Auditing, Logging & Detection
Active Directory security event IDs: a DC reference
Every AD security event ID worth collecting on domain controllers: logon, Kerberos, NTLM, account, group, directory and AD CS events, with fields to hunt.
Foundation
Guides tagged