Security

LDAP Search / Active Directory App Monitor Changes

ntripp_element
Explorer

How can I use Splunk to alert / run reports on group member changes?

Currently I have something I wrote that reads group members from AD, stores in DB then runs a differential.  Seems like splunk would be ideal for this. Is there a way to run a search and diff from the previous run?

Labels (2)
0 Karma

ntripp_element
Explorer

bump?

0 Karma

shivanshu1593
Builder

Yes you can. You can bring your AD logs to Splunk using the following app

Splunk App For Windows 

Using ldapsearch command, and with a bit of SPL magic, you can customise the data that you want to pull from AD.

Since Splunk will store your old, as well as new data, you can easily compare them and schedule alerts, reports, create tickets in a ITSM ticketing tool like Servicenow, Remedy etc and much more.

Hope this helps,

S

Note: If it helped, please mark this as an accepted answer.

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

ntripp_element
Explorer

yes i already was able to pull the information. the other things you referenced I do not follow. I'm really trying to get a little more information on the how ...

0 Karma

shivanshu1593
Builder

If you can give some sample data, which has the data of pre and post group changes, we can help you to build the search.

I believe an EventCode is being generated, everytime there's some changes in the OU. Like 4727 for a group creation, 4728 when a member is added, 4729 if a member is removed and so on.

If that's the case, I'd look out for those eventcodes and use the table command to pipe the required values in tabular format.

Again, some sample data and more light on what you want to achieve will be helpful.

Thanks,

S

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...