Splunk Search

How to generate a list of users and Active Directory groups?

mlevsh
Builder

Can someone advice on the Splunk search to generate the list of users and associated Active Directory (AD) groups? We are using SAML authentication based on AD groups.

Thank you!

0 Karma

brreeves_splunk
Splunk Employee
Splunk Employee

Do you want this to be based on the SAML response? or their full list of AD Groups in Active Directory?

0 Karma

woodcock
Esteemed Legend

You need this app to mine assets from AD

https://splunkbase.splunk.com/app/3059/

adonio
Ultra Champion

maybe something like this for starters:

 index=<yourIndex> sourcetype=<youtSourcetype> CN=Schema objectCategory=* 
    | dedup distinguishedName 
    | stats list(cn) by DC OU 

start with verbose search so you can see all the fields you would like to report on
also, it is not clear from the question if you are looking for users who use splunk or to all users in your company connected to AD?
I would assume you are looking for users who are in splunk since you mentioned SAML. If that is the case, probably use @cusello answer above and join results from ad search (here) by the field user
hope it helps

0 Karma

jpolcari
Communicator

I've had pretty good luck using this Splunk app: https://splunkbase.splunk.com/app/3177/

Allows you to build lookup tables for users, groups, OUs, etc.

gcusello
SplunkTrust
SplunkTrust

Hi mlevsh
try something like this:

| rest /services/authentication/users

Bye.
Giuseppe

mlevsh
Builder

@cusello Hi Giuseppe, this endpoint shows type of authentication, not the actual AD group

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...