Getting Data In

How to monitor Active Directory changes and security events with Universal forwarder?

jared_anderson
Path Finder

We want to monitor Active Directory changes and security Events We are planning to deploy the Universal forwarder to each domain controller. I am confused by the documentation. What is needed/best practice to accomplish this? Do we need to install add-ons to the universal forwarder? Can we just monitor Windows Event security logs?

0 Karma
1 Solution

ddrillic
Ultra Champion

@jared_anderson, you need to install the Universal forwarder and configure it to monitor these sources.

The following Monitor Windows event log data

says -

Windows event log (*.evt) files are in binary format. You cannot monitor them like you do a normal text file. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files.

Splunk Enterprise uses the following stanzas in inputs.conf to monitor the default Windows event logs:

# Windows platform specific input processor.
[WinEventLog://Application]
disabled = 0 
[WinEventLog://Security]
disabled = 0 
[WinEventLog://System]
disabled = 0 

So,

Do we need to install add-ons to the universal forwarder?
Nope

Can we just monitor Windows Event security logs?
Yes

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jared_anderson,
install the Splunk App for Windows Infrastructure: see installation specs at http://docs.splunk.com/Documentation/MSApp/latest/MSInfra/AbouttheSplunkAppforMSInfrastructure : you can find all the TAs to install and how to install them.
Bye.
Giuseppe

0 Karma

ddrillic
Ultra Champion

@jared_anderson, you need to install the Universal forwarder and configure it to monitor these sources.

The following Monitor Windows event log data

says -

Windows event log (*.evt) files are in binary format. You cannot monitor them like you do a normal text file. The splunkd service monitors these binary files by using the appropriate APIs to read and index the data within the files.

Splunk Enterprise uses the following stanzas in inputs.conf to monitor the default Windows event logs:

# Windows platform specific input processor.
[WinEventLog://Application]
disabled = 0 
[WinEventLog://Security]
disabled = 0 
[WinEventLog://System]
disabled = 0 

So,

Do we need to install add-ons to the universal forwarder?
Nope

Can we just monitor Windows Event security logs?
Yes

0 Karma

jared_anderson
Path Finder

For some reason I can't mark your answer as "accept"

0 Karma

jared_anderson
Path Finder

What benefit would there be to install add-ons to the universal forwarder. For example an active directory add-on?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...