Getting Data In

How to do LDAP audit/access logs integration with Splunk?

splunkpri
Loves-to-Learn Lots

Hi team,

I am new to Splunk please help me here

We have integrated one Algosec application with SPlunk Via Syslog method and collecting Audit logs

Means successful login/ unsuccessful login to Algosec Application. In logs we are getting only Algosec application IP but not source IP(Which is actually trying to login). We have checked in AD logs based on username, target IP(Algosec IP) as well but not able see any information of source IP. 

LDAP configuration is done on Algosec application

So my question is which method is useful to get actual source IP

1. Could I get Source IP in Ldap audit logs via event viewer. if yes then how I can forward this logs to Splunk from Event viewer

Windows Event Viewer > Applications and Services Logs > Directory Service

https://www.manageengine.com/products/active-directory-audit/how-to/images/how-to-audit-ldap-queries...

2. Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)- This Ad-on is useful to get LDAP audit logs to find out source IP

https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.3/User/AbouttheSplunkSupportingAdd-onforActi...

Tags (2)
0 Karma

VatsalJagani
Champion

 Could I get Source IP in Ldap audit logs via event viewer?

* I'm not sure if someone in the Splunk community knows about it. But this is more of a Windows/AD question.

 

if yes then how I can forward this logs to Splunk from Event viewer

* There is WinEventLog input that comes pre-bundled with Splunk that you can use.

* For example, Windows Defender logs present under Microsoft > Windows > Windows Defender > Operational logs on EventViewer. That you can collect with [WinEventLog:Microsoft-Windows-Windows Defender/Operational] input stanza.

* If you can see the details in EventViewer there seems like a way to get that into Splunk.

* Reference - https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/MonitorWindowseventlogdata

 

On a side note please make sure you have read this, because chances are it already has answer to what you are looking for.

* Admon Inputs - https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/MonitorActiveDirectory

* Windows Add-on - https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/AbouttheSplunkAdd-onforWindows

 

0 Karma

splunkpri
Loves-to-Learn Lots

Hi Team, Please update on this

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...