Splunk® App for Active Directory

Business Challenge

Within your Active Directory Forest, there is a wealth of data and useful information you can uncover to search and analyze, and as a result, increase operational intelligence, provide enhanced security monitoring, and allow you to troubleshoot and fix any issues. Unfortunately, traditional tools can’t unlock this information; they can deliver health statistics, but miss reporting crucial compliance and auditing information.

Solution

The Splunk App for Active Directory allows IT admins to get real-time operational insight into their Active Directory Forest—from the domains and sites that make up the Forest to the individual “trees.” It also offers critical compliance and auditing information features that track activity from root domains to the individual objects in a site. Administrators can use the information gleaned from the following features to quickly pinpoint problems, identify security breaches and meet compliance requirements:

• Topology reports that display a single, comprehensive view into the entire Active Directory Forest
• Domain services that deliver real-time data on how domains, sites and domain controllers are working individually and together, which can be used to troubleshoot issues and monitor performance
• DNS services that deliver information about the DNS servers and zones that host Active Directory domains, which can be used to prevent performance issues and service disruptions
• User logon failures and anomalous logons that display failed attempts to log onto a specific domain or uncharacteristic usage patterns, which can be used to prevent malicious activity and security breaches across the Forest

Business Impact

Conducive recommends the Splunk App for Active Directory to proactively manage the Active Directory Service, allowing IT professionals to anticipate problems, avoid service outages and meet compliance requirements: