All documentation can be found at the following page:
https://nathangau.wordpress.com/2017/05/01/introducing-the-security-monitoring-management-pack-for-scom/
| DisplayName | ID | Base Class | Abstract | Hosted | Singleton | Group | Extension | Accessibility | |
|---|---|---|---|---|---|---|---|---|---|
 | Security Monitoring: Administrative Accouts Class | Security.Monitoring.AdminAccounts | Microsoft.Windows.ApplicationComponent | False | False | False | False | False | Internal |
 | Security Monitoring Configuration | Security.Monitoring.SecurityMonitoringDA | Microsoft.SystemCenter.ServiceDesigner.Service | False | False | False | False | False | Public |
 | Security Monitoring Configuration Domain Controllers | Security.Monitoring.SecurityMonitoringDA.DomainControllers | Microsoft.SystemCenter.ServiceDesigner.ServiceComponentGroup | False | False | False | False | False | Public |
| Security Monitoring Configuration Member Servers | Security.Monitoring.SecurityMonitoringDA.MemberServers | Microsoft.SystemCenter.ServiceDesigner.ServiceComponentGroup | False | False | False | False | False | Public |
 | Security Monitoring: Extended Writeable Directory Monitoring Group | Security.Monitoring.WindowsComputersExtendedWriteableDirectoryMonitoring | Microsoft.SystemCenter.ComputerGroup | False | False | True | True | False | Public |
 | Security Monitoring: OS User Writeable Locations | Security.Monitoring.WriteableLocations | Microsoft.Windows.LocalApplication | False | True | False | False | False | Internal |
 | Security Monitoring: User Writeable Directories Seed Class | Security.Monitoring.WriteableLocationsSeedClass | Microsoft.Windows.Server.Computer | False | False | False | False | False | Internal |
| DisplayName | ID | Source | Target | Accessibility | Abstract | |
|---|---|---|---|---|---|---|
 | Security Monitoring DA Relationships | Security.Monitoring.SecurityMonitoringDARelationships | Security.Monitoring.SecurityMonitoringDA | Security.Monitoring.SecurityMonitoringDA.DomainControllers | Internal | False |
| Security Monitoring DA Relationship for Domain Controller Class | Security.Monitoring.SecurityMonitoringDARelationshipsForDCs | Security.Monitoring.SecurityMonitoringDA.DomainControllers | Microsoft.Windows.Server.DC.Computer | Internal | False |
| Security Monitoring DA Relationships for Member Servers | Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers | Security.Monitoring.SecurityMonitoringDA.MemberServers | Microsoft.Windows.Computer | Internal | False |
| Security Monitoring DA Relationship for OS Class | Security.Monitoring.SecurityMonitoringDARelationshipsforMS | Security.Monitoring.SecurityMonitoringDA | Security.Monitoring.SecurityMonitoringDA.MemberServers | Internal | False |
| DisplayName | ID | Isolation | Accessibility | |
|---|---|---|---|---|
 | GPO Change Event then run correlation script DS | SecurityMonitoringMP.GPOMonitoring.Event.DS | Any | Public |
| Security.Monitoring.AuditPol.DS | Security.Monitoring.AuditPol.DS | Any | Public |
| Security.Monitoring.DistributedApplication.DataSource | Security.Monitoring.DistributedApplication.DataSource | Any | Public |
| Security.Monitoring.DistributedApplicationMS.DataSource | Security.Monitoring.DistributedApplicationMS.DataSource | Any | Public |
| Security.Monitoring.MultiStringRegistry.DS | Security.Monitoring.MultiStringRegistry.DS | Any | Internal |
| Security.Monitoring.SMBv1Connections.DS | Security.Monitoring.SMBv1Connections.DS | Any | Internal |
| SecurityMonitoring.Event.RepeatedFailedLogind.DS | SecurityMonitoring.Event.RepeatedFailedLogind.DS | Any | Public |
| SecurityMonitoringMP.4688CommandAudit.DS | SecurityMonitoringMP.4688CommandAudit.DS | Any | Internal |
| SecurityMonitoringMP.DCServiceCreation.DS | SecurityMonitoringMP.DCServiceCreation.DS | Any | Public |
| SecurityMonitoringMP.Discoveries.DiscoverWriteableFileLocations | SecurityMonitoringMP.Discoveries.DiscoverWriteableFileLocations | Any | Public |
| SecurityMonitoringMP.GPOMonitoring.GPOEvent.DS | SecurityMonitoringMP.GPOMonitoring.GPOEvent.DS | Any | Public |
| SecurityMonitoringMP.LocalAccountChange.DS | SecurityMonitoringMP.LocalAccountChange.DS | Any | Public |
| SecurityMonitoringMP.Modules.SecurityLogClear.DS | SecurityMonitoringMP.Modules.SecurityLogClear.DS | Any | Public |
| SecurityMonitoringMP.Modules.SystemLogClear.DS | SecurityMonitoringMP.Modules.SystemLogClear.DS | Any | Public |
| SecurityMonitoringMP.ScheduledTaskCreation.DS | SecurityMonitoringMP.ScheduledTaskCreation.DS | Any | Public |
| SecurityMonitoringMP.SuspiciousUserContext.DS | SecurityMonitoringMP.SuspiciousUserContext.DS | Any | Internal |
| SecurityMonitoringMP.WriteableDirectories.DS | SecurityMonitoringMP.WriteableDirectories.DS | Any | Internal |
| SecurityMonitoringMP.WriteableDirectoriesExtended.DS | SecurityMonitoringMP.WriteableDirectoriesExtended.DS | Any | Internal |
| ID | Isolation | Accessibility | |
|---|---|---|---|
 | Security.Monitoring.AuditPol.PowerShell | Any | Internal |
| Security.Monitoring.MultiStringRegistry.PowerShell | Any | Internal |
