Centrify Insight

Thanks For Downloading!

Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows:

Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into %PROGRAMFILES%\Splunk\etc\apps. Then restart Splunk using the splunk restart command or the GUI.

Unix/Linux: Decompress the downloaded file using a tool like tar -xvf and place the resulting folder into $SPLUNK_HOME/etc/apps. Then restart Splunk using the splunk restart command or the GUI.

Centrify Insight is a Splunk application that listens to Active Directory domain controllers and security event logs, as well as *NIX syslog and Centrify Suite logs to provide the type of insight you need to answer security and forensic questions about Centrify secured systems.

Centrify Insight is also a great application for monitoring, searching and reporting on NIX login activity. Find you most active users, watch for failed login attempts and break out login attempts by login method (ssh, console, su) and user type (active directory domain user, local user, root).
NOTE: In order for the Centrify Insight application to monitor NIX login activities, you must use both the splunk universal forwarder and the Centrify Insight *NIX Collector application (<http://splunk-base.splunk.com/apps/31874/centrify-insight-nix-collector>).