How to integrate ADAudit Plus with SIEM solutions?
Objective
This article explains how to integrate ADAudit Plus with security information and event management (SIEM) solutions. This integration allows real-time event forwarding, enhanced security monitoring, and streamlined compliance reporting.
Prerequisites
Have a SIEM solution (e.g., Splunk, ArcSight, or LogRhythm) or a Syslog server.
Ensure network connectivity between ADAudit Plus and the SIEM solution.
Ensure Syslog or SIEM servers are reachable from ADAudit Plus.
Verify the correct protocol (e.g.,, UDP, TCP, or HTTP) and ports are open.
Steps to follow
Step 1: Enabling SIEM integration in ADAudit Plus
- Log in to the ADAudit Plus web console.
- Navigate to Admin > Configuration > SIEM Integration.
Click Enable SIEM Integration.
Select the SIEM solution type from the drop-down menu (Syslog, Splunk, ArcSight, or LogRhythm).
Click Save & Proceed.
Step 2: Configuring Syslog forwarding
- Choose Syslog as the integration type.
- Enter the Syslog server hostname or IP address.
Specify the port number (default: UDP 514) and protocol (UDP or TCP).
Select the Syslog format (RFC 3164 or RFC 5424).
Choose the log categories to forward.
Click Save Configuration.
Step 3: Configuring Splunk HTTP Event Collector forwarding
- In Splunk, go to Settings > Data Inputs > HTTP Event Collector.
- Click New Token, provide a descriptive name (e.g., ADAuditPlus), and save the configuration.
Copy the generated authentication token.
Under Global Settings, enable All Tokens.
In ADAudit Plus, select Splunk as the integration type.
Enter the Splunk server hostname or IP address.
Specify the port number (default: 8088) and protocol (HTTP or HTTPS).
Paste the HTTP Event Collector token generated in Splunk.
Choose the log categories to forward.
Click Save Configuration.
Step 4: Configuring ArcSight forwarding
- Select ArcSight as the integration type.
- Enter the ArcSight server hostname or IP address.
Specify the collector port number.
Choose the Common Event Format (CEF) for data transfer.
Select the log categories to forward.
Click Save Configuration.
Step 5: Configuring LogRhythm Syslog forwarding
- Choose Syslog / SIEM as the integration type.
Enter the LogRhythm Syslog receiver address.
Specify the port number and protocol (UDP or TCP).
Select the log categories to forward.
Click Save Configuration.
Key mappings for SIEM integration
ADAudit Plus forwards various syslog key data that SIEM solutions use to categorize and analyze events. Below are key mappings for different integrations:
Syslog key mappings
Syslog key | ADAudit Plus field |
EVENT_NUMBER | Event Number |
RECORD_NUMBER | Record Number |
UNIQUE_ID | Unique ID |
REPORT_PROFILE | Report Profile Name |
ALERT_PROFILE | Alert Profile Name |
SEVERITY | Severity |
TIME_GENERATED | Event Time |
USERNAME | User Name |
ACCOUNT_DOMAIN | Account Domain |
CLIENT_IP_ADDRESS | User Machine IP |
ArcSight CEF key mappings
CEF key | ADAudit Plus column |
cat | ADAudit Plus Category |
cn1 | Event Number |
cn2 | Record Number |
cn3 | Unique ID |
cs1 | Report Profile Name |
cs4 | Alert Profile Name |
cs3 | Event Source |
cs5 | Severity |
rt | Event Time |
type | Event Type |
reason | Event Remarks |
msg | Message String |
fileName | File Name |
fileLocation | File Location |
suser | User Name |
sntdom | Domain Name |
shost | User Machine Name |
Validation and confirmation
- Verify events from ADAudit Plus appear in the SIEM solution.
- Check that log forwarding is occurring in real time.
Review error logs for any misconfigurations.
Tips
Use TCP instead of UDP for reliable event delivery.
Enable filtering to forward only necessary audit categories.
Regularly test log forwarding to prevent data loss.
Maintain documentation of SIEM integration settings for compliance.
Related Topics and Articles
New to ADSelfService Plus?
Related Articles
How to exclude ADAudit Plus from antivirus and endpoint protection
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to exclude ADAudit Plus from antivirus and endpoint protection software to ensure smooth ...Understanding how ADAudit Plus handles security Event Logs and Archiving
In this article : Question Explanation Important considerations Related topics and articles Question I would like to know if there’s a way to store historical security event logs within ADAudit Plus, access older logs, and view the raw event data. ...Can I import previously generated security logs into ADAudit Plus?
Objective Learn how to import EVT/EVTX logs into ADAudit Plus for analysis and auditing by configuring scheduled or one-time imports using the built-in import functionality. Prerequisites Ensure sufficient disk space is available for log storage. The ...Unable to upgrade ADAudit Plus
Issue description ManageEngine ADAudit Plus may occasionally encounter issues during the upgrade process, resulting in error messages or unexpected interruptions. These problems can hinder users from accessing new features and critical security ...How to upgrade ADAudit Plus
Objective This article provides a step-by-step guide for upgrading ADAudit Plus using a service pack (PPM) file. Prerequisites You must have downloaded the required service pack (PPM) file for the upgrade. You need administrator access to the server ...