How to send on-prem Active Directory Audit Logs to Netwitness

[KyiThin]

Hi Sir/Madam,

I want to integrate Active Directory with Netwitness. I know I can add AD in context hub service. But what I want is sending AD Audit logs to Log decoder. I can't find such a thing in Internet. Can you show me how can I do this?

[DaveGlover]

There are a couple of different ways to do it.  If you search the integrations catalog you will see your options.

Those include:

WinRM

RSA Netwitness Endpoint agent

Snare

Event Reporter

NXlog

https://community.rsa.com/community/products/netwitness/integrations/catalog