Security Monitoring

Security.Monitoring :: 1.0.4.272 (Management Pack)

All documentation can be found at the following page:
https://blogs.technet.microsoft.com/nathangau/2017/05/01/introducing-the-security-monitoring-management-pack-for-scom/

• Show Management Pack XML
• Get Management Pack data in Excel format
• Security.Monitoring.mpb

Management Pack Elements

DataSource Modules (5)

	DisplayName	ID	Isolation	Accessibility
	GPO Change Event then run correlation script DS	SecurityMonitoringMP.GPOMonitoring.Event.DS	Any	Public
	Security.Monitoring.MultiStringRegistry.DS	Security.Monitoring.MultiStringRegistry.DS	Any	Internal
	Security.Monitoring.SMBv1Connections.DS	Security.Monitoring.SMBv1Connections.DS	Any	Internal
	SecurityMonitoring.Event.RepeatedFailedLogind.DS	SecurityMonitoring.Event.RepeatedFailedLogind.DS	Any	Public
	SecurityMonitoringMP.GPOMonitoring.GPOEvent.DS	SecurityMonitoringMP.GPOMonitoring.GPOEvent.DS	Any	Public

ProbeAction Modules (3)

	ID	Isolation	Accessibility
	Security.Monitoring.MultiStringRegistry.PowerShell	Any	Internal
	Security.Monitoring.SMBv1Connections.PowerShell	Any	Internal
	SecurityMonitoringMP.GPOMonitoring.ProbeActionModule.GPOCorrelationScript	Any	Public

Unit Monitor Types (5)

	DisplayName	ID	Accessibility	Support Monitor Recalculate
	Check Existence of RegKey Monitor Type	SecurityMonitoringMP.RegValueExistsMonitorType	Internal	False
	Check value of registry key	SecurityMonitoringMP.RegValueMonitorType	Internal	False
	CheckRegValue	CheckRegValue	Internal	False
	CheckRegValueString	CheckRegValueString	Internal	False
	MultiStringRegMonitorType	MultiStringRegMonitorType	Internal	False

Unit Monitors (6)

	DisplayName	ID	Target	Category	Enabled	Alert Generate	Accessibility
	Security Monitoring: Check Authentication Packages Registry Key	Security.Monitoring.Monitors.AuthenticationPackages	Microsoft.Windows.Server.OperatingSystem	AvailabilityHealth	True	True	Internal
	Security Monitoring: Repeated RDP Logon Failures	SecurityMonitoringMP.Event.RepeatedLogonMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	False	Public
	A System - Is Pending Restart	SecurityMonitoringMP.Event.SystemPendingRestart	Microsoft.Windows.Server.OperatingSystem	Custom	False	True	Public
	Security Monitoring: Event Log Collector Service is stopped	SecurityMonitoringMP.Health.EventCollectorMonitor	WindowsEventCollectorDiscovery.EventLogCollectorServer	Custom	True	True	Public
	Security Monitoring: UseLogonCredential key does not exist	SecurityMonitoringMP.UseLogonCredentialExistsMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	True	Internal
	Security Monitoring: Wdigest passwords stored in clear text	SecurityMonitoringMP.WDigestRegConfiguredMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	True	Internal

