Is there a doc showing how to monitor a Windows/AD system?

Question

I see there are many different collectors available for different items in AD or WIndows. 
 I see there is the Agent Manager for Windows Agents, but I cannot quite nail down what Agents can collect vs what a Collector can collect? 
 
 I am at a point where I do not yet know WHAT I want to collect, since I do not know what I CAN collect So first, what is available to collect (from what format? agent or collector) then I can pick and chose the elements i need I suppose. 
 
 Or start more simply: How are the Agents different than Collectors, specifically in the context of Windows and Active Directory?

Norbert Klasen · Answer

Hi Geoffrey, 
 you can configure Windows to audit its file system: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319068(v=ws.11) . That would generate events in the Windows Event Log for various activities. 
 Depending on what you want to audit, Change Guardian might offer you more choices. 
 Historically Sentinel offers 
 - pull-based Windows event collection with the WECS connector 
 - push-based Windows event collection using Agent Manager agents. 
 For both, raw data is parsed by the Active Directory and Windows collector. 
 Nowadays you can also use ArcSight SmartConnectors: https://www.microfocus.com/documentation/arcsight/arcsight-smartconnectors-8.4/ Those give you the ability to collect from the Vista style event logs as well and process data from WEF, PowerShell, Sysmon and other applications. SmartConnectors normalize events into the Common Event Format (CEF), and forward them to Sentinel through the Syslog Connector. The Connector then forwards the events to Universal Common Event Format Collector for parsing.

Menu

Sentinel Discussions

Is there a doc showing how to monitor a Windows/AD system?

Tags:

Top Replies

Resources