ArcSight Logger Search - Windows Events for Group Changes

gistfile1.txt

deviceEventClassId IN ["Microsoft-Windows-Security-Auditing:4758","Microsoft-Windows-Security-Auditing:4754","Microsoft-Windows-Security-Auditing:755","Microsoft-Windows-Security-Auditing:4735","Microsoft-Windows-Security-Auditing:4734","Microsoft-Windows-Security-Auditing:4731","Microsoft-Windows-Security-Auditing:4730","Microsoft-Windows-Security-Auditing:4727","Microsoft-Windows-Security-Auditing:4737"] and NOT (destinationUserName ENDSWITH "$") and NOT (sourceUserName ENDSWITH "$")