topic Re: Help on AD monitoring with Splunk in Splunk Enterprise

Help on AD monitoring with Splunk

jip31 — Fri, 03 Sep 2021 04:06:15 GMT

I try to list the different way to collect Active Directory in Splunk

Except if I am mistaken there is 2 main way to do that :

Using the Splunk Supporting Add-on for Active Directory: https://splunkbase.splunk.com/app/1151/
Using the splunk-admon.exe process

Is it true? What are the advantages and disadvantages of these solutions please?

Is it also possible to install a connector between Splunk and AD in order to store the AD events in a KV Store?

Thanks in advance

Re: Help on AD monitoring with Splunk

shivanshu1593 — Fri, 03 Sep 2021 10:24:08 GMT

Hi @jip31 ,

Splunk recommends using the Active Directory add on. It's much faster, efficient and easy to debug, if you encounter issues on it.

It gives you a connection with the AD forest. After that, all you need to do is to configure a simple search to query the data and outputlookup into a KVStore lookup, just what you're looking for.

Hope this helps.

Thanks,

***If this helped, please accept it as a solution. It helps others to find the solution for similar issues quickly.***

Re: Help on AD monitoring with Splunk

jip31 — Sat, 04 Sep 2021 06:35:06 GMT

Thanks for your explanation on Active Directory add on

Just another question

Is it also possible to use a DB connect and to link it with the AD forest and to export events in a KV Store lookup?

Re: Help on AD monitoring with Splunk

shivanshu1593 — Sat, 04 Sep 2021 12:03:18 GMT

I believe you can query AD using SQL commands, so technically it is possible. I'd consult with the server team and see if they are okay with it.

To pipe the data into a KVStore using DBconnect is a big pain in the rear end. You'll have to do the following:

1. Create a search using dbquery command and get the desired output from AD forest.

2. Use outputlookup to put the data into KVStore.

3. Save the search as scheduled search to keep the process going.

Hope this helps.

Thank you,

***If this helped, please accept it as a solution. It helps others to find the solution for similar issues quickly.***