Rules (91)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	Security Monitoring: Collect SMBv1 Connections	Security.Monitoring.Collect.SMBv1Connections	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Collect LAPS Events	Security.Monitoring.CollectionRule.CollectLAPSEvents	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Possible Crypto-Ransomware Installed on Computer	Security.Monitoring.Event.4688.GenericCryptoRansomWare	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: RegSvr32 used to load a DLL that is not located on this machine	Security.Monitoring.Event.RemoteRegSvr32	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: SeDebugPrivilege Escalation Detected	Security.Monitoring.Event.SeDebugPrivilegeEscalation	Microsoft.Windows.OperatingSystem	Alert	False	True
	Security Monitoring: Collect LANMAN Authentication	Security.Monitoring.EventCollection.LanMan	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Collect NTLMV1 Events	Security.Monitoring.EventCollection.NTLMV1	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Collect WDigest Authentication Events	Security.Monitoring.EventCollection.WdigestAuthentication	Microsoft.Windows.Server.DC.Computer	EventCollection	True	False
	Security Monitoring Forwarded Events: Possible Crypto-Ransomware Installed on Computer	Security.Monitoring.ForwardedEvents.4688.GenericCryptoRansomWare	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Collect LAPS Events	Security.Monitoring.ForwardedEvents.CollectLAPSEvents	WindowsEventCollectorDiscovery.EventLogCollectorServer	EventCollection	True	False
	Security Monitoring Forwarded Events: SeDebug Privilege Escalation Detected	Security.Monitoring.ForwardedEvents.DebugEscalation	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Secuity Monitoring Forwarded Events: PowerSploit FindAV Signature Tool is in Use	Security.Monitoring.ForwardedEvents.FindAVSignature	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring ForwardedEvents: Powersploit Get DLL Load Path is in Use	Security.Monitoring.ForwardedEvents.GetDLLLoadPath	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerSploit HTTP Path Discovery Tool is in Use	Security.Monitoring.ForwardedEvents.GetHTTPStatus	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerSploit Key Stroke Logger in Use	Security.Monitoring.ForwardedEvents.GetKeystroke	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerSploit Invoke DLL Injection Command in Use	Security.Monitoring.ForwardedEvents.InvokeDLLInjection	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Invoke-Mimikatz Detected in Tier 0 Environment	Security.Monitoring.ForwardedEvents.InvokeMimikatz	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Invoke Ninja Copy is in Use	Security.Monitoring.ForwardedEvents.InvokeNinjaCopy	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Invoke Portscan is in Use	Security.Monitoring.ForwardedEvents.InvokePortScan	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring: Invoke ShellCode is in Use	Security.Monitoring.ForwardedEvents.InvokeShellCodeInUse	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Hidden Process Starting Using PowerShell	Security.Monitoring.ForwardedEvents.PowerShellStartHiddenProcess	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: RegSvr32 used to load a DLL that is not located on this machine	Security.Monitoring.ForwardedEvents.RemoteRegSvr32	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Secuity Monitoring: PowerSploit FindAV Signature Tool is in Use	Security.Monitoring.PowerShellLog.FindAVSignature	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Powersploit Get DLL Load Path is in Use	Security.Monitoring.PowerShellLog.GetDLLLoadPath	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerSploit HTTP Path Discovery Tool is in Use	Security.Monitoring.PowerShellLog.GetHTTPStatus	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerSploit Key Stroke Logger in Use	Security.Monitoring.PowerShellLog.GetKeystroke	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerSploit Invoke DLL Injection Command in Use	Security.Monitoring.PowerShellLog.InvokeDLLInjection	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke-Mimikatz is in Use.	Security.Monitoring.PowerShellLog.InvokeMimikatzInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke Ninja Copy is in Use	Security.Monitoring.PowerShellLog.InvokeNinjaCopy	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke Portscan is in Use	Security.Monitoring.PowerShellLog.InvokePortScan	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke ShellCode in Use	Security.Monitoring.PowerShellLog.InvokeShellCodeInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Hidden Process Starting Using PowerShell	Security.Monitoring.PowerShellLog.PowerShellStartHiddenProcess	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Modification has been made to the DC OU	Security.Monitoring.SecurityMonitoring.Event.DCOUModify	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: A GPO was Created	Security.Monitoring.SecurityMonitoring.Event.GPOCreation	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: A GPO was Deleted	Security.Monitoring.SecurityMonitoring.Event.GPODeletionRule	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Failed RDP Logon	SecurityMonitoring.Event.FailedLogin	Microsoft.Windows.Server.OperatingSystem	Custom	False	True
	Collect Failed Login Attemts	SecurityMonitoring.Failed.Login.Attempts.Collection	Microsoft.Windows.Computer	EventCollection	True	False
	Security Monitoring: Domain Admins membership has changed	SecurityMonitoringMP.Accounts.DomainAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Enterprise Admins membership has changed	SecurityMonitoringMP.Accounts.EnterpriseAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Local Administrators Group was Modified	SecurityMonitoringMP.Accounts.LocalAdminChange	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Schema Admins membership has changed	SecurityMonitoringMP.Accounts.SchemaAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Mimikatz in use	SecurityMonitoringMP.APPLocker.Mimikatz	Microsoft.Windows.Computer	Alert	False	True
	Security Monitoring: Prohibited App in Use	SecurityMonitoringMP.APPLocker.ProhibitedApp	Microsoft.Windows.Computer	Alert	True	True
	Security Monitoring: PSEXEC in Use	SecurityMonitoringMP.APPLocker.PSExec	Microsoft.Windows.Computer	Alert	False	True
	Security Monitoring: WCE in Use	SecurityMonitoringMP.APPLocker.WCE	Microsoft.Windows.Computer	Alert	False	True