| Security.Monitoring.SMBv1Connections.PowerShell | Any | Internal |
| SecurityMonitoringMP.GPOMonitoring.ProbeActionModule.GPOCorrelationScript | Any | Public |
| DisplayName | ID | Accessibility | Support Monitor Recalculate | |
|---|---|---|---|---|
 | Check Existence of RegKey Monitor Type | SecurityMonitoringMP.RegValueExistsMonitorType | Internal | False |
| Check value of registry key | SecurityMonitoringMP.RegValueMonitorType | Internal | False |
| CheckRegValue | CheckRegValue | Internal | False |
| CheckRegValueString | CheckRegValueString | Internal | False |
| MultiStringRegMonitorType | MultiStringRegMonitorType | Internal | False |
| Security.Monitoring.AuditPolMonitorType | Security.Monitoring.AuditPolMonitorType | Public | False |
| SecurityMonitoringMP.CommandLineAuditSetting | SecurityMonitoringMP.CommandLineAuditSetting | Internal | False |
| DisplayName | ID | Target | Enabled | |
|---|---|---|---|---|
 | Security Monitoring: Discover Admin Accounts | Security.Monitoring.AdminAccountDiscovery | Microsoft.Windows.Computer | False |
| Security Monitoring: Distributed App DC Discovery | Security.Monitoring.DA.DCDiscovery | Microsoft.Windows.Server.DC.Computer | True |
| Security Monitoring: Distributed App MemberServer Discovery | Security.Monitoring.DA.MSDiscovery | Microsoft.Windows.Computer | True |
| Security Monitoring: User Writeable Directories Seed Class | Security.Monitoring.Discoveries.UserWriteableLocationSeed | Microsoft.Windows.Computer | True |
| Security Monitoring: Discover Writeable File Locations | Security.Monitoring.DiscoverWriteableFileLocations | Security.Monitoring.WriteableLocationsSeedClass | True |
| Security Monitoring: Populate Extended Writeable Directory Monitoring Group | Security.Monitoring.PopulateExtendedWriteableDirectoryComputerGroup | Security.Monitoring.WindowsComputersExtendedWriteableDirectoryMonitoring | True |
| DisplayName | ID | Target | Algorithm | Category | Enabled | Alert Generate | Accessibility | |
|---|---|---|---|---|---|---|---|---|
 | Security Monitoring Domain Controller Auditing Settings | Security.Monitoring.DCAuditSettings | Security.Monitoring.SecurityMonitoringDA.DomainControllers | WorstOf | ConfigurationHealth | True | False | Public |
| Security Monitoring Member Server Auditing Settings | Security.Monitoring.MemberServerAuditSettings | Security.Monitoring.SecurityMonitoringDA.MemberServers | WorstOf | AvailabilityHealth | True | False | Public |
| DisplayName | ID | Target | Algorithm | Source Monitor | Relationship | Category | Enabled | Alert Generate | Accessibility | |
|---|---|---|---|---|---|---|---|---|---|---|
 | Security Monitoring: Logon/Logoff Setting on Domain Controllers | Security.Monitoring.AccountLogonForDC | Security.Monitoring.SecurityMonitoringDA.DomainControllers | WorstOf | Security.Monitoring.AuditAccountLogonDC | Security.Monitoring.SecurityMonitoringDARelationshipsForDCs | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Logon/Logoff Setting on Member Serverss | Security.Monitoring.AccountLogonForMS | Security.Monitoring.SecurityMonitoringDA.MemberServers | WorstOf | Security.Monitoring.AuditAccountLogonMS | Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Process Auditing Setting on Domain Controllers | Security.Monitoring.DCConfigGroupRollup | Security.Monitoring.SecurityMonitoringDA.DomainControllers | WorstOf | Security.Monitoring.SecurityAudit.ProcessCreationDC | Security.Monitoring.SecurityMonitoringDARelationshipsForDCs | ConfigurationHealth | True | False | Public |
| Security Monitoring: Directory Service Changes Setting on Domain Controllers | Security.Monitoring.DCDirectoryServicesAudit | Security.Monitoring.SecurityMonitoringDA.DomainControllers | WorstOf | Security.Monitoring.DirectoryServiceChangeAuditing | Security.Monitoring.SecurityMonitoringDARelationshipsForDCs | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Include Command Line in Audit Process Set on DC | Security.Monitoring.IncludeCommandLineonDCs | Security.Monitoring.SecurityMonitoringDA.DomainControllers | WorstOf | Security.Monitoring.IncludeCommandLineProcessCreationonDCs | Security.Monitoring.SecurityMonitoringDARelationshipsForDCs | ConfigurationHealth | True | False | Internal |
| Security Monitoring: Include Command Line in Audit Process Set on Member Servers | Security.Monitoring.IncludeCommandLineonMS | Security.Monitoring.SecurityMonitoringDA.MemberServers | WorstOf | Security.Monitoring.IncludeCommandLineProcessCreationonMS | Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers | ConfigurationHealth | True | False | Internal |
