Learn how to detect:
  • User and computer account changes
  • Account lockout
  • Group and group membership changes
  • Password change attempts and expired accounts
Learn how to detect:
  • File changes
  • Permission changes
  • File accesses
Learn how to detect:
  • Local account and group changes
  • Scheduled task and service changes
  • Software installations
Learn how to detect:
  • Mailbox Creation / Deletion
  • Mailbox Permission Changes
  • Database Mount / Dismount
Learn how to detect:
  • Files Creation / Deletion / Viewing
  • SharePoint Permission Changes
  • Content Modifications