On Demand Audit provides the following Active Directory Federation Services built in searches:
-
AD FS All claims provider trust events in the past 30 days
- AD FS All relying party trust events in the past 30 days
- AD FS All endpoint events in the past 30 days
-
AD FS All authentication method changes in the past 30 days
-
AD FS All server farm events in the past 30 days
-
AD FS Authentication method registered and unregistered events in the past 30 days
On Demand Audit provides the following Active Directory Database built in search:
On Demand Audit provides the following anomaly activity built in searches:
- All anomaly detected events in the past 30 days
- Unusual increase in AD account lockout events in the past 30 days
- Unusual increase in failed AD change events in the past 30 days
- Unusual increase in failed AD Federation Services sign-ins in the past 30 days
- Unusual increase in failed file access attempts in the past 30 days
- Unusual increase in file deletes in the past 30 days
- Unusual increase in file renames in the past 30 days
- Unusual increase in files shared from OneDrive and SharePoint events in the past 30 days
- Unusual increase in Office 365 activity by guest user events in the past 30 days
- Unusual increase in Office 365 activity by anonymous user events in the past 30
- Unusual increase in permission changes to AD object events in the past 30 days
- Unusual increase in share access permission changes in the past 30 days
- Unusual increase in successful AD Federation Services sign-ins in the past 30 days
- Unusual increase in successful tenant sign-in events in the past 30 days
- Unusual increase in tenant sign-in failure events in the past 30 days
- Unusual increase in Teams guest participant events in the past 30 days
- Unusual increase in successful on-premises sign-ins in the past 30 days
- Unusual increase in failed on-premises sign-ins in the past 30 days
On Demand Audit provides the following Audit Health built in searches:
-
Change Auditor Installation activity changes in the past 30 days
- Change Auditor Installation connectivity events in the past 30 days
-
Change Auditor Installation setting changes in the past 30 days
- Change Auditor Installation upgrade events in the past 30 days
-
Service activity changes in the past 30 days
-
Service auditing enabled or disabled events in the past 30 days
-
SpecterOps BloodHound Enterprise connectivity events in the past 30 days
-
SpecterOps BloodHound Enterprise configuration changes in the past 30 days
-
Subscription expiring events in the past 90 days
