Implementing Active Directory Security Log Monitoring with Zabbix
Let's try configuring and monitoring audit logs for Active Directory attack countermeasures
If you are monitoring on the server alone without using Zabbix, please refer to the following
https://note.com/nerone1024/n/n12d8483a7963?app_launch=false
Audit Log Configuration
Configure the Group Policy to retain logs.
Open Computer Configuration - Windows Settings - Security Settings - Local Policies - Audit Policy.
Configure the following items to record both success and failure.
Audit account logon events
Audit account management
Audit object access
Audit logon events
Audit privilege use
Zabbix Side Configuration
Using the "Audit account management" setting from above as an example, let's configure it.
Create an item from the management screen
Log in to the management screen, open Configuration -> Hosts, and click on the AD server. *Perform this for both primary and secondary servers.
Open "Items" listed under the host
Click "Create item" in the upper right of the screen
Configure and create it as shown in the image below.
Name: Arbitrary
Type: Zabbix agent (active)
Key: eventlog[Security,,,,"4720|4722|4723|4725|4726",,]
*Configured to detect the following event IDs in the security log.
4720 Account created
4722 Account enabled
4723 Password changed
4725 Account disabled
4726 Account deleted
Type of information: Log
History: 7d *Set as a placeholder
Note that you may also want to add the following for the key:
4729 Added to global security group
4729 Removed from global security group
4732 Added to local security group
4733 Removed from local security group
4756 Added to universal security group
4757 Removed from universal security group
Create a trigger
Click "Triggers" -> "Create trigger" at the top of the screen.
Configure the settings as shown in the image below.
Name: Optional
Severity: Optional
Expression: logeventid(/ServerName/eventlog[Security,,,,"4720|4722|4723|4725|4726",,])=1
I have set the item, function, and result as follows.
Multiple problem event generation mode: Multiple
Allow manual close: Checked
Try verifying that you receive the email.
When I disabled a user I had created for testing in advance, the following error email arrived.
Conclusion
This time, I tried detecting Security logs using Zabbix. You can acquire other logs in a similar way, not just security logs, so please give it a try.
Please refer to the following for other Zabbix articles.
Also, for AD, see the following