Keykhosro Active Directory Security and Audit

Active Directory is one of the most targeted systems in enterprise attacks. Privileged group changes, GPO modifications, and unusual logon patterns are often the first sign of compromise — but AD audit data is scattered across Domain Controllers and rarely combined with direct LDAP configuration checks. This app brings both views into one Splunk app: • Event-driven monitoring of DC security logs — user/group changes, GPO changes, membership churn, authentication activity. • LDAP-based security checks — attribute misconfiguration detection and per-object investigation. • A health check dashboard that verifies add-ons, indexes, DCs, and audit event codes before you rely on the data. Built for AD admins, SOC analysts, and compliance teams who want AD security visibility in Splunk without writing every search from scratch. Open source, MIT licensed: https://github.com/keykhosro/splunk_activedirectory_dashboard