Does this information look incorrect or out-of-date? Please contact us at support@socos.io.
ManageEngine AD Audit Plus is an auditing tool that allows the user to track file permission changes, monitor logons and monitor Windows Server security-related activities.
ManageEngine alerts can be easily forwarded in the CEF format using the syslog server. The forwarding can be configured with the following steps using ArcSight:
- In the main window, click on the Admin tab and select SIEM Integration.
- In the checkbox, tick Enable forwarding of ADAudit Plus Data.
- Choose the ArcSight radio button from the tab in the top menu.
- In the text field below, enter the ArcSight/CEF Server name.
- Choose the preferred protocol and enter the port number. The recommended protocol is TCP.
- Save the configuration and choose the categories to forward
https://www.manageengine.com/products/active-directory-audit/help/getting-started/siem-integration.html