After finding which machine locked an AD user with PowerShell, I needed a SIEM/XDR footprint for a cyber-insurance requirement. Wazuh covered Windows EventIDs and Office 365 in one place with custom rules.
Custom rules in local_rules.xml
We monitor Active Directory for:
- Failed logons
- Account lockouts
- Kerberos authentication errors
- Security group changes
- Critical system events (time sync, firewall, etc.)
Failed logon example:
<rule id="100010" level="5">
<if_sid>60123</if_sid>
<field name="eventdata.targetUserName">.+</field>
<description>Failed login attempt on Windows — User: $(eventdata.targetUserName)</description>
</rule>
Example rule for locked user:
<rule id="100020" level="8">
<if_sid>60123</if_sid>
<field name="eventdata.targetUserName">.+</field>
<description>User account locked — User: $(eventdata.targetUserName)</description>
</rule>
Main EventIDs configured
The following Windows EventIDs were added to monitoring:
- 4740 — User account locked
- 4767 — User account unlocked
- 4771 — Kerberos pre-authentication failure (authentication failure)
- 4782 — Password change on user account
- 532 — Logon failure: account expired
- 4616 — System time change (possible log manipulation)
- 5025 — Windows Firewall has stopped unexpectedly
- 4727 / 4735 / 4737 — Security group creation or modification
These EventIDs surface lockouts, Kerberos failures, group changes, and other high-value AD signals in near real time.
Office365 integration
In addition to the Windows layer, we configured Wazuh to receive Office365 logs, detecting:
- Login failures in Exchange, SharePoint and Teams
- Suspicious access from unusual locations
- MFA-related events
This gives a unified view: Windows + Office365 centralized in a single security dashboard.
Closing thoughts
With custom local_rules.xml entries we get:
- Failed AD authentication attempts
- Lockout alerts
- Critical Windows events
- Office 365 coverage in the same SIEM view
All from the same Kibana dashboards — one pane for Windows and cloud identity.
