Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- is there a dashboard for tracking active Directory...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We want to be able to use Splunk as an auditing tool for our groups local and to Active Directory groups. If changes to the groups accur, we want to be able to see that in a Splunk dashboard.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi Jarose,
Check out this link: Monitor Active Directory in Splunk
If link not visible: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/MonitorActiveDirectory
alternatively, you can also try monitoring a log file that logs the changes made in the database with splunk file monitor.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you can. Splunk has a specific add on for AD. You can check it out. Here's its doc on how to configure and deploy it. I think it'll serve your purpose of bringing those logs into Splunk. Once logs are in, it's very easy to build the required dashboard.
https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.1/User/ConfiguretheSplunkSupportingAdd-onfor...
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi Jarose,
Check out this link: Monitor Active Directory in Splunk
If link not visible: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/MonitorActiveDirectory
alternatively, you can also try monitoring a log file that logs the changes made in the database with splunk file monitor.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have any info on how to get the local server groups modifications? Not AD.
Example: administrators group on the local machines.
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
