Getting Data In

AD Monitoring - Help?

jammcg
New Member

Hi,

I have just installed a splunk trial, that is monitoring AD events and Windows Security logs of the DC. My question is if I move a user into the domain admin group...how do I find the event to create an alert on?

Searching for the specific user ID does not seem to present an ADmon event type appropriately. Any help with monitoring active directory for this kind of activity would be great

0 Karma

treinke
Builder

Personally, I use Windows Security Operations Center.

There is a lot of built in reports for users and groups being added and deleted. One of the dashboards I speed time each day looking at is accounts that were locked at and the NTLM and RDP failures.

There are no answer without questions
0 Karma

treinke
Builder

also from the canned reports in the app, you can view the results and then see the searches they run to get those reports to help learn and then build alerts.

There are no answer without questions
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...