IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Shared Folder or File

    Posted 05/15/24 05:03 PM
    Edited by Beko Resiti 05/15/24 05:04 PM

    How to identify from logs or how to find from Qadar logs or from Log source which privileged user (or domain admin) or group policy has given right to access to the "shared folder or file" for a single domain user? Is there a possible way to find it out when the permissions of folder have been changed for a single CN or OU in order to get access to the specific shared folder in windows server environment?



    ------------------------------
    Beko Resiti
    ------------------------------



  • 2.  RE: Shared Folder or File

    Posted 05/16/24 05:27 AM

    You can start by looking for this event ID -- 5136(S): A directory service object was modified -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5136

    Auditing logs must be enabled on Windows to get these events and forward them to QRadar.



    ------------------------------
    Joao Caetano
    ------------------------------



Related Content