All Apps and Add-ons

How to index Active Directory data?

dagar_ruralking
Loves-to-Learn

The SSE docs https://docs.splunksecurityessentials.com/data-onboarding-guides/windows-security-logs/ don't mention AD data. How should these be indexed?

0 Karma

David
Splunk Employee
Splunk Employee

For security use cases, the most important data source is Windows Security Logs from the Active Directory Domain Controllers. The guide you linked (or found in the app) will absolutely cover those logs.

The second most significant data source is Active Directory itself, via admon. That is documented here:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Data/MonitorActiveDirectory

The third data source that we often see from domain controllers is DNS and DHCP data, if your domain controller is serving as a DNS server for external resolution, or serving as a DHCP server for production use cases. For those, we recommend pulling in data via Splunk Stream. We have docs in SSE for pulling in DNS, and you can configure DHCP the same way:
https://docs.splunksecurityessentials.com/data-onboarding-guides/stream-dns/
There are of course also official docs for Stream:
https://docs.splunk.com/Documentation/StreamApp/7.1.3/DeployStreamApp/AboutSplunkAppforStream

Hopefully that helps!

0 Karma

dagar_ruralking
Loves-to-Learn

Per this: https://docs.splunk.com/Documentation/WindowsAddOn/7.0.0/User/Upgrade
It talks about using msad, wineventlog, perfmon, winevents, and windows indexes.

Prior to me seeing the SSE on boarding a few weeks ago, I was unaware of using oswin, oswinsec, and oswinscript indexes. I am going through and updating my TA_windows to make use of these. The question though, is do I leave all the admon stanzas to point to msad ?

0 Karma

David
Splunk Employee
Splunk Employee

The indexes that are included in SSE were provided to me by Splunk PS, so generally speaking you should use the SSE versions.

Summoning @rfaircloth_splunk in case he has other opinions.

0 Karma

rfaircloth_splu
Splunk Employee
Splunk Employee

I generally use "appmsadmon" as the admon index

0 Karma

rfaircloth_splu
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...