topic Re: Can someone share documentation on the best process to verify domain controller logs in Splunk? in Splunk Search

Can someone share documentation on the best process to verify domain controller logs in Splunk?

GIA — Fri, 01 Dec 2023 01:19:23 GMT

I am very new using Splunk but I am enjoying it a lot so far.

I am being tasked with writing a document on how to verify that all Domain Controller's logs are going into Splunk for the SecOps team to action on a daily basis. Can someone please point to a good document on this process? Thank you in advance!

Re: Can someone share documentation on the best process to verify domain controller logs in Splunk?

gcusello — Fri, 01 Dec 2023 06:52:08 GMT

Hi @GIA ,

I don't know at what step of the DC monitoring you are:

at first, you should take logs from your DCs using a Splunk Universal Forwarder.

On this UF you have to deploy the Splunk Add-On for Microsoft Windows (https://splunkbase.splunk.com/app/742), enabling all the stanzas.

Then you have to configure your UFs to send logs to a Splunk instance.

On this instance, you have to install the same Splunk Add-On for Microsoft Windows and the Domain Controller Monitoring App for Splunk (https://splunkbase.splunk.com/app/6698).

This last app should give you some Use Cases for monitoring your DCs, if they aren't sufficient, you can develop your Use Cases using the SPL.

Ciao.

Giuseppe

Re: Can someone share documentation on the best process to verify domain controller logs in Splunk?

GIA — Sat, 02 Dec 2023 23:28:09 GMT

Thanks a lot!

Re: Can someone share documentation on the best process to verify domain controller logs in Splunk?

gcusello — Sun, 03 Dec 2023 06:34:26 GMT

Hi @GIA ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