---
id: 5900
title: "AD Security 101: SIEM Tools and AD Monitoring"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/ad-security-101-siem-tools/"
published_at: "2023-03-23T17:28:00Z"
tags: ["siem", "threat-detection", "active-directory", "monitoring", "logging", "dcshadow"]
phying_url: "https://phying.com/item/5900"
lang: en
---

# AD Security 101: SIEM Tools and AD Monitoring

## Summary

Why SIEMs alone can't secure AD monitoring: attackers bypass AD logs (DCShadow), and SIEMs face collection limits, configuration errors, processing gaps, stale threat intel, and false positives.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2023-03-23T17:28:00Z
- **Original:** https://www.semperis.com/blog/ad-security-101-siem-tools/
- **Phying News:** https://phying.com/item/5900