Splunk Search for AD Logons for Users that Have Escalated Privileges Copy
sourcetype=syslog sudo | stats count by user host | map search="search index=ad_summary username=$user$ type_logon=ad_last_logon"
0 comments