EVID 4728...4762 : Group Member Added/Removed (XML - Security)

Event Details

Event Type	Group Member Added/Removed
Event Description	4728(S) : A member was added to a security-enabled global group. 4729(S) : A member was removed from a security-enabled global group. 4730(S) : A security-enabled global group was deleted. 4732(S) : A member was added to a security-enabled local group. 4733(S) : A member was removed from a security-enabled local group. 4735(S) : A security-enabled local group was changed. 4746(S) : A member was added to a security-disabled local group. 4747(S) : A member was removed from a security-disabled local group. 4749(S) : A security-disabled global group was created. 4751(S) : A member was added to a security-disabled global group. 4752(S) : A member was removed from a security-disabled global group. 4753(S) : A security-disabled global group was deleted. 4756(S) : A member was added to a security-enabled universal group. 4757(S) : A member was removed from a security-enabled universal group. 4758(S) : A security-enabled universal group was deleted. 4761(S) : A member was added to a security-disabled universal group. 4762(S) : A member was removed from a security-disabled universal group.
Event IDs	4728, 4729, 4730, 4732, 4733, 4735, 4746, 4747, 4749, 4751, 4752, 4753, 4756, 4757, 4758, 4761, 4762

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	<command>	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
TargetUserName	<group>	<group>
TargetDomainName	<object>	<domainimpacted>
TargetSid	N/A	N/A
SubjectUserSid	N/A	<domainorigin>, <login>
SubjectUserName	<login>	<login>
SubjectDomainName	<domainorigin>	<domainorigin>
SubjectLogonId	<session>	<session>
PrivilegeList	N/A	N/A
SamAccountName	N/A	N/A
SidHistory	N/A	N/A
MemberName	<sname>	<account>
MemberSid	<domainimpacted>, <account>	<domainimpacted>, <account>
CallerProcessName	N/A	<process>
CallerProcessId	N/A	<processid>
GroupTypeChange	N/A	<action>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1007836	Group Member Added/Removed	Base Rule	Account Added To Group	Access Granted
	EVID 4762 : User Removed From Univ Distribution Group	Sub Rule	Account Removed From Group	Access Revoked
	EVID 4757 : User Removed From Univ Security Group	Sub Rule	Account Removed From Group	Access Revoked
	EVID 4756 : User Added To Univ Security Group	Sub Rule	Account Added To Group	Access Granted
	EVID 4752 : User Removed From Global Distribution Group	Sub Rule	Account Removed From Group	Access Revoked
	EVID 4761 : User Added To Universal Distribution Group	Sub Rule	Account Added To Group	Access Granted
	EVID 4751 : User Added To Global Distribution Group	Sub Rule	Account Added To Group	Access Granted
	EVID 4747 : User Removed From Local Distribution Group	Sub Rule	Account Removed From Group	Access Revoked
	EVID 4746 : User Added To Local Distribution Group	Sub Rule	Account Added To Group	Access Granted
	EVID 4733 : User Removed From Local Security Group	Sub Rule	Account Removed From Group	Access Revoked
	EVID 4732 : User Added To Local Security Group	Sub Rule	Account Added To Group	Access Granted
	EVID 4729 : User Removed From Global Security Group	Sub Rule	Account Removed From Group	Access Revoked
	EVID 4728 : User Added To Global Security Group	Sub Rule	Account Added To Group	Access Granted
	EVID 4749 : Sec-Disabled Global Group Created	Sub Rule	Group Created	Account Created
	EVID 4751 : User Added To Sec-Disabled Global Group	Sub Rule	Account Added To Group	Access Granted
	EVID 4753 : Sec-Disabled Global Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4730 : Sec-Enabled Global Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4758 : Universal Security Group Deleted	Sub Rule	Group Deleted	Account Deleted
	EVID 4735 : Local Security Group Changed Logs	Sub Rule	Group Attribute Modified	Account Modified

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011139	V 2.0 : Group Management Events	Base Rule	Group Information	Information
	V 2.0 : EVID 4727 : Sec-Enable Global Group Created	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4728 : Member Added To Sec-Enable Global	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4729 : Member Removed From Sec-Enable	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4730 : Sec-Enable Global Group Deleted	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4731 : Sec-Enabled Local Group Created	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4732 : Member Added To Sec-Enable Local	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4733 : Member Removed From Sec-Enabled	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4734 : Sec-Enable Local Group Deleted	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4735 : Sec-Enable Local Group Modified	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4737 : Sec-Enable Global Group Modified	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4744 : Sec-Disable Local Group Created	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4745 : Sec-Disable Local Group Modified	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4746 : Member Added To Sec-Disable Local	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4747 : Member Removed From Sec-Disable	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4748 : Sec-Disable Local Group Deleted	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4749 : Sec-Disable Global Group Created	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4750 : Sec-Disable Global Group Modified	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4751 : Member Added To Sec-Disable Global	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4752 : Member Removed From Sec-Disabled	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4753 : Sec-Disable Global Group Deleted	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4754 : Sec-Enabled Univ Group Created	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4755 : Sec-Enable Univ Group Modified	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4756 : Member Added To Sec-Enable Univ	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4757 : Member Removed From Sec-Enabled	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4758 : Sec-Enable Global Univ Deleted	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4759 : Sec-Disable Univ Group Created	Sub Rule	Group Created	Account Created
	V 2.0 : EVID 4760 : Sec-Disable Univ Group Modified	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4761 : Member Added To Sec-Disable Univ	Sub Rule	Account Added To Group	Access Granted
	V 2.0 : EVID 4762 : Member Removed From Sec-Disable	Sub Rule	Account Removed From Group	Access Revoked
	V 2.0 : EVID 4763 : Sec-Disable Global Univ Deleted	Sub Rule	Group Deleted	Account Deleted
	V 2.0 : EVID 4764 : Group Type Changed	Sub Rule	Group Attribute Modified	Account Modified
	V 2.0 : EVID 4799 : Sec-Enable Local Group Members	Sub Rule	Object Read	Access Success