Just found this nice list of useful event IDs for #AD monitoring: https://github.com/TonyPhipps/SIEM/blob/master/Notable-Event-IDs.md My next step is to figure out how to bring that list with low effort to a data collection rule for #Sentinel integration with the Azure Monitoring Agent. Do you have good sources / lists with Event IDs for AD monitoring or are you ingesting just everything?