How to map index in active directory to splunk instance?

[denys_k]

Hello guys

I have an index, stored in active directory. Is there a possibility to make my splunk instance extract data from this index?
And if so, help me please with direction of movement

Thanks

[FrankVl]

What exactly do you mean by index in this case? Not the Splunk sense of index I guess?

In general: yes you can collect data from Active Directory. Either by crafting your own powershell scripts for instance to make ldap queries. Or by using the ldapsearch add-on: https://splunkbase.splunk.com/app/1151/

[denys_k]

splunkweb
Settings - Access Controls - Authentication method (radiobutton LDAP) - Configure Splunk to use LDAP
and then, map roles to AD group.