EVID 4727...4764 : Group Management (Security)

Event Details

Event Type	Account Security Group Management
Event Description	4727(S) : A security-enabled global group was created. 4730(S) : A security-enabled global group was deleted. 4731(S) : A security-enabled local group was created. 4734(S) : A security-enabled local group was deleted. 4735(S) : A security-enabled local group was changed. 4737 : A security-enabled global group was changed. 4744 : A security-disabled local group was created. 4745 : A security-disabled local group was changed. 4748 : A security-disabled local group was deleted. 4749 : A security-disabled global group was created. 4750 : A security-disabled global group was changed. 4753(S) : A security-disabled global group was deleted. 4754(S) : A security-enabled universal group was created. 4755 : A security-enabled universal group was changed. 4758(S) : A security-enabled universal group was deleted. 4759(S) : A security-disabled universal group was created. 4760(S) : A security-disabled universal group was changed. 4763(S) : A security-disabled universal group was deleted. 4764 : A security-disabled group was deleted.
Event IDs	4727, 4730, 4731, 4734, 4735, 4737, 4744, 4745, 4748, 4749, 4750, 4753, 4754, 4755, 4758, 4759, 4760, 4763, 4764

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	N/A	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	<tag1>	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
EventData	<vendorinfo>	N/A
GroupTypeChange	N/A	<action>
MemberName	N/A	<account>
MemberSid	N/A	N/A
TargetUserName	N/A	<group>
TargetDomainName	N/A	<domainimpacted>
TargetSid	N/A	N/A
SubjectUserSid	N/A	N/A
SubjectUserName	N/A	<login>
SubjectDomainName	N/A	<domainorigin>
SubjectLogonId	N/A	<session>
PrivilegeList	N/A	N/A
CallerProcessId	N/A	<processid>
CallerProcessName	N/A	<process>
SamAccountName	<account>	N/A
SidHistory	<objecttype>	N/A
Account Name	<login>	N/A
Account Domain	<domain>	N/A
Logon ID	<session>	N/A
Security ID	N/A	N/A
(Account\|Group) Domain	N/A	N/A
Group Name	<group>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1000637	Group Management	Base Rule	Group Created	Account Created
	EVID 4727 : Global Security Group Created	Sub Rule	Group Created	Account Created
	EVID 4730 : Global Security Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4731 : Local Security Group Created	Sub Rule	Group Created	Account Created
	EVID 4734 : Local Security Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4764 : Group Type Changed	Sub Rule	Group Attribute Modified	Account Modified
	EVID 4763 : Universal Distribution Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4760 : Universal Distribution Group Changed	Sub Rule	Group Attribute Modified	Account Modified
	EVID 4759 : Universal Distribution Group Created	Sub Rule	Group Created	Account Created
	EVID 4758 : Universal Security Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4755 : Universal Security Group Changed	Sub Rule	Group Attribute Modified	Account Modified
	EVID 4754 : Universal Security Group Created	Sub Rule	Group Created	Account Created
	EVID 4753 : Global Distribution Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4750 : Global Distribution Group Changed	Sub Rule	Group Attribute Modified	Account Modified
	EVID 4749 : Global Distribution Group Created	Sub Rule	Group Created	Account Created
	EVID 4748 : Local Distribution Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4745 : Local Distribution Group Changed	Sub Rule	Group Attribute Modified	Account Modified
	EVID 4744 : Local Distribution Group Created	Sub Rule	Group Created	Account Created
	EVID 4737 : Global Security Group Changed	Sub Rule	Group Attribute Modified	Account Modified
	EVID 4735 : Local Security Group Changed	Sub Rule	Group Attribute Modified	Account Modified

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011139	V 2.0 : Group Management Events	Base Rule	Group Information	Information
	V 2.0 : EVID 4727 : Sec-Enable Global Group Create	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4728 : Memb Add To Sec-Enable Global	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4729 : Memb Remove From Sec-Enabled	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4730 : Sec-Enable Global Group Delete	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4731 : Sec-Enabled Local Group Create	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4732 : Memb Add To Sec-Enable Local	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4733 : Memb Remove From Sec-Enabled	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4734 : Sec-Enable Local Group Delete	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4735 : Sec-Enable Local Group Modifi	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4737 : Sec-Enable Global Group Modifi	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4744 : Sec-Disable Local Group Create	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4745 : Sec-Disable Local Group Modifi	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4746 : Memb Add To Sec-Disable Local	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4747 : Memb Remove From Sec-Disable	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4748 : Sec-Disable Local Group Delete	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4749 : Sec-Disabl Global Group Create	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4750 : Sec-Disable Global Group Modif	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4751 : Memb Add To Sec-Disable Global	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4752 : Memb Remove From Sec-Disabled	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4753 : Sec-Disable Global Group Delet	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4754 : Sec-Enabled Univ Group Create	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4755 : Sec-Enable Univer Group Modifi	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4756 : Memb Add To Sec-Enable Univer	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4757 : Memb Remove From Sec-Enabled	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4758 : Sec-Enable Global Unive Delete	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4759 : Sec-Disable Unive Group Create	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4760 : Sec-Disable Unive Group Modifi	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4761 : Memb Add To Sec-Disable Univer	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4762 : Memb Remove From Sec-Disable	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4763 : Sec-Disable Global Univ Delete	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4764 : Group Type Changed	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4799 : Sec-Enable Local Group Members	Sub Rule	Object Read	Access Success