<110>2024-03-27T10:27:09.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = GroupMgmtReports ]  [ REPORT_PROFILE = Security Group Membership Changes ]  [ SOURCE = nordc-dc-03.acme.com ]  [ GROUP_TYPE = Security ]  [ GROUP_SCOPE = Global ]  [ GROUP_MGMT_TYPE = - ]  [ FORMAT_MESSAGE = Member 'CN=Trimble\, Kamilah,OU=Norcross Local Admins,OU=MDS-ATL Laptop User Directory,OU=Corp-Users,DC=acme,DC=com' was removed from Global Security Group 'Simpplr_Users' by 'MDS-ATL\ssmith'. ]  [ TIME_GENERATED = 1711549629 ]  [ PRIVILEGES = - ]  [ ACCOUNT_NAME = Simpplr_Users ]  [ ACCOUNT_DOMAIN = MDS-ATL ]  [ ACCOUNT_SID = %{S-1-5-21-1725571127-999974082-2044928816-40191} ]  [ CALLER_USER_NAME = ssmith ]  [ CALLER_USER_DOMAIN = MDS-ATL ]  [ CALLER_LOGON_ID = 0x16bb8b20c ]  [ SAM_ACCOUNT_NAME = null ]  [ SID_HISTORY = null ]  [ OLD_ACCOUNT_NAME = null ]  [ MEMBER_NAME = CN=Trimble\, Kamilah,OU=Norcross Local Admins,OU=MDS-ATL Laptop User Directory,OU=Corp-Users,DC=acme,DC=com ]  [ MEMBER_SID = S-1-5-21-1725571127-999974082-2044928816-26144 ]  [ EVENT_NUMBER = 4729 ]  [ REMARKS = A member was removed from a security-enabled global group. ]  [ RECORD_NUMBER = 1041091822 ]  [ CALLER_USER_SID = S-1-5-21-1725571127-999974082-2044928816-21433 ]  [ ATTRIBUTES_TEXT = null ]  [ ATTRIBUTES_NEW_VALUE = null ]  [ ATTRIBUTES_OLD_VALUE = null ]  [ CORRELATION_ID = null ]  [ ATTRIBUTE_CATEGORY_ID = 1 ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = Simpplr_Users ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = CN=Simpplr_Users,OU=Security Groups - Local,OU=Corp-Groups,DC=acme,DC=com ]  [ ACCOUNT_NAME_OU_GUID = {B79FCDFD-311B-4DF5-92CE-DA9EA57C6FAC} ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = Shawn Smith ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = CN=Shawn Smith,OU=ADMP Admins,OU=GPO Test,OU=Administrative Accounts,OU=MDS-ATL Exempt User Directory,OU=Corp-Users,DC=acme,DC=com ]  [ CALLER_USER_OU_GUID = {1E300D52-93CC-436A-96B2-9864D4269F10} ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ MEMBER_SAM_ACCOUNT_NAME = kamilaht ]  [ MEMBER_DISPLAY_NAME = Trimble, Kamilah ]  [ MEMBER_USER_PRINCIPAL_NAME = null ]  [ MEMBER_USER_GUID = {0142A1B8-1E4A-434B-B9CE-3FA2B456984E} ]  [ MEMBER_DISTINGUISH_NAME = null ]  [ MEMBER_NAME_OU_GUID = {288F27D6-DA76-4795-A52E-88CE00B2930A} ]  [ MEMBER_USER_DEPARTMENT = null ]  [ MEMBER_USER_MANAGER_NAME = null ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ ATTRIBUTE_SYNTAX = null ]  [ OP_APPLN_CORRELATION_ID = null ]  [ OP_CORRELATION_ID = null ]  [ OP_TREE_DELETE = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = null ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = - ]  [ EXTRA_COLUMN5 = 192.168.10.13 ]  [ EXTRA_COLUMN6 = Network (i.e. connection to shared folder on this computer from elsewhere on network or IIS logon) ]  [ EXTRA_COLUMN7 = 3 ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ PERMISSION_CHANGES = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ ACTUAL_ATTR_NEW_VALUE = null ]  [ ACTUAL_ATTR_OLD_VALUE = null ] 
{
    "facilityCode": 13,
    "facilityLabel": "log audit",
    "fieldExtractorName": "ad_audit_plus",
    "localHostname": "Nordc-app-Dell",
    "localStartTime": "2024-03-27T10:27:09.000-04:00",
