Active Directory Monitoring App

The Active Directory Monitoring App provides operational visibility into Active Directory domain controller health, replication status, authentication activity, and security posture through four integrated dashboards. The app automatically identifies domain controllers by correlating Active Directory health telemetry (MSAD:NT6:Health) with either AD replication metrics (MSAD:NT6:Replication) or NTDS performance counters (PerfmonMk:NTDS). All dashboard panels are scoped exclusively to detected domain controllers, ensuring that visualizations reflect only AD infrastructure rather than general Windows servers. The app surfaces authentication events, audit trails, security operations data, endpoint health, network activity, process execution, and Windows Defender status from Windows event logs collected via the Splunk Add-on for Microsoft Windows. By centralizing DC detection logic in reusable macros, the app supports flexible index configuration while maintaining consistent host scoping across all dashboards.