Alerting on Active Directory group name

[Anonymous]

I'm trying to work on alerting to changes to groups in Active Directory like the Domain Admins group.

I can see the event in investigate, I can also see the group name 'Domain Admins' is in the event, but I noticed that the icon looks different to other meta keys, and in investigate it appears that the group meta key doesn't work either.

I assume that the meta key 'Group' is not defined properly somewhere.

[DaveGlover]

Jeremy

It appears as if ‘group’ is not indexed. That however should not matter for ESA.

Do you know if you have defined it in the index-concentrator-custom file?

Dave

[Anonymous]

Hi Dave,

It's not defined in the custom concentrator file, but for my use case, I don't think it will matter.

I was just doing some testing and what I want to do if maintain a list of groups that I want to be alerted on if their group membership changes.

I tested the generation of meta on the alert key with an app rule successfully, which I'll then create a workflow to action upon.

Thanks.