Getting Data In
Highlighted

Active Directory Monitoring results

New Member

I've been testing out the data input Active Directory Monitoring on my new Splunk 4.3 implementation. I've been able to get results in and have done some controlled tests to see what sort of data this will give, however, one thing that I've noticed with the results is that any events that show up, do not show the name, SID, or account of the administrator who has made the change.

Does anyone know if you can get this type of information from this data input? Or maybe associate it with an appropriate security event from the DC?

Tags (1)
0 Karma
Highlighted

Re: Active Directory Monitoring results

Splunk Employee
Splunk Employee

This is precisely the information that is provided by the Splunk App for Active Directory. Check on http://docs.splunk.com for information on this app.

Highlighted

Re: Active Directory Monitoring results

Splunk Employee
Splunk Employee
0 Karma
Highlighted

Re: Active Directory Monitoring results

Explorer

What about importing Microsoft/AD event (evt and evtx) files? Is there any documentation on how to do it?

0 Karma
Highlighted

Re: Active Directory Monitoring results

Splunk Employee
Splunk Employee

Given the problem, you want to use a Splunk Universal Forwarder to read the WinEventLog:Security. The Splunk App for Active Directory provides all the field extractions necessary to do what you need to do.

0 Karma