Showing results for 
Search instead for 
Did you mean: 

How to create a watchlist from a AD group

I need to create a watchlist for users added/removed from an AD group and any changes made by those users.  Any help would be appreciated.  Thank you.  

1 Reply
Level 12
Report Inappropriate Content
Message 2 of 2

Re: How to create a watchlist from a AD group

As an example, look at my response to the "Reporting.Alerting on an Event ID" question on how I built Alarms for users added or removed from Critical AD Groups.

The thing you would add would be on the Alarm's Actions Tab, select "Update Watchlist" then configure what is to occur, Append > Source User > Watchlist Name

As for changes made by the users in the updated watchlist, that would be another correlation rule.