| Security Monitoring: Process Auditing Setting on Member Servers | Security.Monitoring.MemberServerProcessCreation | Security.Monitoring.SecurityMonitoringDA.MemberServers | WorstOf | Security.Monitoring.ProcessCreationMemberServer | Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Security Group Management Audit Setting on Domain Controllers | Security.Monitoring.SecurityGroupManagementforDC | Security.Monitoring.SecurityMonitoringDA.DomainControllers | WorstOf | Security.Monitoring.SGManagementDC | Security.Monitoring.SecurityMonitoringDARelationshipsForDCs | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Special Group Logon Setting on Domain Controllers | Security.Monitoring.SpecialGroupLogonDC | Security.Monitoring.SecurityMonitoringDA.DomainControllers | WorstOf | Security.Monitoring.SpecialGroupLogonAuditingEnabledonDC | Security.Monitoring.SecurityMonitoringDARelationshipsForDCs | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Special Group Logon Setting on Member Servers | Security.Monitoring.SpecialGroupLogonMS | Security.Monitoring.SecurityMonitoringDA.MemberServers | WorstOf | Security.Monitoring.SpecialGroupLogonEnabledOnMemberServers | Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers | AvailabilityHealth | True | False | Internal |
| Security Monitoring: User Account Management Audit Setting on Member Servers | Security.Monitoring.UserAcctforMS | Security.Monitoring.SecurityMonitoringDA.MemberServers | WorstOf | Security.Monitoring.UserAccountMgmtMS | Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers | AvailabilityHealth | True | False | Internal |
| DisplayName | ID | Target | Category | Enabled | Alert Generate | Accessibility | |
|---|---|---|---|---|---|---|---|
 | Security Monitoring: Account Logon Monitoring not Set on DCs | Security.Monitoring.AuditAccountLogonDC | Microsoft.Windows.Server.DC.Computer | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Account Logon Monitoring not Set on Member Servers | Security.Monitoring.AuditAccountLogonMS | Microsoft.Windows.Computer | AvailabilityHealth | False | False | Internal |
| Security Monitoring: Directory Service Change Monitoring not Set on DCs | Security.Monitoring.DirectoryServiceChangeAuditing | Microsoft.Windows.Server.DC.Computer | ConfigurationHealth | True | False | Internal |
| Security Monitoring: Include Command Line for Process Auditing Setting on DCs | Security.Monitoring.IncludeCommandLineProcessCreationonDCs | Microsoft.Windows.Server.DC.Computer | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Include Command Line for Process Auditing Setting on Member Servers | Security.Monitoring.IncludeCommandLineProcessCreationonMS | Microsoft.Windows.Computer | AvailabilityHealth | False | False | Internal |
| Security Monitoring: Check Authentication Packages Registry Key | Security.Monitoring.Monitors.AuthenticationPackages | Microsoft.Windows.Server.OperatingSystem | AvailabilityHealth | True | True | Internal |
| Security Monitoring: Process Creation Setting for Member Servers | Security.Monitoring.ProcessCreationMemberServer | Microsoft.Windows.Computer | AvailabilityHealth | False | False | Public |
| Security Monitoring: Audit Process Creation Set on DC | Security.Monitoring.SecurityAudit.ProcessCreationDC | Microsoft.Windows.Server.DC.Computer | ConfigurationHealth | True | False | Public |
| Security Monitoring: Security Group Management Audit not Set on DCs | Security.Monitoring.SGManagementDC | Microsoft.Windows.Server.DC.Computer | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Domain Controller Special Group Logon | Security.Monitoring.SpecialGroupLogonAuditingEnabledonDC | Microsoft.Windows.Server.DC.Computer | AvailabilityHealth | True | False | Internal |
| Security Monitoring: Member Server Special Group Logon | Security.Monitoring.SpecialGroupLogonEnabledOnMemberServers | Microsoft.Windows.Computer | AvailabilityHealth | False | False | Internal |
| Security Monitoring: User Account Management Audit Setting not Set on Member Servers | Security.Monitoring.UserAccountMgmtMS | Microsoft.Windows.Computer | AvailabilityHealth | False | False | Internal |
| Security Monitoring: Repeated RDP Logon Failures | SecurityMonitoringMP.Event.RepeatedLogonMonitor | Microsoft.Windows.Server.OperatingSystem | Custom | True | False | Public |
| A System - Is Pending Restart | SecurityMonitoringMP.Event.SystemPendingRestart | Microsoft.Windows.Server.OperatingSystem | Custom | False | True | Public |
| Security Monitoring: Event Log Collector Service is stopped | SecurityMonitoringMP.Health.EventCollectorMonitor | WindowsEventCollectorDiscovery.EventLogCollectorServer | Custom | True | True | Public |
| Security Monitoring: UseLogonCredential key does not exist | SecurityMonitoringMP.UseLogonCredentialExistsMonitor | Microsoft.Windows.Server.OperatingSystem | Custom | False | True | Internal |
| Security Monitoring: Wdigest passwords stored in clear text | SecurityMonitoringMP.WDigestRegConfiguredMonitor | Microsoft.Windows.Server.OperatingSystem | Custom | True | True | Internal |
| DisplayName | ID | Target | Category | Enabled | Alert Generate | |
|---|---|---|---|---|---|---|
 | Security Monitoring: Collect SMBv1 Connections | Security.Monitoring.Collect.SMBv1Connections | Microsoft.Windows.Server.OperatingSystem | None | True | False |
| Security Monitoring: Collect LAPS Events | Security.Monitoring.CollectionRule.CollectLAPSEvents | Microsoft.Windows.Server.OperatingSystem | EventCollection | True | False |
| Security Monitoring: Collect Legacy TLS Events | Security.Monitoring.CollectLegacyTLSEvents | Microsoft.Windows.Server.OperatingSystem | EventCollection | True | False |
