Getting Data In

Active Directory Monitoring results

rodman
New Member

I've been testing out the data input Active Directory Monitoring on my new Splunk 4.3 implementation. I've been able to get results in and have done some controlled tests to see what sort of data this will give, however, one thing that I've noticed with the results is that any events that show up, do not show the name, SID, or account of the administrator who has made the change.

Does anyone know if you can get this type of information from this data input? Or maybe associate it with an appropriate security event from the DC?

Tags (1)
0 Karma

Douggg
Explorer

What about importing Microsoft/AD event (evt and evtx) files? Is there any documentation on how to do it?

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Given the problem, you want to use a Splunk Universal Forwarder to read the WinEventLog:Security. The Splunk App for Active Directory provides all the field extractions necessary to do what you need to do.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

This is precisely the information that is provided by the Splunk App for Active Directory. Check on http://docs.splunk.com for information on this app.

ChrisG
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...