🖥️ Active Directory Integration with Splunk and Sysmon

🗂️ Overview

Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It is used for managing permissions and access to network resources. AD stores data as objects, including users, groups, and devices, and organizes them into a hierarchical structure.

Key Features:

• Centralized Management: Provides a single point of management for network resources.
• Authentication and Authorization: Manages user login and access permissions.
• Group Policy: Allows administrators to implement specific configurations for users and computers.
• Scalability: Can be used in small or large-scale environments.
• Integration: Works with other Microsoft services and applications.

AD helps in streamlining IT administration and enhancing security by ensuring that only authorized users have access to resources.

---

📦 Install Splunk and Sysmon

🔧 Splunk Universal Forwarder

The Splunk Universal Forwarder is a lightweight version of Splunk designed to collect and forward log data to a Splunk instance (e.g., Splunk Enterprise or Splunk Cloud) for indexing and analysis.

Key Features:

1. 📄 Data Collection: Gathers log data from various sources, including files, directories, and network ports.
2. 🔗 Data Forwarding: Sends collected data to a central Splunk server for processing and indexing.
3. ⚡ Lightweight: Designed to be resource-efficient, making it suitable for deployment on numerous endpoints.
4. 🔐 Security: Ensures secure data transmission using encryption.

---

👀 Sysmon (System Monitor)

Sysmon is a Windows system service and driver that logs detailed system activity to the Windows event log. It is part of the Sysinternals suite and is commonly used for advanced system monitoring and forensic analysis.

Key Features:

1. 📑 Process Creation Logging: Records details about new processes, including command-line arguments and executable hashes.
2. 🌐 Network Connection Logging: Logs TCP and UDP network connections.
3. 📝 File Creation Time Changes: Monitors and logs changes to file creation times to detect tampering.
4. 🛠️ Registry Event Logging: Tracks changes to the Windows Registry.
5. 🏷️ Event Tagging: Tags events with unique identifiers for easier correlation and analysis.

---

🔄 Integration of Splunk Universal Forwarder and Sysmon

Sysmon generates detailed logs about system activity, which can be collected and forwarded by the Splunk Universal Forwarder to a Splunk server. This integration allows for advanced monitoring, analysis, and visualization of security-related events, helping organizations detect and respond to potential threats more effectively.

---

⚙️ Installation Steps

🖥️ Install Splunk Universal Forwarder on Target Machine and Server

---

🖥️ Target Machine Setup

1. 🛠️ Change Hostname: Set the hostname to Target-PC.

2. 🔗 Assign Static IPv4 Address: Assign a static IP to the target machine.

   

3. ⬇️ Download Splunk Universal Forwarder:

   • Go to Splunk.com, log in, and download the Splunk Universal Forwarder.
   • Install it.

   

4. ⬇️ Download and Install Sysmon:

   • Sysmon (System Monitor) is a Windows service and driver that logs detailed system activity to the event log. It tracks process creations, network connections, and changes to file creation times, helping to detect and investigate malicious activity. It's part of the Sysinternals suite and is used for advanced monitoring and forensic analysis.
   • Download Sysmon from the Sysinternals suite.
   • Use sysmon-modular for configuration.
   • Download the sysmonconfig.xml.
   • Install Sysmon with the downloaded configuration file.

   sysmon -accepteula -i sysmonconfig.xml

   

5. ⚙️ Configure Splunk Forwarder:

   • Now we need to instruct our splunk forwarder on what we want to send over to our Splunk Server.To do this we must configure a file called inputs.conf. For this we use inputs.conf file from github
   • Modify the inputs.conf file.

   

   • Change Splunk Forwarder logon as Local System. as follows.

   

   • Restart the service.
   • Now we have Sysmon installed and Universal forwarder installed along with updated inputs.conf

6. 🌐 Access Splunk Server:

   

   • Log in to the Splunk server.

   

   • Create an index named endpoint.
   • Ensure that Splunk server is set to receive data.
   • Forwarding and Receiving

   

   • If we everything setup correctly. Verify that data from the target machine is being received.

   

---

🛠️ Active Directory (Windows Server) Setup

1. 🛠️ Change Hostname: Set the hostname to ActiveDirectory.

2. 🔗 Assign Static IPv4 Address: Assign IP 192.168.10.7.

3. ⬇️ Download Splunk Universal Forwarder: Install it on the Windows server.

4. ⬇️ Download and Install Sysmon: Follow the same process as for the target machine.

   • Download Sysmon.
   • Use the sysmon-modular configuration.
   • Install Sysmon with the configuration file.

5. ⚙️ Configure Splunk Forwarder:

   • Now we need to instruct our splunk forwarder on what we want to send over to our Splunk Server To do this we must configure a file called inputs.conf For this we use inputs.conf file from github
   • Modify the inputs.conf file.

   

   • Anytime you update inputs.conf file you must restart splunk universal folder service.
   • Restart the Splunk Forwarder service after updating the configuration.

---

✔️ Final Steps

Now that both the Target Machine and Active Directory have the Splunk Universal Forwarder and Sysmon configured, verify that the data from both machines is being received by the Splunk server.

Ensure that:

• Both machines are sending data.
• The Splunk server is configured to receive and index the data correctly.

---