| Security Monitoring: Possible Crypto-Ransomware Installed on Computer | Security.Monitoring.Event.4688.GenericCryptoRansomWare | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: PowerShell script run natively to bypass existing execution policy | Security.Monitoring.Event.ByPassExecutionPolicy | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: PowerShell used to Invoke an Encoded Command | Security.Monitoring.Event.InvokeEncodedCommand | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: PowerShell used to Invoke a Remote Expression | Security.Monitoring.Event.InvokeRemoteExpression | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: An attempt was made to kill Windows Defender | Security.Monitoring.Event.KillWindowsDefender | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: PowerShell Running Only in Memory | Security.Monitoring.Event.PowerShellRuninMemoryOnly | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: RegSvr32 used to load a DLL that is not located on this machine | Security.Monitoring.Event.RemoteRegSvr32 | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: SeDebugPrivilege Escalation Detected | Security.Monitoring.Event.SeDebugPrivilegeEscalation | Microsoft.Windows.OperatingSystem | Alert | False | True |
| Security Monitoring: Possible WMI Persistence Event Detected | Security.Monitoring.Event.WMIPersistence | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Possible WMI Remote Attempt Made To this System | Security.Monitoring.Event.WMIRemote.Destination | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Possible WMI Remote Attempt Made From this System | Security.Monitoring.Event.WMIRemote.Source | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Collect LANMAN Authentication | Security.Monitoring.EventCollection.LanMan | Microsoft.Windows.Server.OperatingSystem | EventCollection | True | False |
| Security Monitoring: Collect NTLMV1 Events | Security.Monitoring.EventCollection.NTLMV1 | Microsoft.Windows.Server.OperatingSystem | EventCollection | True | False |
| Security Monitoring: Collect WDigest Authentication Events | Security.Monitoring.EventCollection.WdigestAuthentication | Microsoft.Windows.Server.DC.Computer | EventCollection | True | False |
| Security Monitoring: Executable Run from User Writeable Windows Directory | Security.Monitoring.ExecutableRunFromUserWriteableDirectory | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Executable Run from User Writeable Windows Directory Extended | Security.Monitoring.ExecutableRuninWriteableDirectoriesExtended | Security.Monitoring.WriteableLocations | Alert | True | True |
| Security Monitoring Forwarded Events: Possible Crypto-Ransomware Installed on Computer | Security.Monitoring.ForwardedEvents.4688.GenericCryptoRansomWare | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: PowerShell script run natively to bypass existing execution policy | Security.Monitoring.ForwardedEvents.ByPassExecutionPolicy | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Collect LAPS Events | Security.Monitoring.ForwardedEvents.CollectLAPSEvents | WindowsEventCollectorDiscovery.EventLogCollectorServer | EventCollection | True | False |
| Security Monitoring Forwarded Events: SeDebug Privilege Escalation Detected | Security.Monitoring.ForwardedEvents.DebugEscalation | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Executable Run from User Writeable Windows Directory | Security.Monitoring.ForwardedEvents.ExecutableRunFromUserWriteableDirectory | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Secuity Monitoring Forwarded Events: PowerSploit FindAV Signature Tool is in Use | Security.Monitoring.ForwardedEvents.FindAVSignature | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring ForwardedEvents: Powersploit Get DLL Load Path is in Use | Security.Monitoring.ForwardedEvents.GetDLLLoadPath | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: PowerSploit HTTP Path Discovery Tool is in Use | Security.Monitoring.ForwardedEvents.GetHTTPStatus | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: PowerSploit Key Stroke Logger in Use | Security.Monitoring.ForwardedEvents.GetKeystroke | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: PowerSploit Invoke DLL Injection Command in Use | Security.Monitoring.ForwardedEvents.InvokeDLLInjection | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: PowerShell used to Invoke an Encoded Command | Security.Monitoring.ForwardedEvents.InvokeEncodedCommand | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Invoke-Mimikatz Detected in Tier 0 Environment | Security.Monitoring.ForwardedEvents.InvokeMimikatz | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Invoke Ninja Copy is in Use | Security.Monitoring.ForwardedEvents.InvokeNinjaCopy | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Invoke Portscan is in Use | Security.Monitoring.ForwardedEvents.InvokePortScan | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: PowerShell used to Invoke a Remote Expression | Security.Monitoring.ForwardedEvents.InvokeRemoteExpression | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring: Invoke ShellCode is in Use | Security.Monitoring.ForwardedEvents.InvokeShellCodeInUse | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: An attempt was made to kill Windows Defender | Security.Monitoring.ForwardedEvents.KillWindowsDefender | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: PowerShell Running Only in Memory | Security.Monitoring.ForwardedEvents.PowerShellRuninMemoryOnly | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Hidden Process Starting Using PowerShell | Security.Monitoring.ForwardedEvents.PowerShellStartHiddenProcess | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: RegSvr32 used to load a DLL that is not located on this machine | Security.Monitoring.ForwardedEvents.RemoteRegSvr32 | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Secuity Monitoring: PowerSploit FindAV Signature Tool is in Use | Security.Monitoring.PowerShellLog.FindAVSignature | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Powersploit Get DLL Load Path is in Use | Security.Monitoring.PowerShellLog.GetDLLLoadPath | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: PowerSploit HTTP Path Discovery Tool is in Use | Security.Monitoring.PowerShellLog.GetHTTPStatus | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: PowerSploit Key Stroke Logger in Use | Security.Monitoring.PowerShellLog.GetKeystroke | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: PowerSploit Invoke DLL Injection Command in Use | Security.Monitoring.PowerShellLog.InvokeDLLInjection | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Invoke-Mimikatz is in Use. | Security.Monitoring.PowerShellLog.InvokeMimikatzInUse | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Invoke Ninja Copy is in Use | Security.Monitoring.PowerShellLog.InvokeNinjaCopy | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Invoke Portscan is in Use | Security.Monitoring.PowerShellLog.InvokePortScan | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Invoke ShellCode in Use | Security.Monitoring.PowerShellLog.InvokeShellCodeInUse | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Hidden Process Starting Using PowerShell | Security.Monitoring.PowerShellLog.PowerShellStartHiddenProcess | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Security Event Log was Cleared. | Security.Monitoring.SecurityLogClearedv2 | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Modification has been made to the DC OU | Security.Monitoring.SecurityMonitoring.Event.DCOUModify | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: A GPO was Created | Security.Monitoring.SecurityMonitoring.Event.GPOCreation | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: A GPO was Deleted | Security.Monitoring.SecurityMonitoring.Event.GPODeletionRule | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: A Scheduled Task Was Created On Server | Security.Monitoring.SecurityMonitoring.Event.ScheduledTaskCreatedOnServer | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: A service was Created on a Domain Controller | Security.Monitoring.SecurityMonitoring.Event.ServiceCreatedonDC | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| New Alert Rule | Security.Monitoring.SuspiciousUserContext | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: System Event Log was Cleared. | Security.Monitoring.SystemLogClearedv2 | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Failed RDP Logon | SecurityMonitoring.Event.FailedLogin | Microsoft.Windows.Server.OperatingSystem | Custom | False | True |
| Collect Failed Login Attemts | SecurityMonitoring.Failed.Login.Attempts.Collection | Microsoft.Windows.Computer | EventCollection | True | False |
| Security Monitoring: Domain Admins membership has changed | SecurityMonitoringMP.Accounts.DomainAdminChange | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: Enterprise Admins membership has changed | SecurityMonitoringMP.Accounts.EnterpriseAdminChange | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: Local Administrators Group was Modified | SecurityMonitoringMP.Accounts.LocalAdminChange | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Schema Admins membership has changed | SecurityMonitoringMP.Accounts.SchemaAdminChange | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: Mimikatz in use | SecurityMonitoringMP.APPLocker.Mimikatz | Microsoft.Windows.Computer | Alert | False | True |
| Security Monitoring: Prohibited App in Use | SecurityMonitoringMP.APPLocker.ProhibitedApp | Microsoft.Windows.Computer | Alert | True | True |
| Security Monitoring: PSEXEC in Use | SecurityMonitoringMP.APPLocker.PSExec | Microsoft.Windows.Computer | Alert | False | True |
| Security Monitoring: WCE in Use | SecurityMonitoringMP.APPLocker.WCE | Microsoft.Windows.Computer | Alert | False | True |