	Security Monitoring: WinRar in use	SecurityMonitoringMP.APPLocker.WinRar	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: A suspicious process creation (AppLocker bypass) was executed	SecurityMonitoringMP.Event.4688.SuspiciousApplockerJava	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	SecurityMonitoringMP.Event.4688.SuspiciousApplockerRegsvr	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (cmd) was executed	SecurityMonitoringMP.Event.4688.SuspiciousCMD	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (FTP script execution via echo command) was executed	SecurityMonitoringMP.Event.4688.SuspiciousFTPCommand	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (registry) was executed	SecurityMonitoringMP.Event.4688.SuspiciousReg	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring; A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	SecurityMonitoringMP.Event.4688.SuspiciousWindowsPosition	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Possible Golden Ticket in Use	SecurityMonitoringMP.Event.GoldenTicketDetection	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Local account created on a member server	SecurityMonitoringMP.Event.LocalAccountCreatedonServer	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Scheduled Task was Created	SecurityMonitoringMP.Event.ScheduledTaskCreation	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Security Log was cleared	SecurityMonitoringMP.Event.SecurityLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A Service was created on a domain controller	SecurityMonitoringMP.Event.ServiceCreatedonDC	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: A service was created on a member server	SecurityMonitoringMP.Event.ServiceCreatedonMemberServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: Service associated with a known threat was created on a member server	SecurityMonitoringMP.Event.ServiceKnownThreat	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A Smart Card has been Disabled to Allow for Interactive Logon	SecurityMonitoringMP.Event.SmartCardDisabled	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Software was Installed on a Server	SecurityMonitoringMP.Event.SoftwareInstallOnServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: Software was Removed from a Server	SecurityMonitoringMP.Event.SoftwareRemovedFromServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: The system Log was cleared	SecurityMonitoringMP.Event.SystemLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A system has been powered off	SecurityMonitoringMP.Event.SystemPoweredOff	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: A system was restarted	SecurityMonitoringMP.Event.SystemRestarted	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: Unexpected System Shutdown	SecurityMonitoringMP.Event.UnexpectedShutdown	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring Collection: Event ID 4672	SecurityMonitoringMP.EventCollection.4672	Microsoft.Windows.Server.OperatingSystem	EventCollection	False	False
	Security Monitoring Collection: Event ID 4624 Logon Type 4	SecurityMonitoringMP.EventCollection.BatchLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring Event Collection: Event ID 4769 result 0x1F	SecurityMonitoringMP.EventCollection.GoldenTicket	Microsoft.Windows.Server.DC.Computer	EventCollection	True	False
	Security Monitoring Collection: Event ID 4694	SecurityMonitoringMP.EventCollection.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerJava	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerRegsvr	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (cmd) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousCMD	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (FTP script execution via echo command) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousFTPCommand	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (registry) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousReg	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousWindowsPosition	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Potential Credential Swap in Progress	SecurityMonitoringMP.ForwardedEvents.CredentialSwap	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Local User Created or Deleted in Administrator Security Group	SecurityMonitoringMP.ForwardedEvents.LocalUserCreatedDeleted	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Prohibited App in Use	SecurityMonitoringMP.ForwardedEvents.ProhibitedApp	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Possible PtH Attack in Progress Against Tier 2	SecurityMonitoringMP.ForwardedEvents.PtHTier2	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	True
	Security Monitoring Forwarded Events: Security log cleared on a server configured to forward events	SecurityMonitoringMP.ForwardedEvents.SecurityLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Service Created on system	SecurityMonitoringMP.ForwardedEvents.ServiceCreation	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	True
	Security Monitoring Forwarded Events: Service associated with a known threat was created on a forwarding computer	SecurityMonitoringMP.ForwardedEvents.ServiceCreationKnownThreats	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Special Group logon event	SecurityMonitoringMP.ForwardedEvents.SpecialGroupLogon	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: System Log was Cleared	SecurityMonitoringMP.ForwardedEvents.SystemLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	GPO Change Event then run correlation script Rule	SecurityMonitoringMP.GPOMonitoring.EventAndScript.Rule	Microsoft.Windows.Server.DC.Computer	Custom	True	True
	Security Monitoring: Potential Credential Swap in Progress	SecurityMonitoringMP.Pth.CredentialSwap	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Possible PtH attack in progress (successful) against DC	SecurityMonitoringMP.Pth.PtHAgainstDC	Microsoft.Windows.Server.DC.Computer	Alert	False	True
	Security Monitoring: Possible PtH Attack in Progress against tier 1	SecurityMonitoringMP.Pth.PtHAgainstTier1	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring Threat Hunting: Batch Logon in use	SecurityMonitoringMP.ThreatHunt.BatchLogonInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring Threat Hunting: Special Group logon event	SecurityMonitoringMP.ThreatHunt.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	Alert	True	True

