How ingest logs AD from specific OU

[mitnibel]

Hello,

We have a AD with diferents OU and we need ingest only logs from one OU. The problem with logs from AD is that only logs of security group management category appear the OU.

Someone know if exists possibility to send OU in all security log entries (f.ex: logon)? Or know any other possibility to separate log from OU's?

Thanks.

Regards,

[mitnibel]

Hello,

With this, only log the changes in groups AD of OU, but not for other event type as logon, because in this log not appear OU.

we need monitoring logs of AD logon in one specific OU. It's possible with other metodology?

Regards,

[jacobpevans]

Greetings @mitnibel,

The Splunk add-on for Windows handles this natively. See documentation here: https://docs.splunk.com/Documentation/WindowsAddOn/latest/User/AbouttheSplunkAdd-onforWindows.

Once you have the add-on installed and AD configured, navigate to Settings > Data Inputs > "+ Add New" [Active Directory Monitoring], and you will see an option for Starting node.

Cheers,
Jacob

[mitnibel]

Hello,

With this, only log the changes in groups AD of OU, but not for other event type as logon, because in this log not appear OU.

we need monitoring logs of AD logon in one specific OU. It's possible with other metodology?

Regards,