### AD Eventtypes ####

[admon]
search = source=ActiveDirectory

[wineventlog-ds]
search = source="WinEventLog:Directory Service"

[perfmon]
search = source="Perfmon:*"

[powershell]
search = source=Powershell

[ad-files]
search = index=msad 

[perfmon-ntds]
search = eventtype=perfmon sourcetype="Perfmon:NTDS"

[msad-dc-health]
search = eventtype=powershell sourcetype="MSAD:*:Health"

[msad-rep-health]
search = eventtype=powershell sourcetype="MSAD:*:Replication"

[msad-site]
search = eventtype=powershell sourcetype="MSAD:*:SiteInfo"

[msad-subnetinfo]
search = eventtype=powershell sourcetype="MSAD:*:SiteInfo" Type="Subnet"

[msad-sitelinkinfo]
search = eventtype=powershell sourcetype="MSAD:*:SiteInfo" Type="SiteLink"

[msad-siteinfo]
search = eventtype=powershell sourcetype="MSAD:*:SiteInfo" Type="Site"

[msad-subnet-affinity]
search = sourcetype="MSAD:*:Netlogon" msad_affinity=NO_CLIENT_SITE

[admon-gpo]
search = eventtype=admon objectCategory="*CN=Group-Policy-Container*"

[admon-group]
search = eventtype=admon objectCategory="*CN=Group*"

[admon-computer]
search = eventtype=admon objectCategory="*CN=Computer*"

[admon-user]
search = eventtype=admon objectCategory="*CN=Person*"