| Security Monitoring: WinRar in use | SecurityMonitoringMP.APPLocker.WinRar | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: A suspicious process creation (AppLocker bypass) was executed | SecurityMonitoringMP.Event.4688.SuspiciousApplockerJava | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: A suspicious process creation (AppLocker bypass using regsvr32) was execuited | SecurityMonitoringMP.Event.4688.SuspiciousApplockerRegsvr | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: A suspicious process creation (cmd) was executed | SecurityMonitoringMP.Event.4688.SuspiciousCMD | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: A suspicious process creation (FTP script execution via echo command) was executed | SecurityMonitoringMP.Event.4688.SuspiciousFTPCommand | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: A suspicious process creation (registry) was executed | SecurityMonitoringMP.Event.4688.SuspiciousReg | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring; A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed | SecurityMonitoringMP.Event.4688.SuspiciousWindowsPosition | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Possible Golden Ticket in Use | SecurityMonitoringMP.Event.GoldenTicketDetection | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: Local account created on a member server | SecurityMonitoringMP.Event.LocalAccountCreatedonServer | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Security Log was cleared | SecurityMonitoringMP.Event.SecurityLogCleared | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: A service was created on a member server | SecurityMonitoringMP.Event.ServiceCreatedonMemberServer | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: Service associated with a known threat was created on a member server | SecurityMonitoringMP.Event.ServiceKnownThreat | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: A Smart Card has been Disabled to Allow for Interactive Logon | SecurityMonitoringMP.Event.SmartCardDisabled | Microsoft.Windows.Server.DC.Computer | Alert | True | True |
| Security Monitoring: Software was Installed on a Server | SecurityMonitoringMP.Event.SoftwareInstallOnServer | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: Software was Removed from a Server | SecurityMonitoringMP.Event.SoftwareRemovedFromServer | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: The system Log was cleared | SecurityMonitoringMP.Event.SystemLogCleared | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: A system has been powered off | SecurityMonitoringMP.Event.SystemPoweredOff | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: A system was restarted | SecurityMonitoringMP.Event.SystemRestarted | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring: Unexpected System Shutdown | SecurityMonitoringMP.Event.UnexpectedShutdown | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring Collection: Event ID 4672 | SecurityMonitoringMP.EventCollection.4672 | Microsoft.Windows.Server.OperatingSystem | EventCollection | False | False |
| Security Monitoring Collection: Event ID 4624 Logon Type 4 | SecurityMonitoringMP.EventCollection.BatchLogon | Microsoft.Windows.Server.OperatingSystem | EventCollection | True | False |
| Security Monitoring Event Collection: Event ID 4769 result 0x1F | SecurityMonitoringMP.EventCollection.GoldenTicket | Microsoft.Windows.Server.DC.Computer | EventCollection | True | False |
| Security Monitoring Collection: Event ID 4694 | SecurityMonitoringMP.EventCollection.SpecialGroupLogon | Microsoft.Windows.Server.OperatingSystem | EventCollection | True | False |
| Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass) was executed | SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerJava | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass using regsvr32) was execuited | SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerRegsvr | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: A suspicious process creation (cmd) was executed | SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousCMD | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: A suspicious process creation (FTP script execution via echo command) was executed | SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousFTPCommand | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: A suspicious process creation (registry) was executed | SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousReg | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed | SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousWindowsPosition | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Potential Credential Swap in Progress | SecurityMonitoringMP.ForwardedEvents.CredentialSwap | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Local User Created or Deleted in Administrator Security Group | SecurityMonitoringMP.ForwardedEvents.LocalUserCreatedDeleted | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Prohibited App in Use | SecurityMonitoringMP.ForwardedEvents.ProhibitedApp | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Possible PtH Attack in Progress Against Tier 2 | SecurityMonitoringMP.ForwardedEvents.PtHTier2 | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | False | True |
