Device Integration: ManageEngine ADManager Plus

TABLE OF CONTENTS

• Overview
• Prerequisites
• Configuration Steps
  • ADManager Plus Syslog Forwarding
• Actions Supported
• Verification (MSSP Only)
  • On ADR SIEM UI
  • On ADR CCE (CLI)
• Official Documentation Link

Overview

ADManager Plus is an identity and access management solution for Active Directory, Microsoft 365, and Google Workspace. It supports forwarding management action logs in real time to a central Syslog server, enabling centralized security monitoring and audit compliance. 

Prerequisites

• Administrative access to ADManager Plus.
• Administrative access to ADR SIEM UI.
• ADR CCE server IP.
• Firewall rule allowing UDP port 514 (Syslog) from ADManager Plus to the CCE server.

Configuration Steps

ADManager Plus Syslog Forwarding

1. Log in to the ADManager Plus console.
2. Navigate to the Admin tab, then System Settings, and select Integrations.
   • In some versions, go to Personalize > Integration.
3. In the Log Forwarding section, click Syslog.
4. On the Syslog Settings page:
   • Check Enable forwarding of ADManager Plus data.
   • Enter the ADR CCE IP address under Syslog Server.
   • Port: 514.
   • Protocol: UDP is default; choose TCP if encryption is required and supported.
   • Syslog Standard: Select RawLog.
   • Data Format: Choose the preferred payload format (ADManager provides a preview).
   • Click Save to apply changes.
   • By default, Enable Integration should be ON; toggle OFF to disable Syslog forwarding.

Actions Supported

ADManager Plus forwards logs for management actions in:

• Active Directory
• Google Workspace
• Microsoft 365

Common forwarded events include:

• User, group, and computer creation, modification, deletion
• Password resets and account lockouts
• Privilege escalations and access modifications
• Policy and application changes

Verification (MSSP Only)

On ADR SIEM UI

1. Log in to the ADR SIEM GUI as an administrator.
2. Navigate to System Logs and Flows > Collection Status.
3. Confirm the ADManager Plus device (manageengine) appears under Source Device IP.

On ADR CCE (CLI)

Run the following command to confirm Syslog packets are arriving from ADManager Plus device.

sudo tcpdump -i any port 514 and host <ADManagerPlus_IP> -s0 -AAA

Official Documentation Link

For further reference, see ManageEngine's official ADManager Plus documentation. ManageEngine ADManager Plus