ADAudit plus integration with Splunk Enterprise

[sir_swade]

Has anyone be able to get adaudit plus to integrate with Splunk Enterprise?  I followed these instructions but have not gotten any data to show on the indexer.

SIEM integration | Admin settings | ADAudit Plus (manageengine.com)

Also contacted ManageEngine support which has not be able to figure out the issue.  I searched the forum and found this old thread but no one had a response.

How to get audit plus manager logs into splunk ent... - Splunk Community

Any help is appreciated, thanks.

[maheshnc]

Hi,

Have you got resolution?

[PickleRick]

I don't think the ADAudit solution is a very popular one so it might be difficult to find someone with much experience with it let alone knowing your particular problem.

Having said that - the linked page describes pushing events to Splunk's HEC input - that's a fairly standard way of getting the data into Splunk so the troubleshooting would be as with any other HEC source - check if the source even tries to connect to your Splunk receiving component (indexer or HF, wherever you configured the HEC input). Check if it succeeds. Verify if TLS negotiates properly (if enabled).

These are all things you can get from a simple tcpdump/wireshark run.