modified

Account Modified

EVID 4743 : Computer Account Deleted

Sub Rule

Computer Account Deleted

Account Deleted

EVID 4742 : Computer Account Changed

Sub Rule

Computer Account Attribute Modified

Account Modified

EVID 4741 : Computer Account Created

Sub Rule

Computer Account Created

Account Created

EVID 4756 : Account Added To Group

Sub Rule

Account Added To Group

Access Granted

EVID 4723 : Password Change Attempt

Sub Rule

Password Modified

Account Modified

EVID 4724 : Password Change Attempt

Sub Rule

Password Modified

Account Modified

EVID 4738 : User Account Changed

Sub Rule

User Account Attribute Modified

Account Modified

Account Management

Base Rule

User Account Attribute Modified

Account Modified

EVID 4737 : Security Enabled Group Change

Sub Rule

Group Attribute Modified

Account Modified

EVID 4760 : Security Disabled Group Change

Sub Rule

Group Attribute Modified

Account Modified

EVID 4727 : Security Enabled Global Group Created

Sub Rule

Group Created

Account Created

EVID 4731 : Security Enabled Local Group Created

Sub Rule

Group Created

Account Created

EVID 4759 : Security Disabled Univ. Group Created

Sub Rule

Group Created

Account Created

EVID 4767 : User Account Unlocked

Sub Rule

Account Unlocked

Access Granted

EVID 4734 : Security Enabled Local Group Deleted

Sub Rule

Group Deleted

Account Deleted

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Common Event

Classification

1011139

V 2.0 : Group Management Events

Base Rule

Group Information

Information

V 2.0 : EVID 4727 : Sec-Enable Global Group Created

Sub Rule

Group Created

Account Created

V 2.0 : EVID 4728 : Member Added To Sec-Enable Global

Sub Rule

Account Added To Group

Access Granted

V 2.0 : EVID 4729 : Member Removed From Sec-Enabled

Sub Rule

Account Removed From Group

Access Revoked

V 2.0 : EVID 4730 : Sec-Enable Global Group Deleted

Sub Rule

Group Deleted

Account Deleted

V 2.0 : EVID 4731 : Sec-Enabled Local Group Created

Sub Rule

Group Created

Account Created

V 2.0 : EVID 4732 : Member Added To Sec-Enable Local

Sub Rule

Account Added To Group

Access Granted

V 2.0 : EVID 4733 : Member Removed From Sec-Enabled

Sub Rule

Account Removed From Group

Access Revoked

V 2.0 : EVID 4734 : Sec-Enable Local Group Deleted

Sub Rule

Group Deleted

Account Deleted

V 2.0 : EVID 4735 : Sec-Enable Local Group Modified

Sub Rule

Group Attribute Modified

Account Modified

V 2.0 : EVID 4737 : Sec-Enable Global Group Modified

Sub Rule

Group Attribute Modified

Account Modified

V 2.0 : EVID 4744 : Sec-Disable Local Group Create

Sub Rule

Group Created

Account Created

V 2.0 : EVID 4745 : Sec-Disable Local Group Modified

Sub Rule

Group Attribute Modified

Account Modified

V 2.0 : EVID 4746 : Member Added To Sec-Disable Local

Sub Rule

Account Added To Group

Access Granted

V 2.0 : EVID 4747 : Member Removed From Sec-Disable

Sub Rule

Account Removed From Group

Access Revoked

V 2.0 : EVID 4748 : Sec-Disable Local Group Deleted

Sub Rule

Group Deleted

Account Deleted

V 2.0 : EVID 4749 : Sec-Disable Global Group Created

Sub Rule

Group Created

Account Created

V 2.0 : EVID 4750 : Sec-Disable Global Group Modified

Sub Rule

Group Attribute Modified

Account Modified

V 2.0 : EVID 4751 : Member Added To Sec-Disable Global

Sub Rule

Account Added To Group

Access Granted

V 2.0 : EVID 4752 : Member Removed From Sec-Disabled

Sub Rule

Account Removed From Group

Access Revoked

V 2.0 : EVID 4753 : Sec-Disable Global Group Deleted

Sub Rule

Group Deleted

Account Deleted

V 2.0 : EVID 4754 : Sec-Enabled Univ Group Created

Sub Rule

Group Created

Account Created

V 2.0 : EVID 4755 : Sec-Enable Univ Group Modified

Sub Rule

Group Attribute Modified

Account Modified

V 2.0 : EVID 4756 : Member Added To Sec-Enable Univ

Sub Rule

Account Added To Group

Access Granted

V 2.0 : EVID 4757 : Member Removed From Sec-Enabled

Sub Rule

Account Removed From Group

Access Revoked

V 2.0 : EVID 4758 : Sec-Enable Global Univ Deleted

Sub Rule

Group Deleted

Account Deleted

V 2.0 : EVID 4759 : Sec-Disable Univ Group Created

Sub Rule

Group Created

Account Created

V 2.0 : EVID 4760 : Sec-Disable Univ Group Modified

Sub Rule

Group Attribute Modified

Account Modified

V 2.0 : EVID 4761 : Member Added To Sec-Disable Univ

Sub Rule

Account Added To Group

Access Granted

V 2.0 : EVID 4762 : Member Removed From Sec-Disable

Sub Rule

Account Removed From Group

Access Revoked

V 2.0 : EVID 4763 : Sec-Disable Global Univ Deleted

Sub Rule

Group Deleted

Account Deleted

V 2.0 : EVID 4764 : Group Type Changed

Sub Rule

Group Attribute Modified

Account Modified

V 2.0 : EVID 4799 : Sec-Enable Local Group Members

Sub Rule

Object Read

Access Success