icon-deception.svg
Deception

Configuring Splunk to Forward Active Directory Event Logs

You can configure a Splunk server to filter event logs from the Active Directory (AD) domain controllers for decoy accounts or enumeration detection. You can forward these logs to the Zscaler Deception Admin Portal when adversary actions are detected.

Prerequisites

Make sure that the following prerequisites are met:

  • Configure all of the AD servers to forward security logs to the Splunk server.
  • If you have selected the Deception Admin Portal to receive logs, make sure that there is network connectivity between the Splunk server and the Deception Admin Portal on TCP port 443.
  • If you have selected a Decoy Connector to receive logs, make sure that there is network connectivity between the Splunk server and the Decoy Connector’s management IP on TCP port 80.

Configuring a Splunk server to forward event logs to the Deception Admin Portal

To configure a Splunk server to forward event logs to the Deception Admin Portal:

  1. Download the trigger script from the Deception Admin Portal.
  2. Log in to a Splunk instance.
  3. Go to Search & Reporting > Search.
  4. Create a new search.
  5. Open the triggers script (.txt file) downloaded from the Zscaler Deception Admin Portal, and copy the query into the Search textbox.

  6. Click the Magnifying glass icon.

  7. Click Save As > Alert.

  8. In the Save As Alert window:

    1. Title: Enter an alert title.
    2. Alert type: Select Real-Time.
    3. Trigger alert when: Select Per-Result from the drop-down menu.
    4. Expires: Enter an expiry date for the alert. For example, enter 3650 and select day(s) from the drop-down menu.
    5. Trigger Actions: Click Add Actions and select Webhook from the drop-down menu, and then enter the URL to the Zscaler Deception API.
    6. Click Save.

To test AD decoys, log in to a decoy AD user account. You can see events triggered on the Splunk server and Deception Admin Portal.

Related Articles
About Active Directory DecoysAdding an Active Directory DomainCreating an Active Directory Decoy UserViewing Active Directory Decoy ComputersConfiguring and Downloading a Trigger ScriptConfiguring Windows Task Scheduler to Enable AlertingConfiguring Microsoft Azure Sentinel to Forward Active Directory Event LogsConfiguring IBM QRadar to Forward Active Directory Event LogsConfiguring LogRhythm to Forward Active Directory Event LogsConfiguring Splunk to Forward Active Directory Event LogsExporting a Root CA Certificate from an Active Directory Certificate ServiceRunning the Decoy Deployment Script on an Active Directory