What is a good replacement to monitor Active Directory with Splunk 7.x?

[snix]

I am trying to monitor changes in Active Directory and found a number of ways to ingest data from AD. Splunk Add-on for Active Directory seems to be the big one but I am starting to think it is not supported any longer and wanted to verify that and if so what is a good replacement?

[adonio · Accepted solution]

hello there,

i think its supported, its says its compatible with splunk 7.x
https://splunkbase.splunk.com/app/3207/
try it out
read here all the way:
http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorActiveDirectory

hope it helps

[snix]

That is good to hear about Splunk Add-On for Active Directory. I got worried when I was not able to find it in the store when you try to install it directly through the web interface. Maybe I am doing something wrong on my end or it is just expected you download it and install it manually.

Thanks for sending over the other link I have already got that one going and trying to wrap my head around how to use the logs that are coming in from that input.

[adonio]

glad you were able to install it and onbaord data
myself too cant find it using the splunk ui ... it happens form time to time.
indeed AD is chatty and sends plenty of data.
there are many answers, blog, and ideas in the www about how to use that data and answer interesting questions about it.
if it answered your question, kindly accept the answer to close the question