Alerts
Rule results for failed logons, lockouts, privileged and policy changes, brute force, spraying and probing.
Account locked out
tavi.vale locked out on DC-EX-01 at 2026-08-30 11:07:00 UTC; caller LEX-WS-049.
Account tavi.vale · Source 10.24.3.53
Password reset by another account
Password of tavi.vale reset by elin.briar on DC-EX-01 at 2026-08-28 12:10:00 UTC.
Account tavi.vale · Source 10.24.3.220
Account locked out
anika.quill locked out on DC-EX-02 at 2026-08-27 12:43:00 UTC; caller LEX-WS-006.
Account anika.quill · Source 10.24.1.121
Password reset by another account
Password of neri.wren reset by elin.briar on DC-EX-01 at 2026-08-24 11:03:00 UTC.
Account neri.wren · Source 10.24.4.175
Account locked out
neri.moss locked out on DC-EX-01 at 2026-08-18 14:44:00 UTC; caller LEX-WS-024.
Account neri.moss · Source 10.24.1.112
Password reset by another account
Password of kian.wren reset by elin.briar on DC-EX-02 at 2026-08-18 11:09:00 UTC.
Account kian.wren · Source 10.24.4.27
Account locked out
sela.quill locked out on DC-EX-01 at 2026-08-17 15:28:00 UTC; caller LEX-WS-017.
Account sela.quill · Source 10.24.3.111
Account locked out
orin.briar locked out on DC-EX-01 at 2026-08-11 17:18:00 UTC; caller LEX-WS-022.
Account orin.briar · Source 10.24.3.139
Password reset by another account
Password of kian.briar reset by elin.briar on DC-EX-02 at 2026-08-07 10:28:00 UTC.
Account kian.briar · Source 10.24.4.49
Password reset by another account
Password of anika.quill reset by elin.briar on DC-EX-02 at 2026-08-04 17:57:00 UTC.
Account anika.quill · Source 10.24.1.212
Account locked out
kian.moss locked out on DC-EX-02 at 2026-08-02 14:51:00 UTC; caller LEX-WS-019.
Account kian.moss · Source 10.24.4.219
Password changed
anika.vale changed their password on DC-EX-01 at 2026-10-22 15:52:00 UTC.
Account anika.vale · Source 10.24.3.102
Directory object changed
Directory object created by tavi.vale on DC-EX-02 at 2026-10-22 12:11:00 UTC.
Source 10.24.3.81
Privileged account logon
1 successful logon (4624) on 2026-10-22 by dara.vale, member of Server Operators.
Account dara.vale
Account lifecycle change
Account changed: mira.quill by elin.briar on DC-EX-01 at 2026-10-21 12:46:00 UTC.
Account mira.quill · Source 10.24.2.91
Account lifecycle change
Account changed by neri.vale; requested by [excluded].
Account neri.vale
Directory object changed
Directory object created by tavi.vale on DC-EX-01 at 2026-10-21 09:42:00 UTC.
Source 10.24.3.154
Privileged account logon
1 successful logon (4624) on 2026-10-20 by orin.quill, member of Administrators, Domain Admins.
Account orin.quill
Account lifecycle change
Account changed: veya.quill by elin.briar on DC-EX-02 at 2026-10-19 14:06:00 UTC.
Account veya.quill · Source 10.24.1.163
Password changed
mira.briar changed their password on DC-EX-01 at 2026-10-19 11:50:00 UTC.
Account mira.briar · Source 10.24.4.91
Rule coverage
Rules evaluated by the scheduled cli/evaluate-alerts.php job over the collected events · pattern thresholds: brute force 10, spraying 10, probing 5 per 10 minutes
| Rule | Severity | Trigger | Alerts raised |
|---|---|---|---|
| Brute force | Critical | At least 10 failed logons (4625) for one account within 10 minutes | 2 |
| Password spraying | Critical | One source fails logons for at least 10 distinct existing accounts within 10 minutes | 1 |
| Account probing | Critical | One source tries at least 5 non-existent accounts (status 0xC0000064) within 10 minutes | 1 |
| Security log cleared | Critical | Any 1102 event | 1 |
| Audit policy changed | Critical | Any 4719 event | 1 |
| Member added to privileged group | Critical | 4728 / 4732 / 4756 for a privileged group | 2 |
| Member removed from privileged group | Warning | 4729 / 4733 / 4757 for a privileged group | 1 |
| Account locked out | Warning | Any 4740 event | 24 |
| Password reset by another account | Warning | Any 4724 event | 17 |
| Group Policy changed | Warning | 5136 / 5137 on a Group Policy object | 1 |
| Directory object changed | Info | 5136 / 5137 on other directory objects | 9 |
| Account lifecycle change | Info | 4720 / 4722 / 4725 / 4726 / 4738 | 44 |
| Password changed | Info | Any 4723 event | 27 |
| Privileged account logon | Info | 4624 by a member of a privileged group (one alert per account per day) | 20 |