Splunk Enterprise Security

How to generate a lookup to dynamically add Active Directory to the Splunk Enterprise Security - Assets and Identity list?

vaibhavladani
Explorer

Can any one help me in generating a lookup to dynamically add the Active Directory to the Splunk Enterprise Security - Assets and Identity list? Had worked out for the the Identity part, but it will help if any one can give me some examples regarding the lookup for Assets from Active Directory.

0 Karma
1 Solution

hire_vladimir
Explorer

see https://splunkbase.splunk.com/app/2976/

it contains example of pulling AD assets, among other things, and integration into ES.

View solution in original post

hire_vladimir
Explorer

see https://splunkbase.splunk.com/app/2976/

it contains example of pulling AD assets, among other things, and integration into ES.

vaibhavladani
Explorer

Hi hire_vladmir tried this SA-IdentityAssetExtraction app and it worked, I was able to get the list of Identities and Assets from my Active Directory which now I will be able to add under ES.
Thanks really appreciate your help.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I'm not an ES expert and don't have any ES instance to test this but if you write a quick script in PowerShell and schedule it to export all your assets into a csv file every day (hour, week, whatever) using the Get-ADComputer cmdlet and then configure ES to read from that CSV file and populate your list of assets from there, will that not work for you?

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...