# Active Directory Change Auditing

**URL:** <https://discuss.elastic.co/t/active-directory-change-auditing/77526>\
**Category:** Logstash\
**Created:** [March 6, 2017, 3:18pm UTC](https://discuss.elastic.co/t/active-directory-change-auditing/77526 "2017-03-06T15:18:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![HawkUser](https://avatars.discourse-cdn.com/v4/letter/h/ecccb3/32.png) [@HawkUser](https://discuss.elastic.co/u/HawkUser)\
**Post date:** [March 6, 2017, 3:18pm UTC](https://discuss.elastic.co/t/active-directory-change-auditing/77526/1 "2017-03-06T15:18:46Z")

</div>

Hi Folks,

I'm interesting in logging Event IDs 5136 (Directory Service Changes - A directory service object was modified.).

i'm already using WinLogBeats to capture login/logout events, that was pretty straight forward and easy!.

But the logging directory change events is whole different story.

Every modification in active directory change is audit has the following structure:

If the change purpose is modification attribute that already has value, 2 events is written.  
(the connection between the events is field name "Correlation ID" or as logged using WinLogBeats as OpCorrelationID)  
If the change is clearing attribute value, only the 1 event written.

**the first event say the value deleted and what was the old value.**

> A directory service object was modified.
> 
> Subject:  
> Security ID: FOREST\XXX XXX  
> Account Name: XXX XXX  
> Account Domain: FOREST  
> Logon ID: 0x50D63

> Directory Service:  
> Name: forest.local  
> Type: Active Directory Domain Services
> 
> Object:  
> DN: CN=XXX XXX,CN=Users,DC=forest,DC=local  
> GUID: CN=XXX XXX,CN=Users,DC=forest,DC=local  
> Class: user
> 
> Attribute:  
> LDAP Display Name: description  
> Syntax (OID): 2.5.5.12  
> Value: a
> 
> Operation:  
> Type: Value Deleted  
> Correlation ID: {7143b205-d541-42b9-b5c6-ecc78c4c7774}  
> Application Correlation ID: -

**the second event that the value added and what is the new value.**

> A directory service object was modified.
> 
> Subject:  
> Security ID: FOREST\XXX  
> Account Name: XXX XXX  
> Account Domain: FOREST  
> Logon ID: 0x50D63

> Directory Service:  
> Name: forest.local  
> Type: Active Directory Domain Services
> 
> Object:  
> DN: CN=XXX XXX,CN=Users,DC=forest,DC=local  
> GUID: CN=XXX XXX,CN=Users,DC=forest,DC=local  
> Class: user
> 
> Attribute:  
> LDAP Display Name: description  
> Syntax (OID): 2.5.5.12  
> Value: ab
> 
> Operation:  
> Type: Value Added  
> Correlation ID: {7143b205-d541-42b9-b5c6-ecc78c4c7774}  
> Application Correlation ID: -

After spending few hours in reading about Logstash Aggregation, do the fantastic community has insights how to use it or someone already deploy this usages?

the purpose is holding one document for every change, include the old value and new value.

> **[Aggregate filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-aggregate.html)**

Regards,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2017, 3:18pm UTC](https://discuss.elastic.co/t/active-directory-change-auditing/77526/2 "2017-04-03T15:18:45Z")

</div>

Closed on April 3, 2017, 3:18pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.