Alerts
Rule results for failed logons, lockouts, privileged and policy changes, brute force, spraying and probing.
Password reset by another account
Password of kian.quill reset by elin.briar on DC-EX-01 at 2026-10-08 14:38:00 UTC.
Account kian.quill · Source 10.24.2.129
Password reset by another account
Password of orin.briar reset by elin.briar on DC-EX-01 at 2026-10-07 13:53:00 UTC.
Account orin.briar · Source 10.24.3.44
Account locked out
kian.moss locked out on DC-EX-01 at 2026-10-07 12:20:00 UTC; caller LEX-WS-001.
Account kian.moss · Source 10.24.1.107
Password reset by another account
Password of anika.quill reset by elin.briar on DC-EX-01 at 2026-10-05 16:11:00 UTC.
Account anika.quill · Source 10.24.2.32
Account locked out
veya.wren locked out on DC-EX-01 at 2026-10-02 17:15:00 UTC; caller LEX-WS-054.
Account veya.wren · Source 10.24.3.170
Password reset by another account
Password of kian.briar reset by elin.briar on DC-EX-01 at 2026-10-02 14:08:00 UTC.
Account kian.briar · Source 10.24.1.97
Account locked out
tavi.wren locked out on DC-EX-01 at 2026-10-01 14:19:00 UTC; caller LEX-WS-026.
Account tavi.wren · Source 10.24.2.75
Password reset by another account
Password of kian.quill reset by elin.briar on DC-EX-01 at 2026-09-29 08:49:00 UTC.
Account kian.quill · Source 10.24.1.118
Password reset by another account
Password of orin.vale reset by elin.briar on DC-EX-02 at 2026-09-28 15:02:00 UTC.
Account orin.vale · Source 10.24.1.126
Account locked out
neri.wren locked out on DC-EX-02 at 2026-09-26 14:06:00 UTC; caller LEX-WS-022.
Account neri.wren · Source 10.24.4.218
Member removed from privileged group
kian.vale removed from Administrators by tavi.vale on DC-EX-01 at 2026-09-25 11:40:00 UTC (event 4733).
Account kian.vale · Source 10.24.3.56
Password reset by another account
Password of kian.wren reset by elin.briar on DC-EX-01 at 2026-09-24 16:58:00 UTC.
Account kian.wren · Source 10.24.1.170
Account locked out
anika.quill locked out on DC-EX-01 at 2026-09-18 14:49:00 UTC; caller LEX-WS-041.
Account anika.quill · Source 10.24.1.12
Account locked out
sela.briar locked out on DC-EX-02 at 2026-09-11 08:25:00 UTC; caller LEX-WS-020.
Account sela.briar · Source 10.24.1.149
Account locked out
kian.briar locked out on DC-EX-01 at 2026-09-09 14:05:00 UTC; caller LEX-WS-040.
Account kian.briar · Source 10.24.2.89
Password reset by another account
Password of kian.wren reset by elin.briar on DC-EX-01 at 2026-09-09 12:57:00 UTC.
Account kian.wren · Source 10.24.2.160
Password reset by another account
Password of tavi.wren reset by elin.briar on DC-EX-01 at 2026-09-08 11:06:00 UTC.
Account tavi.wren · Source 10.24.3.35
Account locked out
anika.wren locked out on DC-EX-01 at 2026-09-07 10:45:00 UTC; caller LEX-WS-023.
Account anika.wren · Source 10.24.3.136
Account locked out
neri.briar locked out on DC-EX-02 at 2026-09-05 13:36:00 UTC; caller LEX-WS-044.
Account neri.briar · Source 10.24.1.55
Password reset by another account
Password of mira.briar reset by elin.briar on DC-EX-01 at 2026-09-03 12:28:00 UTC.
Account mira.briar · Source 10.24.3.39
Rule coverage
Rules evaluated by the scheduled cli/evaluate-alerts.php job over the collected events · pattern thresholds: brute force 10, spraying 10, probing 5 per 10 minutes
| Rule | Severity | Trigger | Alerts raised |
|---|---|---|---|
| Brute force | Critical | At least 10 failed logons (4625) for one account within 10 minutes | 2 |
| Password spraying | Critical | One source fails logons for at least 10 distinct existing accounts within 10 minutes | 1 |
| Account probing | Critical | One source tries at least 5 non-existent accounts (status 0xC0000064) within 10 minutes | 1 |
| Security log cleared | Critical | Any 1102 event | 1 |
| Audit policy changed | Critical | Any 4719 event | 1 |
| Member added to privileged group | Critical | 4728 / 4732 / 4756 for a privileged group | 2 |
| Member removed from privileged group | Warning | 4729 / 4733 / 4757 for a privileged group | 1 |
| Account locked out | Warning | Any 4740 event | 24 |
| Password reset by another account | Warning | Any 4724 event | 17 |
| Group Policy changed | Warning | 5136 / 5137 on a Group Policy object | 1 |
| Directory object changed | Info | 5136 / 5137 on other directory objects | 9 |
| Account lifecycle change | Info | 4720 / 4722 / 4725 / 4726 / 4738 | 44 |
| Password changed | Info | Any 4723 event | 27 |
| Privileged account logon | Info | 4624 by a member of a privileged group (one alert per account per day) | 20 |