query.txt
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757]) | day := formatTime(format="%Y-%m-%d", field=@timestamp, timezone="Europe/Berlin") | rename(field="windows.EventData.TargetUserName", as="group") | groupBy([day, group], function=count())
Aggregate Active Directory group membership additions and removals into a daily count by group for compliance reporting and anomaly baselining. Keep the timezone aligned with your investigation queries. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
LogScaleComplianceActiveDirectoryComplianceMonitoring+1
@sebastian · 2.8.2026