[ms_ad_obj_msad_access]
search = `ms_obj_win_events_security` (EventCode=566 OR EventCode=4662 OR EventCode=5136 OR EventCode=5137 OR EventCode=5141)

[ms_ad_obj_msad-dc-health]
search = source=powershell sourcetype="MSAD:*:Health"

[ms_ad_obj_msad-failed-successful-user-logons]
search = `ms_obj_failed_success_logons_user`

[ms_ad_obj_msad-successful-user-logons]
search = `ms_obj_success_logons_user`

[ms_ad_obj_msad-failed-user-logons]
search = `ms_obj_failed_logons_user`

[ms_ad_obj_msad-successful-system-logons]
search = `ms_obj_success_logons_system`

[ms_ad_obj_msad-failed-system-logons]
search = `ms_obj_failed_logons_system`

[ms_ad_obj_msad-successful-computer-logons]
search = `ms_obj_success_logons_computer`

[ms_ad_obj_msad-failed-successful-computer-logons]
search = `ms_obj_failed_success_logons_computer)`

[ms_ad_obj_msad-account-lockout]
search = `ms_obj_win_events_security` EventCode=4740

[ms_ad_obj_msad-account-unlock]
search = `ms_obj_win_events_security` EventCode=4767

[ms_ad_obj_wineventlog_ds]
search = source="WinEventLog:Directory Service" OR source="XmlWinEventLog:Directory Service"

### Ported from Splunk App for Windows Infrastructure ###
###
###		AD and DNS eventtypes
###
[msad-account-lockout]
search = `ms_obj_win_events_security` EventCode=4740

[msad-account-unlock]
search = `ms_obj_win_events_security` EventCode=4767

[msad-ad-access]
search = `ms_obj_win_events_security` EventCode=4662

[msad-admin-audit]
search = `ms_obj_changes_base_all`

[msad-anomalous-events]
search = eventtype=msad-security-anomalous-events OR eventtype=msad-dirsvcs-anomalous-events

[msad-computer-changes]
search = `ms_obj_changes_base_cat_computer`

[msad-dirsvcs-anomalous-events]
search = eventtype=ms_ad_obj_wineventlog_ds (Type=Error OR Type=Warning OR EventCode=1458)

[msad-disabled-logons]
search = `ms_obj_failed_logons_all` (Status=0xC000006E OR Status=0xC0000072 OR Status=0xC0000193)


[msad-dns-events]
search = (`ms_ad_obj_win_events_all`) (Type=Warning OR Type=Error) DNS) OR (source="WinEventLog:DNS Server" (Type=Warning OR Type=Error))

[msad-failed-computer-logons]
search = `ms_obj_failed_logons_computer`

[msad-failed-user-logons]
search = `ms_obj_failed_logons_user`

[msad-group-changes]
search = `ms_obj_changes_base_cat_group`

[msad-groupmembership-changes]
search = `ms_obj_changes_base_cat_group_membership`

[msad-password-changes]
search = `ms_obj_win_events_security` (EventCode=4723 OR EventCode=4724)

[msad-rep-errors]
search = eventtype=ms_ad_obj_wineventlog_ds (EventCode=1014 OR EventCode=1083 OR EventCode=1084 OR EventCode=1203 OR EventCode=1307 OR EventCode=1308 OR EventCode=1311 OR EventCode=1566 OR EventCode=1699 OR EventCode=1800 OR EventCode=1801 OR EventCode=1865 OR EventCode=1925 OR EventCode=1926 OR EventCode=1988 OR EventCode=2087 OR EventCode=2088)

[msad-security-anomalous-events]
search = `ms_obj_win_events_security` (Type=Error OR Type=Warning OR EventCode=512 OR EventCode=513 OR EventCode=516 OR EventCode=517 OR EventCode=1100 OR EventCode=1101 OR EventCode=1102 OR EventCode=1104 OR EventCode=4609 OR EventCode=4612 OR EventCode=1621)

[msad-successful-computer-logons]
search = `ms_obj_success_logons_computer`

[msad-successful-user-logons]
search = `ms_obj_success_logons_user`

[msad-user-changes]
search = `ms_obj_changes_base_cat_user`
###
###		Windows eventtypes
###
[eventlog_Update_Successful]
search = source="*:System" "Installation Successful"

[eventlog_Update_Failed]
search = source="*:System" "Installation Failure"

[updatelog_Update_Successful]
search = sourcetype="WindowsUpdateLog" "Content Install" "Installation Successful"

[updatelog_Update_Failed]
search = sourcetype="WindowsUpdateLog" Failure "Content Install" "Installation Failure"

[Update_Successful]
search = eventtype=eventlog_Update_Successful OR eventtype=updatelog_Update_Successful

[Update_Failed]
search = eventtype=eventlog_Update_Failed OR eventtype=updatelog_Update_Failed

[Key_Events_On_Hosts]
search = \
    ( \
        sourcetype="wineventlog*" OR sourcetype="xmlwineventlog*" \
            (Type="*Error*" OR Type="*Fail*" OR EventCode=1074 OR EventCode=19 OR \
            EventCode=20 OR EventCode=21 OR Eventcode=1001) \
    ) OR \
    ( \
        sourcetype="WindowsUpdateLog" (status="installed" OR \
            status="failure" OR status="restart required") \
    )
description = This event type identifies key events on a host machine running Windows. \
    Key events are defined as most commonly occurring scenarios on a Windows host that \
    may require immediate attention or may explain issues seen on a host. hence the \
    events collected by this event type include the following: \
        1. Windows event log events from the System, Application or Security event log \
            that indicate errors. \
        2. Windows system event log event with event code 1074 for system reboots. Event codes \
            600*s although useful in detecting the reboots of the event log itself are useful, \
            they have been known to be noisy in reality and so excluded from this event type. \
        3. Windows update event log events with event codes 19, 20 or 21 for installs, \
            failures and required reboot scenarios. \
        4. Windows update log actions indicating install, failure or install requiring reboots. \
    Note: since event types dont support append command, we OR the source types.
###
###	Windows, AD and DNS common eventtype
### 
[wineventlog_common]
search = eventtype=wineventlog_windows OR source = "WinEventLog:DFS Replication" OR source = "WinEventLog:Directory Service" OR source = "WinEventLog:File Replication Service" OR source = "WinEventLog:Key Management Service" OR source="WinEventLog:DNS Server" OR source="WinEventLog:Exchange Auditing"

[netmon_windows]
search = sourcetype=WinNetMon
#tags = os windows

[printmon_windows]
search = sourcetype=WinPrintMon
#tags = os windows