I am new to Splunk please help me here
We have integrated one Algosec application with SPlunk Via Syslog method and collecting Audit logs
Means successful login/ unsuccessful login to Algosec Application. In logs we are getting only Algosec application IP but not source IP(Which is actually trying to login). We have checked in AD logs based on username, target IP(Algosec IP) as well but not able see any information of source IP.
LDAP configuration is done on Algosec application
So my question is which method is useful to get actual source IP
1. Could I get Source IP in Ldap audit logs via event viewer. if yes then how I can forward this logs to Splunk from Event viewer
Windows Event Viewer > Applications and Services Logs > Directory Service
2. Splunk Supporting Add-on for Active Directory (SA-LDAPSearch)- This Ad-on is useful to get LDAP audit logs to find out source IP
Could I get Source IP in Ldap audit logs via event viewer?
* I'm not sure if someone in the Splunk community knows about it. But this is more of a Windows/AD question.
if yes then how I can forward this logs to Splunk from Event viewer
* There is WinEventLog input that comes pre-bundled with Splunk that you can use.
* For example, Windows Defender logs present under Microsoft > Windows > Windows Defender > Operational logs on EventViewer. That you can collect with [WinEventLog:Microsoft-Windows-Windows Defender/Operational] input stanza.
* If you can see the details in EventViewer there seems like a way to get that into Splunk.
On a side note please make sure you have read this, because chances are it already has answer to what you are looking for.