Active Directory Federation Services insight

Content Pack

ADFS Content Pack for Graylog

Jil

free!

Download from Github View on Github 0 2

Published

02 Dec 14:47

Last Push

02 Dec 14:49

Marketplace Rating

No rating yet

Discussion

0 Comments

Readme from Github

graylog-adfs

ADFS Content Pack for Graylog. Based on ADFS 3.0 (Windows 2012 R2)

Contains

an input for ADFS event logs
a set of extractors for some events
a simple dashboard

nxlog fowarder configuration

## AD FS logs to the right collector

<Input in>
    Module      im_msvistalog
	Exec        if ($SourceName !~ /^AD FS/) drop();
</Input>

<Output out>
    Module      om_udp
    Host        your-graylog-server.youdomain.here
    Port        5001
    OutputType  GELF
</Output>

<Route 1>
    Path        in => out
</Route>

INSTALL

You must perform two search and replace before importing the JSON file in Graylog:

CONTOSO.COM by your full domain name
CONTOSO by your short domain name That is because user may log in with UPN or not and the logs do not standardize the login representation.

Published

Last Push

Marketplace Rating

Discussion

Your Rating

Comments