Getting Data In

How to monitor specific Active Directory user groups, and set up a search to alert when members of these groups perform a login?

arkonner
Path Finder

I am looking to monitor specific AD user groups and want to create a search that alerts me to when the members of these group perform a login. How do I pull that information?

0 Karma

arkonner
Path Finder

Sorry, my question was not clear - Active Directory user group perform login on Windows

0 Karma

javiergn
SplunkTrust
SplunkTrust

See my answer below and let me know if that helps

0 Karma

javiergn
SplunkTrust
SplunkTrust

Perform a login in Splunk or perform a login on a Windows machine?

If Splunk:

  • Use the internal logs to monitor when a login success happens

    index=_internal sourcetype=splunk_web_service user=* action="login" status="success"

  • Find if the user belongs to those groups via the ldap commands

If Windows:

  • Collect Security event logs from required hosts
  • Run a search in Splunk using the right Event Code for your Windows domain level. Also keep in mind logons can be interactive, remote, local, batch, etc so you need to use the Logon Type field too.
  • Once you have the user, correlate with AD in the same way as above via the ldap commands in order to find out the user group membership

Useful links:

Hope that helps.

Thanks,
J

0 Karma

arkonner
Path Finder

How to monitor specific Active Directory user groups, and set up a search to alert when members of these groups perform a login on Active Directory

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...