| Security Monitoring Forwarded Events: Security log cleared on a server configured to forward events | SecurityMonitoringMP.ForwardedEvents.SecurityLogCleared | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Service Created on system | SecurityMonitoringMP.ForwardedEvents.ServiceCreation | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | False | True |
| Security Monitoring Forwarded Events: Service associated with a known threat was created on a forwarding computer | SecurityMonitoringMP.ForwardedEvents.ServiceCreationKnownThreats | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: Special Group logon event | SecurityMonitoringMP.ForwardedEvents.SpecialGroupLogon | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| Security Monitoring Forwarded Events: System Log was Cleared | SecurityMonitoringMP.ForwardedEvents.SystemLogCleared | WindowsEventCollectorDiscovery.EventLogCollectorServer | Alert | True | True |
| GPO Change Event then run correlation script Rule | SecurityMonitoringMP.GPOMonitoring.EventAndScript.Rule | Microsoft.Windows.Server.DC.Computer | Custom | True | True |
| Security Monitoring: Potential Credential Swap in Progress | SecurityMonitoringMP.Pth.CredentialSwap | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| Security Monitoring: Possible PtH attack in progress (successful) against DC | SecurityMonitoringMP.Pth.PtHAgainstDC | Microsoft.Windows.Server.DC.Computer | Alert | False | True |
| Security Monitoring: Possible PtH Attack in Progress against tier 1 | SecurityMonitoringMP.Pth.PtHAgainstTier1 | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring Threat Hunting: Batch Logon in use | SecurityMonitoringMP.ThreatHunt.BatchLogonInUse | Microsoft.Windows.Server.OperatingSystem | Alert | False | True |
| Security Monitoring Threat Hunting: Special Group logon event | SecurityMonitoringMP.ThreatHunt.SpecialGroupLogon | Microsoft.Windows.Server.OperatingSystem | Alert | True | True |
| DisplayName | ID | Target | Monitor | Reset Monitor | Category | Enabled | Accessibility | |
|---|---|---|---|---|---|---|---|---|
 | Modify Windows Firewall | SecurityMonitoringMP.Recovery.BlockPortWindowsFW | Microsoft.Windows.Server.OperatingSystem | SecurityMonitoringMP.Event.RepeatedLogonMonitor | False | Custom | false | Public |
| Restart Service | SecurityMonitoringMP.Recovery.RestartWecSVC | WindowsEventCollectorDiscovery.EventLogCollectorServer | SecurityMonitoringMP.Health.EventCollectorMonitor | True | Custom | true | Public |
| DisplayName | ID | Target | Accessibility | Category | Enabled | |
|---|---|---|---|---|---|---|
 | Security Monitoring: Create Registry Key to Discover Writeable Locations | SecurityMonitoring.PowerShell.Task.CreateUserWriteableRegKey | Microsoft.Windows.Computer | Internal | Maintenance | True |
| Security Monitoring: Remove Registry Key to Discover Writeable Locations | SecurityMonitoring.PowerShell.Task.RemoveUserWriteableRegKey | Microsoft.Windows.Computer | Internal | Maintenance | True |
| ID | Context | Target | |
|---|---|---|---|
 | OverrideForMonitorSecurityMonitoringAccountLogonAuditingMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup | Microsoft.SystemCenter.ManagementServerComputersGroup | Security.Monitoring.AuditAccountLogonMS |
| OverrideForMonitorSecurityMonitoringCommandLineAuditingMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup | Microsoft.SystemCenter.ManagementServerComputersGroup | Security.Monitoring.IncludeCommandLineProcessCreationonMS |
| OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012Full | Microsoft.Windows.Server.6.2.Full.OperatingSystem | SecurityMonitoringMP.UseLogonCredentialExistsMonitor |
| OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012OS | Microsoft.Windows.Server.6.2.OperatingSystem | SecurityMonitoringMP.UseLogonCredentialExistsMonitor |
| OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2016 | Microsoft.Windows.Server.10.0.OperatingSystem | SecurityMonitoringMP.UseLogonCredentialExistsMonitor |
| OverrideForMonitorSecurityMonitoringProcessCreationMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup | Microsoft.SystemCenter.ManagementServerComputersGroup | Security.Monitoring.ProcessCreationMemberServer |
| OverrideForMonitorSecurityMonitoringSpecialGroupLogonMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup | Microsoft.SystemCenter.ManagementServerComputersGroup | Security.Monitoring.SpecialGroupLogonEnabledOnMemberServers |
| OverrideForMonitorSecurityMonitoringUserAccountManagementAuditingMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup | Microsoft.SystemCenter.ManagementServerComputersGroup | Security.Monitoring.UserAccountMgmtMS |
| ID | Context | Target | |
|---|---|---|---|
| OverrideForRuleSecurityMonitoringEventSeDebugPrivilegeEscalation | Microsoft.SystemCenter.ManagementServer | Security.Monitoring.Event.SeDebugPrivilegeEscalation |
| OverrideForRuleSecurityMonitoringExecutableRunFromUserWriteableDirectory | Security.Monitoring.WindowsComputersExtendedWriteableDirectoryMonitoring | Security.Monitoring.ExecutableRunFromUserWriteableDirectory |
| OverrideForRuleSecurityMonitoringMPEventLocalAccountCreatedonServer.DomainControllers | Microsoft.Windows.Server.DC.Computer | SecurityMonitoringMP.Event.LocalAccountCreatedonServer |
