Getting Data In

What is a good replacement to monitor Active Directory with Splunk 7.x?

snix
Communicator

I am trying to monitor changes in Active Directory and found a number of ways to ingest data from AD. Splunk Add-on for Active Directory seems to be the big one but I am starting to think it is not supported any longer and wanted to verify that and if so what is a good replacement?

0 Karma
1 Solution

adonio
Ultra Champion

hello there,

i think its supported, its says its compatible with splunk 7.x
https://splunkbase.splunk.com/app/3207/
try it out
read here all the way:
http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorActiveDirectory

hope it helps

View solution in original post

0 Karma

adonio
Ultra Champion

hello there,

i think its supported, its says its compatible with splunk 7.x
https://splunkbase.splunk.com/app/3207/
try it out
read here all the way:
http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorActiveDirectory

hope it helps

0 Karma

snix
Communicator

That is good to hear about Splunk Add-On for Active Directory. I got worried when I was not able to find it in the store when you try to install it directly through the web interface. Maybe I am doing something wrong on my end or it is just expected you download it and install it manually.

Thanks for sending over the other link I have already got that one going and trying to wrap my head around how to use the logs that are coming in from that input.

0 Karma

adonio
Ultra Champion

glad you were able to install it and onbaord data
myself too cant find it using the splunk ui ... it happens form time to time.
indeed AD is chatty and sends plenty of data.
there are many answers, blog, and ideas in the www about how to use that data and answer interesting questions about it.
if it answered your question, kindly accept the answer to close the question

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...