    "message": "<110>2024-03-27T10:27:09.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = GroupMgmtReports ]  [ REPORT_PROFILE = Security Group Membership Changes ]  [ SOURCE = nordc-dc-03.acme.com ]  [ GROUP_TYPE = Security ]  [ GROUP_SCOPE = Global ]  [ GROUP_MGMT_TYPE = - ]  [ FORMAT_MESSAGE = Member 'CN=Trimble\\, Kamilah,OU=Norcross Local Admins,OU=MDS-ATL Laptop User Directory,OU=Corp-Users,DC=acme,DC=com' was removed from Global Security Group 'Simpplr_Users' by 'MDS-ATL\\ssmith'. ]  [ TIME_GENERATED = 1711549629 ]  [ PRIVILEGES = - ]  [ ACCOUNT_NAME = Simpplr_Users ]  [ ACCOUNT_DOMAIN = MDS-ATL ]  [ ACCOUNT_SID = %{S-1-5-21-1725571127-999974082-2044928816-40191} ]  [ CALLER_USER_NAME = ssmith ]  [ CALLER_USER_DOMAIN = MDS-ATL ]  [ CALLER_LOGON_ID = 0x16bb8b20c ]  [ SAM_ACCOUNT_NAME = null ]  [ SID_HISTORY = null ]  [ OLD_ACCOUNT_NAME = null ]  [ MEMBER_NAME = CN=Trimble\\, Kamilah,OU=Norcross Local Admins,OU=MDS-ATL Laptop User Directory,OU=Corp-Users,DC=acme,DC=com ]  [ MEMBER_SID = S-1-5-21-1725571127-999974082-2044928816-26144 ]  [ EVENT_NUMBER = 4729 ]  [ REMARKS = A member was removed from a security-enabled global group. ]  [ RECORD_NUMBER = 1041091822 ]  [ CALLER_USER_SID = S-1-5-21-1725571127-999974082-2044928816-21433 ]  [ ATTRIBUTES_TEXT = null ]  [ ATTRIBUTES_NEW_VALUE = null ]  [ ATTRIBUTES_OLD_VALUE = null ]  [ CORRELATION_ID = null ]  [ ATTRIBUTE_CATEGORY_ID = 1 ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = Simpplr_Users ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = CN=Simpplr_Users,OU=Security Groups - Local,OU=Corp-Groups,DC=acme,DC=com ]  [ ACCOUNT_NAME_OU_GUID = {B79FCDFD-311B-4DF5-92CE-DA9EA57C6FAC} ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = Shawn Smith ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = CN=Shawn Smith,OU=ADMP Admins,OU=GPO Test,OU=Administrative Accounts,OU=MDS-ATL Exempt User Directory,OU=Corp-Users,DC=acme,DC=com ]  [ CALLER_USER_OU_GUID = {1E300D52-93CC-436A-96B2-9864D4269F10} ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ MEMBER_SAM_ACCOUNT_NAME = kamilaht ]  [ MEMBER_DISPLAY_NAME = Trimble, Kamilah ]  [ MEMBER_USER_PRINCIPAL_NAME = null ]  [ MEMBER_USER_GUID = {0142A1B8-1E4A-434B-B9CE-3FA2B456984E} ]  [ MEMBER_DISTINGUISH_NAME = null ]  [ MEMBER_NAME_OU_GUID = {288F27D6-DA76-4795-A52E-88CE00B2930A} ]  [ MEMBER_USER_DEPARTMENT = null ]  [ MEMBER_USER_MANAGER_NAME = null ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ ATTRIBUTE_SYNTAX = null ]  [ OP_APPLN_CORRELATION_ID = null ]  [ OP_CORRELATION_ID = null ]  [ OP_TREE_DELETE = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = null ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = - ]  [ EXTRA_COLUMN5 = 192.168.10.13 ]  [ EXTRA_COLUMN6 = Network (i.e. connection to shared folder on this computer from elsewhere on network or IIS logon) ]  [ EXTRA_COLUMN7 = 3 ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ PERMISSION_CHANGES = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ ACTUAL_ATTR_NEW_VALUE = null ]  [ ACTUAL_ATTR_OLD_VALUE = null ] ",
    "messageType": "audit_log",
    "priority": 110,
    "program": "ADAuditPlus",
    "senderHost": "192.168.10.233",
    "sensitivity": "normal",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "ad_audit_plus",
    "tags": [
        "rfc3164",
        "ad_audit_plus",
        "audit_log"
    ]
}