| DisplayName | Description | ID | Target | Category | Enabled | Instance Name | Counter Name | Frequency | Event_ID | Event Source | Alert Generate | Alert Severity | Alert Priority | Remotable | Event Log |
| NetLogon Secure Channel Noncompliant Device Rule | This rule alerts on NetLogon vulnerable connection events (ID 5829) in the System eventlog on Domain Controllers | OpsLogix.NetLogon.RPC.NonCompliantDeviceEvents.Alert.Rule | OpsLogix.NetLogon.RPC.DomainController.Class | Custom | False | | | 0 | 5829 | Netlogon | True | Warning | Normal | True | System |
| Collect Noncompliant Device NetLogon Events | This rule collects NetLogon vulnerable connection events (ID 5829) from the System eventlog on Domain Controllers | OpsLogix.NetLogon.RPC.NonCompliantDeviceEvents.Collection.Rule | OpsLogix.NetLogon.RPC.DomainController.Class | EventCollection | False | | | 0 | 0 | | False | | | True | |
| NetLogon Secure Channel Rejected Device Rule | This rule alerts on NetLogon rejected connection events (ID 5827 or 5828) in the System eventlog on Domain Controllers | OpsLogix.NetLogon.RPC.RejectedDeviceEvents.Alert.Rule | OpsLogix.NetLogon.RPC.DomainController.Class | Custom | False | | | 0 | 0 | Netlogon | True | Error | Normal | True | System |
| Collect Rejected Device NetLogon Events | This rule collects NetLogon rejected connection events (ID 5827 or 5828) from the System eventlog on Domain Controllers | OpsLogix.NetLogon.RPC.RejectedDeviceEvents.Collection.Rule | OpsLogix.NetLogon.RPC.DomainController.Class | EventCollection | False | | | 0 | 0 | | False | | | True | |