Recoveries (2)

	DisplayName	ID	Target	Monitor	Reset Monitor	Category	Enabled	Accessibility
	Modify Windows Firewall	SecurityMonitoringMP.Recovery.BlockPortWindowsFW	Microsoft.Windows.Server.OperatingSystem	SecurityMonitoringMP.Event.RepeatedLogonMonitor	False	Custom	false	Public
	Restart Service	SecurityMonitoringMP.Recovery.RestartWecSVC	WindowsEventCollectorDiscovery.EventLogCollectorServer	SecurityMonitoringMP.Health.EventCollectorMonitor	True	Custom	true	Public

Monitor Property Overrides (4)

	ID	Context	Target
	OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012Full	Microsoft.Windows.Server.6.2.Full.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
	OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012OS	Microsoft.Windows.Server.6.2.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
	OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012R2	Microsoft.Windows.Server.2012.R2.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
	OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2016	Microsoft.Windows.Server.10.0.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor

Rule Property Overrides (3)

	ID	Context	Target
	OverrideForRuleSecurityMonitoringEventSeDebugPrivilegeEscalation	Microsoft.SystemCenter.ManagementServer	Security.Monitoring.Event.SeDebugPrivilegeEscalation
	OverrideForRuleSecurityMonitoringMP.Pth.PtHAgainstTier1.ServerDCComputer	Microsoft.Windows.Server.DC.Computer	SecurityMonitoringMP.Pth.PtHAgainstTier1
	OverrideForRuleSecurityMonitoringMP.Pth.PtHAgainstTier1.SQLComputer	Microsoft.SQLServer.ComputerGroup	SecurityMonitoringMP.Pth.PtHAgainstTier1

Folder Items (4)

	ID	FolderName	ElementID
	i08b0d1b442c04c8daf4574e19f39c3c9	SecurityMonitoringMP.Folder.SecurityMonitoring	SecurityMonitoringMP.View.SecurityMonitoringAlerts
	i3691038e88044516a67ac5bbc79422c0	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.View.EventCollectorState
	i74a5ba1881174da89a4041962320a070	SecurityMonitoringMP.Folder.SecurityMonitoring	SecurityMonitoringMP.View.ThreatHuntingAlert
	if3e38fad5d3547168a4bca954c52cecb	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.View.EventCollectorAlerts

Folders (2)

	DisplayName	ID	ParentFolder	Accessibility
	Event Collectors	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.Folder.SecurityMonitoring	Public
	Security Monitoring	SecurityMonitoringMP.Folder.SecurityMonitoring	Microsoft.SystemCenter.Monitoring.ViewFolder.Root	Public

Views (4)

	DisplayName	ID	Target	Type	Accessibility	Visible
	Event Collector Alerts	SecurityMonitoringMP.View.EventCollectorAlerts	WindowsEventCollectorDiscovery.EventLogCollectorServer	Microsoft.SystemCenter.AlertViewType	Public	True
	Event Collector State	SecurityMonitoringMP.View.EventCollectorState	WindowsEventCollectorDiscovery.EventLogCollectorServer	Microsoft.SystemCenter.StateViewType	Public	True
	Security Monitoring MP Alerts	SecurityMonitoringMP.View.SecurityMonitoringAlerts	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
	Threat Hunting	SecurityMonitoringMP.View.ThreatHuntingAlert	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True

Report Resources (10)

	ID	File Name	Accessibility
	AlertSummary.ID	Alert Summary_v1.rdl	Internal
	BatchLogonReport.ID	Batch Logon Report_v1.2.rdl	Internal
	EventCollectionSummary.ID	Event Collection Report_v1.rdl	Internal
	FailedLoginDetails.ID	Failed Login Details_v1.rdl	Internal
	FailedLoginSummary.ID	Failed Login Summary_v1.rdl	Internal
	FailedLoginSummary24.ID	Failed Login Summary (24 hours)_v1.rdl	Internal
	LanManConnectionReport.ID	LanMan.rdl	Internal
	NTLMv1ConnectionReport.ID	NTLMV1.rdl	Internal
	SMBv1ConnectionReport.ID	SMBv1 Connections Report_v1.rdl	Internal
	WDigestConnectionReport.ID	Wdigest.rdl	Internal

Reports (10)

	DisplayName	ID	Accessibility	Visible
	Alert Summary	Security.Monitoring.AlertSummary	Public	True
	Batch Logon Report	Security.Monitoring.BatchLogonReport	Public	True
	Event Colleciton Summary	Security.Monitoring.EventCollectionSummary	Public	True
	Failed Login Details	Security.Monitoring.FailedLoginDetails	Public	True
	Failed Login Summary	Security.Monitoring.FailedLoginSummary	Public	True
	Failed Login Summary (24 Hours)	Security.Monitoring.FailedLoginSummary24Hours	Public	True
	LanMan Connection Report	Security.Monitoring.LanManConnectionReport	Public	True
	NTLM Version 1 Connection Report	Security.Monitoring.NTLMv1ConnectionReport	Public	True
	SMBv1 Connections Report	Security.Monitoring.SMBv1ConnectionReport	Public	True
	WDigest Connection Report	Security.Monitoring.WDigestConnectionReport	Public	True