AD Global Group Membership Changes (365d)
This rule monitors Windows Security Event Logs for Event IDs 4728 and 4729, which indicate that a security-enabled global group has had a member added or removed, respectively. By aggregating these changes by group name and event action, it provides a summary of administrative activity regarding Active Directory group membership changes over a 365-day period.
Cortex XDR
