Synopsis
SIEM Pull Service has detected via Splunk query that, on this Linux system, a user was removed from a group.
Description
SIEM Pull Service has detected via Splunk query that, on this Linux system, a user was removed from a group. The query used was (sourcetype=linux_audit OR sourcetype=linux_secure) AND ("op=user * removed by * from group" OR op=delete-user-from-group)
