# Active Directory Auditing

**URL:** <https://community.graylog.org/t/active-directory-auditing/27908>\
**Category:** Graylog Central (peer support)\
**Created:** [March 1, 2023, 7:25pm UTC](https://community.graylog.org/t/active-directory-auditing/27908 "2023-03-01T19:25:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RemyDePoorter](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/remydepoorter/32/14341_2.png) [@RemyDePoorter](https://community.graylog.org/u/RemyDePoorter)\
**Post date:** [March 1, 2023, 7:25pm UTC](https://community.graylog.org/t/active-directory-auditing/27908/1 "2023-03-01T19:25:00Z")

</div>

Hello,  
I’m new here. I would like to use Graylog 5.0 to audit Windows active directory and send a mail in case of threats.

So I have installed OpenSearch and NXLogs.

I would like to use this package: [GitHub - reighnman/Graylog\_Content\_Pack\_Active\_Directory\_Auditing](https://github.com/reighnman/Graylog_Content_Pack_Active_Directory_Auditing)  
But I have an error when importing the json file

How can I solve this?

---

<div class="post-metadata">

**Author:** ![joe.gross](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/joe.gross/32/13372_2.png) [@joe.gross](https://community.graylog.org/u/joe.gross)\
**Post date:** [March 1, 2023, 7:29pm UTC](https://community.graylog.org/t/active-directory-auditing/27908/2 "2023-03-01T19:29:04Z")

</div>

Sorry to be the bearer of bad news, but it’s too old.

“Tested with nxLog/Windows 2008R2 Domain Controllers/Graylog 1.2”

Graylog 1.2 was EOL by 2016. There have been several major changes since then that could render these older content packs obsolete.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 1, 2023, 10:40pm UTC](https://community.graylog.org/t/active-directory-auditing/27908/3 "2023-03-01T22:40:05Z")

</div>

Hey @RemyDePoorter

Perhaps try this see if it works, plus its newer then the one you have.

> [@Active Directory Auditing (WinLogBeats) - Graylog 3.0.2+](https://community.graylog.org/t/active-directory-auditing-winlogbeats-graylog-3-0-2/22889):
>
> Active Directory Auditing (WinLogBeats) - Graylog 3.0.2+ @reighnman [Download from Github](https://raw.githubusercontent.com/reighnman/Graylog_Content_Pack_Active_Directory_Auditing_Dashboards_Beats/master/content_pack.json)[View on Github](https://github.com/reighnman/Graylog_Content_Pack_Active_Directory_Auditing_Dashboards_Beats)[Open Issues](https://github.com/reighnman/Graylog_Content_Pack_Active_Directory_Auditing_Dashboards_Beats/issues)[Stargazers](https://github.com/reighnman/Graylog_Content_Pack_Active_Directory_Auditing_Dashboards_Beats/stargazers) Tested with WinLogBeats(Sidecar-Collector)/Windows 2012R2 Domain Controllers/Graylog 3.0.2/WinLogBeats This content pack provides several useful dashboards for auditing Active Directory events: DNS Object Summary - DNS Creations, Deletions Group Object Summary - Group Creations, Modifications, Deletions, Membership Changes User Object Summary - Account Creations…

If not there are work-arounds you could do if you want to keep open version.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 15, 2023, 10:40pm UTC](https://community.graylog.org/t/active-directory-auditing/27908/4 "2023-03-15T22:40:33Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.