Active Directory Monitoring results

[rodman]

I've been testing out the data input Active Directory Monitoring on my new Splunk 4.3 implementation. I've been able to get results in and have done some controlled tests to see what sort of data this will give, however, one thing that I've noticed with the results is that any events that show up, do not show the name, SID, or account of the administrator who has made the change.

Does anyone know if you can get this type of information from this data input? Or maybe associate it with an appropriate security event from the DC?

[Douggg]

What about importing Microsoft/AD event (evt and evtx) files? Is there any documentation on how to do it?

[ahall_splunk]

Given the problem, you want to use a Splunk Universal Forwarder to read the WinEventLog:Security. The Splunk App for Active Directory provides all the field extractions necessary to do what you need to do.

[ahall_splunk]

This is precisely the information that is provided by the Splunk App for Active Directory. Check on http://docs.splunk.com for information on this app.

[ChrisG]

Specifically: http://docs.splunk.com/Documentation/ActiveDirectory/latest/DeployAD/AbouttheSplunkAppforActiveDirec...