UTMStack: AD Audit Integration

Jason Hall

3/22/24, 10:06 AM

I am trying to enable the AD Audit integration but I'm getting an error "Windows events are not being logged"

I have the agent installed on the Domain Controller that i am pointing it to and i can see the winlogbeats logs coming in ok.

1 + 0

utm

Score:0

Server

Greg Askew

3/22/24, 11:25 AM

Directory Service Change auditing needs to be enabled.

Use the following commands:

Get current audit settings:
auditpol /get /category:*

Confirm that Advanced Auditing is enabled:
reg query HKLM\System\CurrentControlSet\Control\LSA /v SCENoApplyLegacyAuditPolicy

Enable Directory Service Change auditing:

Audit Directory Service Changes
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-directory-service-changes

AD Audit Configuration
https://docs.utmstack.com/books/ad-auditor/page/ad-audit

Note that auditing also needs to be enabled on the AD objects themselves. This typically means adding a System Access Control List (SACL) at the root of the object hierarchies, specifying that modifications and deletes are audited. These should be added to the root of the domain in AD Users and Computers (dsa.msc), and the root of the Sites config container in AD Sites and Services (dssite.msc).

If all is configured correctly, there should be plenty of change events (Event Id 5136) in the security event log, due to objects are frequently changed during normal operation. You can also test creation/deletion of objects to create 5137 and 5141 events, respectively.

+ 3

Jason Hall

3/22/24, 12:26 PM

Thanks, i currently have auditing enabled as i have another product that pulls these logs ok. i noticed on a screenshot in the documentation, for a log source under the data type it has wineventlog. When i install the agent on my device i only get hids as a data type. Could this be the issue? I can see the logon and logoff events in the log viewer

Greg Askew

3/22/24, 12:54 PM

Seems like it may be related. Intrusion detection wouldn't necessarily be related to this capability.

Jason Hall

3/24/24, 10:46 AM

Yeah it seems although all the Windows Event logs are being pulled through, none of the Windows Activity Dashboards or the AD audit section are displaying any data. Is there a way to force wineventlog as a type for a data source?

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: UTMStack: AD Audit Integration

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.