Alerts
Rule results for failed logons, lockouts, privileged and policy changes, brute force, spraying and probing.
Brute force
30 failed logons (4625) for mira.quill from 1 source(s) between 2026-10-21 03:12:00 and 03:19:44 UTC on DC-EX-01; status 0xC000006A.
Account mira.quill · Source 198.51.100.20
Password spraying
20 failed logons (4625) against 20 distinct accounts from 198.51.100.21 between 2026-10-20 01:40:00 and 01:45:23 UTC on DC-EX-01; status 0xC000006A.
Source 198.51.100.21
Security log cleared
Security log cleared by orin.quill on DC-EX-02 at 2026-10-19 22:41:00 UTC.
Source 10.24.1.42
Account probing
15 failed logons (4625) for 15 non-existent account names from 198.51.100.22 between 2026-10-17 23:05:00 and 23:09:26 UTC on DC-EX-01; status 0xC0000064.
Source 198.51.100.22
Member added to privileged group
veya.quill added to Backup Operators by tavi.vale on DC-EX-02 at 2026-10-13 15:21:00 UTC (event 4728).
Account veya.quill · Source 10.24.2.185
Audit policy changed
Audit policy changed by tavi.vale on DC-EX-01 at 2026-10-10 18:47:00 UTC.
Source 10.24.4.109
Account locked out
sela.quill locked out on DC-EX-02 at 2026-10-21 10:03:00 UTC; caller LEX-WS-028.
Account sela.quill · Source 10.24.1.140
Account locked out
mira.quill locked out on DC-EX-01 at 2026-10-21 03:14:00 UTC; caller EXT-GW.
Account mira.quill · Source 10.24.2.138
Account locked out
elin.vale locked out on DC-EX-01 at 2026-10-19 14:29:00 UTC; caller LEX-WS-008.
Account elin.vale · Source 10.24.4.143
Group Policy changed
Group Policy "Workstation Hardening" modified by tavi.vale on DC-EX-02 at 2026-10-19 14:12:00 UTC.
Source 10.24.4.194
Account locked out
veya.wren locked out on DC-EX-01 at 2026-10-18 13:33:00 UTC; caller LEX-WS-023.
Account veya.wren · Source 10.24.2.134
Account locked out
kian.moss locked out on DC-EX-01 at 2026-10-17 12:13:00 UTC; caller LEX-WS-048.
Account kian.moss · Source 10.24.4.18
Password reset by another account
Password of tavi.moss reset by elin.briar on DC-EX-01 at 2026-10-16 11:56:00 UTC.
Account tavi.moss · Source 10.24.3.98
Account locked out
sela.vale locked out on DC-EX-01 at 2026-10-15 16:48:00 UTC; caller LEX-WS-055.
Account sela.vale · Source 10.24.2.133
Password reset by another account
Password of sela.quill reset by elin.briar on DC-EX-02 at 2026-10-15 11:14:00 UTC.
Account sela.quill · Source 10.24.4.170
Account locked out
elin.moss locked out on DC-EX-01 at 2026-10-13 08:12:00 UTC; caller LEX-WS-045.
Account elin.moss · Source 10.24.2.201
Account locked out
orin.vale locked out on DC-EX-01 at 2026-10-12 17:19:00 UTC; caller LEX-WS-002.
Account orin.vale · Source 10.24.1.43
Account locked out
elin.wren locked out on DC-EX-02 at 2026-10-11 16:38:00 UTC; caller LEX-WS-010.
Account elin.wren · Source 10.24.4.102
Password changed
anika.vale changed their password on DC-EX-01 at 2026-10-22 15:52:00 UTC.
Account anika.vale · Source 10.24.3.102
Directory object changed
Directory object created by tavi.vale on DC-EX-02 at 2026-10-22 12:11:00 UTC.
Source 10.24.3.81
Rule coverage
Rules evaluated by the scheduled cli/evaluate-alerts.php job over the collected events · pattern thresholds: brute force 10, spraying 10, probing 5 per 10 minutes
| Rule | Severity | Trigger | Alerts raised |
|---|---|---|---|
| Brute force | Critical | At least 10 failed logons (4625) for one account within 10 minutes | 2 |
| Password spraying | Critical | One source fails logons for at least 10 distinct existing accounts within 10 minutes | 1 |
| Account probing | Critical | One source tries at least 5 non-existent accounts (status 0xC0000064) within 10 minutes | 1 |
| Security log cleared | Critical | Any 1102 event | 1 |
| Audit policy changed | Critical | Any 4719 event | 1 |
| Member added to privileged group | Critical | 4728 / 4732 / 4756 for a privileged group | 2 |
| Member removed from privileged group | Warning | 4729 / 4733 / 4757 for a privileged group | 1 |
| Account locked out | Warning | Any 4740 event | 24 |
| Password reset by another account | Warning | Any 4724 event | 17 |
| Group Policy changed | Warning | 5136 / 5137 on a Group Policy object | 1 |
| Directory object changed | Info | 5136 / 5137 on other directory objects | 9 |
| Account lifecycle change | Info | 4720 / 4722 / 4725 / 4726 / 4738 | 44 |
| Password changed | Info | Any 4723 event | 27 |
| Privileged account logon | Info | 4624 by a member of a privileged group (one alert per account per day) | 20 |