Splunk Enterprise Security

How to integrate Splunk for Enterprise Security with Active Directory to detect security events?

rubeniturrieta
Communicator

Hi everyone,

I have Splunk App for Enterprise Security, and i want to integrate it with Active Directory. I already have a dynamic lookup with assets from AD, but i want to detect security events, for example, a brute force attempt in Splunk App for Enterprise Security with Active Directory data. How can I do this?

Thanks you so much in advance

Regards

0 Karma
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

Just use an universal forwarder on your AD host, with the windows/AD specific TA. See here for more details: https://splunkbase.splunk.com/app/1680/#/overview

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

Just use an universal forwarder on your AD host, with the windows/AD specific TA. See here for more details: https://splunkbase.splunk.com/app/1680/#/overview

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!