| S. No | Device Type | Threat Indicators generated |
|---|---|---|
| 1. | Windows OS/Windows AD | Window Defender |
| Host Login Success / Host Login Failure |
| Object Access Status |
| Account Lockout | ||
| Suspicious Service / Process | ||
| Suspicious Process | ||
| Account Created / Enabled | ||
| Account Deleted / Disabled | ||
| Privilege Change | ||
| Network Logout | ||
| Directory Service Status | ||
| System Time | ||
| Group Policy Object | ||
| Password Change / Reset | ||
| 2. | MSSQL | Login Success |
| Login Failure | ||
| Application | ||
| Object Access Status | ||
| 3. | Windows IIS | Web Exploit |
| 4. | Windows DNS |
| Suspicious Domain | ||
| 5. | Windows DHCP | Application |
| 6. | Windows SMTP | Email Info |
| 7. | MS Exchange | Email Info |