| OverrideForRuleSecurityMonitoringMPEventLocalAdminChange.DomainControllers | Microsoft.Windows.Server.DC.Computer | SecurityMonitoringMP.Accounts.LocalAdminChange |
| ID | FolderName | ElementID | |
|---|---|---|---|
 | i08b0d1b442c04c8daf4574e19f39c3c9 | SecurityMonitoringMP.Folder.SecurityMonitoring | SecurityMonitoringMP.View.SecurityMonitoringAlerts |
| i23e6b51216814447b3b73c5124fae3d3 | SecurityMonitoringMP.Folder.Administration | SecurityMonitoringMP.View.DCDistributedApp |
| i2465151f071a4563af2090f8f6f734ce | SecurityMonitoringMP.Folder.Administration | SecurityMonitoringMP.View.MemberServerDistributedApp |
| i3691038e88044516a67ac5bbc79422c0 | SecurityMonitoringMP.Folder.EventCollectors | SecurityMonitoringMP.View.EventCollectorState |
| i74a5ba1881174da89a4041962320a070 | SecurityMonitoringMP.Folder.SecurityMonitoring | SecurityMonitoringMP.View.ThreatHuntingAlert |
| ibbd540dc68af4043bfdb9f75cf03ae00 | SecurityMonitoringMP.Folder.SecurityMonitoring | SecurityMonitoringMP.View.OnlineDocumentation |
| if3e38fad5d3547168a4bca954c52cecb | SecurityMonitoringMP.Folder.EventCollectors | SecurityMonitoringMP.View.EventCollectorAlerts |
| if879997c69ee482abc74aca8ebbe4367 | SecurityMonitoringMP.Folder.Administration | SecurityMonitoringMP.View.DADocumentation |
| DisplayName | ID | ParentFolder | Accessibility | |
|---|---|---|---|---|
| Administration | SecurityMonitoringMP.Folder.Administration | SecurityMonitoringMP.Folder.SecurityMonitoring | Public |
| Event Collectors | SecurityMonitoringMP.Folder.EventCollectors | SecurityMonitoringMP.Folder.SecurityMonitoring | Public |
| Security Monitoring | SecurityMonitoringMP.Folder.SecurityMonitoring | Microsoft.SystemCenter.Monitoring.ViewFolder.Root | Public |
| DisplayName | ID | Target | Type | Accessibility | Visible | |
|---|---|---|---|---|---|---|
 | Distributed Application Documentation | SecurityMonitoringMP.View.DADocumentation | System.Entity | Microsoft.SystemCenter.UrlViewType | Public | True |
 | Domain Controller Audit Settings | SecurityMonitoringMP.View.DCDistributedApp | Security.Monitoring.SecurityMonitoringDA.DomainControllers | Microsoft.SystemCenter.StateViewType | Public | True |
 | Event Collector Alerts | SecurityMonitoringMP.View.EventCollectorAlerts | WindowsEventCollectorDiscovery.EventLogCollectorServer | Microsoft.SystemCenter.AlertViewType | Public | True |
| Event Collector State | SecurityMonitoringMP.View.EventCollectorState | WindowsEventCollectorDiscovery.EventLogCollectorServer | Microsoft.SystemCenter.StateViewType | Public | True |
| Member Server Audit Settings | SecurityMonitoringMP.View.MemberServerDistributedApp | Security.Monitoring.SecurityMonitoringDA.MemberServers | Microsoft.SystemCenter.StateViewType | Public | True |
| Online Documentation | SecurityMonitoringMP.View.OnlineDocumentation | System.Entity | Microsoft.SystemCenter.UrlViewType | Public | True |
| Security Monitoring MP Alerts | SecurityMonitoringMP.View.SecurityMonitoringAlerts | System.Entity | Microsoft.SystemCenter.AlertViewType | Public | True |
| Threat Hunting | SecurityMonitoringMP.View.ThreatHuntingAlert | System.Entity | Microsoft.SystemCenter.AlertViewType | Public | True |
| ID | File Name | Accessibility | |
|---|---|---|---|
 | AlertSummary.ID | Alert Summary_v1.rdl | Internal |
| BatchLogonReport.ID | Batch Logon Report_v1.2.rdl | Internal |
| EventCollectionSummary.ID | Event Collection Report_v1.rdl | Internal |
| FailedLoginDetails.ID | Failed Login Details_v1.rdl | Internal |
| FailedLoginSummary.ID | Failed Login Summary_v1.rdl | Internal |
| FailedLoginSummary24.ID | Failed Login Summary (24 hours)_v1.rdl | Internal |
| LanManConnectionReport.ID | LanMan.rdl | Internal |
| LegacyTLSConnectionReport.ID | LegacyTLS.rdl | Internal |
| NTLMv1ConnectionReport.ID | NTLMV1.rdl | Internal |
| SMBv1ConnectionReport.ID | SMBv1 Connections Report_v1.rdl | Internal |
| WDigestConnectionReport.ID | Wdigest.rdl | Internal |
| DisplayName | ID | Accessibility | Visible | |
|---|---|---|---|---|
 | Alert Summary | Security.Monitoring.AlertSummary | Public | True |
| Batch Logon Report | Security.Monitoring.BatchLogonReport | Public | True |
| Event Colleciton Summary | Security.Monitoring.EventCollectionSummary | Public | True |
| Failed Login Details | Security.Monitoring.FailedLoginDetails | Public | True |
| Failed Login Summary | Security.Monitoring.FailedLoginSummary | Public | True |
| Failed Login Summary (24 Hours) | Security.Monitoring.FailedLoginSummary24Hours | Public | True |
| LanMan Connection Report | Security.Monitoring.LanManConnectionReport | Public | True |
| Legacy TLS Protocols Connection Report | Security.Monitoring.LegacyTLSConnectionReport | Public | True |
| NTLM Version 1 Connection Report | Security.Monitoring.NTLMv1ConnectionReport | Public | True |
| SMBv1 Connections Report | Security.Monitoring.SMBv1ConnectionReport | Public | True |
| WDigest Connection Report | Security.Monitoring.WDigestConnectionReport | Public | True |
Home
Show Management Pack References