Getting Data In

How to do LDAP audit/access logs integration with Splunk?

splunkpri
Explorer

Hi team,

I am new to Splunk please help me here

We have integrated one Algosec application with SPlunk Via Syslog method and collecting Audit logs

Means successful login/ unsuccessful login to Algosec Application. In logs we are getting only Algosec application IP but not source IP(Which is actually trying to login). We have checked in AD logs based on username, target IP(Algosec IP) as well but not able see any information of source IP. 

LDAP configuration is done on Algosec application

So my question is which method is useful to get actual source IP

1. Could I get Source IP in Ldap audit logs via event viewer. if yes then how I can forward this logs to Splunk from Event viewer

Windows Event Viewer > Applications and Services Logs > Directory Service

https://www.manageengine.com/products/active-directory-audit/how-to/images/how-to-audit-ldap-queries...

2. Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)- This Ad-on is useful to get LDAP audit logs to find out source IP

https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.3/User/AbouttheSplunkSupportingAdd-onforActi...

Labels (5)
Tags (2)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

 Could I get Source IP in Ldap audit logs via event viewer?

* I'm not sure if someone in the Splunk community knows about it. But this is more of a Windows/AD question.

 

if yes then how I can forward this logs to Splunk from Event viewer

* There is WinEventLog input that comes pre-bundled with Splunk that you can use.

* For example, Windows Defender logs present under Microsoft > Windows > Windows Defender > Operational logs on EventViewer. That you can collect with [WinEventLog:Microsoft-Windows-Windows Defender/Operational] input stanza.

* If you can see the details in EventViewer there seems like a way to get that into Splunk.

* Reference - https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/MonitorWindowseventlogdata

 

On a side note please make sure you have read this, because chances are it already has answer to what you are looking for.

* Admon Inputs - https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/MonitorActiveDirectory

* Windows Add-on - https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/AbouttheSplunkAdd-onforWindows

 

0 Karma

splunkpri
Explorer

Hi Team, Please update on this

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...