https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300518#M56815 <P>Hi jared_anderson,<BR /> install the Splunk App for Windows Infrastructure: see installation specs at <A href="http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/AbouttheSplunkAppforMSInfrastructure">http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/AbouttheSplunkAppforMSInfrastructure</A> : you can find all the TAs to install and how to install them.<BR /> Bye.<BR /> Giuseppe</P> Mon, 02 Apr 2018 21:45:20 GMT gcusello 2018-04-02T21:45:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300515#M56812 <P>We want to monitor Active Directory changes and security Events We are planning to deploy the Universal forwarder to each domain controller. I am confused by the documentation. What is needed/best practice to accomplish this? Do we need to install add-ons to the universal forwarder? Can we just monitor Windows Event security logs?</P> Mon, 02 Apr 2018 16:02:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300515#M56812 jared_anderson 2018-04-02T16:02:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300516#M56813 <P>@jared_anderson, you need to install the Universal forwarder and configure it to monitor these sources.</P> <P>The following <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/MonitorWindowseventlogdata">Monitor Windows event log data</A> </P> <P>says -</P> <P>Windows event log (*.evt) files are in binary format. You cannot monitor them like you do a normal text file. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files. </P> <P>Splunk Enterprise uses the following stanzas in <CODE>inputs.conf</CODE> to monitor the default Windows event logs:</P> <PRE><CODE># Windows platform specific input processor. [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 </CODE></PRE> <P>So,</P> <P>Do we need to install add-ons to the universal forwarder? <BR /> Nope</P> <P>Can we just monitor Windows Event security logs?<BR /> Yes</P> Mon, 02 Apr 2018 17:38:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300516#M56813 ddrillic 2018-04-02T17:38:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300517#M56814 <P>What benefit would there be to install add-ons to the universal forwarder. For example an active directory add-on?</P> Mon, 02 Apr 2018 19:52:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300517#M56814 jared_anderson 2018-04-02T19:52:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300518#M56815 <P>Hi jared_anderson,<BR /> install the Splunk App for Windows Infrastructure: see installation specs at <A href="http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/AbouttheSplunkAppforMSInfrastructure">http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/AbouttheSplunkAppforMSInfrastructure</A> : you can find all the TAs to install and how to install them.<BR /> Bye.<BR /> Giuseppe</P> Mon, 02 Apr 2018 21:45:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300518#M56815 gcusello 2018-04-02T21:45:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300519#M56816 <P>For some reason I can't mark your answer as "accept"</P> Tue, 03 Apr 2018 13:47:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Active-Directory-changes-and-security-events-with/m-p/300519#M56816 jared_anderson 2018-04-03T13:47:43Z