Security

Does anyone have a group of security audits already in place and can make recommendations on using Splunk to monitor Active Directory?

joshk2005
Explorer

I have just been handed the Splunk application for our organization. I've been asked to work with our security team to create some audit ability that can monitor changes to sensitive groups, changes to privileged accounts, changes to GPO's, all servers accessed by specific user in last x days, all changes that a given user has made in AD in x days, etc. We are still defining what we want audited with Splunk, but I just wondered if anyone have a group of security audits already in place that can make some recommendations.

msmith4
New Member

make sure you review 4624 and 4625 events and correlate them. e.g. if 4625 is coming from same source but to multiple accounts, somebody is most likely attempting password guessing.

0 Karma

shandman
Path Finder

At my previous company, I implemented the https://splunkbase.splunk.com/app/1059/ "splunk app for active directory" . The security team used it daily in monitoring Active Directory and some of the things you referenced. I would start there.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Hi Josh,

Check out the blog post, http://blogs.microsoft.com/cybertrust/2013/06/03/microsoft-releases-new-mitigation-guidance-for-acti...

The document they reference, http://aka.ms/bpsadtrd , is thorough, but may be overwhelming. Of particular interest is Appendix L, which provides a list of the event codes to monitor. That should get you started into which EventCodes you can use to build your alerts and dashboards.

Cheers

NimrodSky
Explorer

Hi,

We just added SkyFormation into Splunkbase approved apps, you can see it here - https://splunkbase.splunk.com/app/2787/

SkyFormation currently provides you with Discover and governance for your cloud application usage, but we are definitely planning on providing business cloud app policies similar to the ones you mention above.

If your company use business cloud apps such as sales force I'd be happy to learn more about your needs.

Nimrod Bar-Zeav

SkyFormation

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...