WinlogBeat

---

Table of contents

• AD Audit Log Cleared
• AD Audit Policy Change
• AD Cred DC Validate Failed
• AD Dir Srvc Obj Created
• AD Dir Srvc Obj Deleted
• AD Dir Srvc Obj Modified
• AD Dir Srvc Obj Moved
• AD Dir Srvc Obj Undeleted
• AD EventLogServiceStarted
• AD EventLogServiceStopped
• AD Failed Login On Locked Account
• AD LocalGroupEnumerated
• AD LocalGroupEnumeratedAnomaly
• AD LoginFailure
• AD Logon SpecialPrivileges
• AD Member Add Sec Dsbl Gbl Group
• AD Member Add Sec Dsbl Lcl Group
• AD Member Add Sec Dsbl Unv Group
• AD Member Add Sec Enbl Gbl Group
• AD Member Add Sec Enbl Lcl Group
• AD Member Add Sec Enbl Unv Group
• AD NTLMv1Anonymous
• AD NTLMv1NonAnonymous
• AD Net Share Obj Accessed
• AD Net Share Obj Added
• AD Net Share Obj Deleted
• AD Net Share Obj Modified
• AD Object Permissions Changed
• AD ProcessCreation
• AD Registry Value Modified
• AD Replica Src Naming Context Established
• AD Replica Src Naming Context Removed
• AD Scheduled Task Created
• AD Scheduled Task Deleted
• AD Scheduled Task Disabled
• AD Scheduled Task Enabled
• AD Scheduled Task Updated
• AD Sec Enabled Global Grp Created
• AD Sec Enabled Local Grp Created
• AD Sec Enabled Universal Grp Created
• AD Successful Login With Explicit Credentials
• AD SystemShutdown
• AD User Account Changed
• AD User Account Deleted
• AD User Account Enabled
• AD User Right Assigned
• ADMassPasswordChange
• ADPasswordChange
• ADPasswordChangeOtherUser
• ADUserLockout
• EventADHostnameInterruption
• EventADHostnameInterruptionDaily
• Ingress Interruption ADHostname Daily
• Ingress Interruption ADHostname Hourly