AD Monitoring - Help?

[jammcg]

Hi,

I have just installed a splunk trial, that is monitoring AD events and Windows Security logs of the DC. My question is if I move a user into the domain admin group...how do I find the event to create an alert on?

Searching for the specific user ID does not seem to present an ADmon event type appropriately. Any help with monitoring active directory for this kind of activity would be great

[treinke]

Personally, I use Windows Security Operations Center.

There is a lot of built in reports for users and groups being added and deleted. One of the dashboards I speed time each day looking at is accounts that were locked at and the NTLM and RDP failures.

[treinke]

also from the canned reports in the app, you can view the results and then see the searches they run to get those reports to help learn and then build alerts.