1 Reply Latest reply on Dec 4, 2013 1:52 PM by rth67

    How to create a watchlist from a AD group

    hsanchez

      I need to create a watchlist for users added/removed from an AD group and any changes made by those users.  Any help would be appreciated.  Thank you.  

        • 1. Re: How to create a watchlist from a AD group
          rth67

          As an example, look at my response to the "Reporting.Alerting on an Event ID" question on how I built Alarms for users added or removed from Critical AD Groups.

           

          The thing you would add would be on the Alarm's Actions Tab, select "Update Watchlist" then configure what is to occur, Append > Source User > Watchlist Name

           

          As for changes made by the users in the updated watchlist, that would be another correlation rule.