group

Event fields used to define/normalize metadata about a security group, or distribution group that is created changed or deleted.

Attributes

Name	Type	Description	Sample Value
group_domain	string	domain or computer name of the group	`CONTOSO`
group_name	string	the name of a security group, or a distribution group that is created,changed, or deleted	`AccountOperators`
group_sam_name	string	this is a name of the group used to support clients and servers from previous versions of Windows (pre-Windows 2000 logon name). The value of sAMAccountName attribute of new group object. For example: ServiceDesk. For local groups it is simply a name of new group	`AccountOperators`
group_sid	string	SID of a group	`S-1-5-21-3457937927-2839227994-823803824-6605`
group_sid_history	string	contains previous SIDs used for the object if the object was moved from another domain. Whenever an object is moved from one domain to another, a new SID is created and becomes the objectSID. The previous SID is added to the sIDHistory property. This parameter contains the value of sIDHistory attribute of a group object. This parameter might not be captured in the event, and in that case appears as "-". For local groups it is not applicable and always has "-" value.	`-`