AD_DS_Security_Audit.xml

<?xml version="1.0" encoding="UTF-8"?>

<zabbix_export>

    <version>3.4</version>

    <date>2018-09-26T08:47:42Z</date>

    <groups>

        <group>

            <name>My Templates</name>

        </group>

    </groups>

    <templates>

        <template>

            <template>Template AD DS Security Audit</template>

            <name>Template AD DS Security Audit</name>

            <description/>

            <groups>

                <group>

                    <name>My Templates</name>

                </group>

            </groups>

            <applications>

                <application>

                    <name>Security events</name>

                </application>

            </applications>

            <items>

                <item>

                    <name>Windows Security (ID4720)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4720$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4722)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4722$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4723)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4723$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4724)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4724$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4725)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4725$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4726)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4726$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4738)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4738$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4740)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4740$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4741)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4741$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4742)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4742$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4743)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4743$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4767)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4767$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4780)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4780$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

                <item>

                    <name>Windows Security (ID4781)</name>

                    <type>7</type>

                    <snmp_community/>

                    <snmp_oid/>

                    <key>eventlog[Security,,,,^4781$]</key>

                    <delay>5m</delay>

                    <history>1w</history>

                    <trends>0</trends>

                    <status>0</status>

                    <value_type>2</value_type>

                    <allowed_hosts/>

                    <units/>

                    <snmpv3_contextname/>

                    <snmpv3_securityname/>

                    <snmpv3_securitylevel>0</snmpv3_securitylevel>

                    <snmpv3_authprotocol>0</snmpv3_authprotocol>

                    <snmpv3_authpassphrase/>

                    <snmpv3_privprotocol>0</snmpv3_privprotocol>

                    <snmpv3_privpassphrase/>

                    <params/>

                    <ipmi_sensor/>

                    <authtype>0</authtype>

                    <username/>

                    <password/>

                    <publickey/>

                    <privatekey/>

                    <port/>

                    <description/>

                    <inventory_link>0</inventory_link>

                    <applications>

                        <application>

                            <name>Security events</name>

                        </application>

                    </applications>

                    <valuemap/>

                    <logtimefmt/>

                    <preprocessing/>

                    <jmx_endpoint/>

                    <master_item/>

                </item>

            </items>

            <discovery_rules/>

            <httptests/>

            <macros/>

            <templates/>

            <screens/>

        </template>

    </templates>

    <triggers>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4742$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4742$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A computer account was changed.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>0</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4741$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4741$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A computer account was created.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>0</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4743$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4743$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A computer account was deleted.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>0</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4723$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4723$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>An attempt was made to change an account's password.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>0</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4724$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4724$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>An attempt was made to reset an account's password.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>1</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4738$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4738$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A user account was changed.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>1</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4720$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4720$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A user account was created.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>1</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4726$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4726$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A user account was deleted.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>2</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4725$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4725$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A user account was disabled.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>1</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4722$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4722$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A user account was enabled.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>0</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4740$].logseverity(0)}&gt;0 and {Template AD DS Security Audit:eventlog[Security,,,,^4740$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A user account was locked out.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>1</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4767$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4767$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>A user account was unlocked.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>1</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4780$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4780$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>The ACL was set on accounts which are members of administrators groups.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>0</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

        <trigger>

            <expression>{Template AD DS Security Audit:eventlog[Security,,,,^4781$].logseverity(0)}&gt;1 and {Template AD DS Security Audit:eventlog[Security,,,,^4781$].nodata(600)}=0</expression>

            <recovery_mode>0</recovery_mode>

            <recovery_expression/>

            <name>The name of an account was changed.</name>

            <correlation_mode>0</correlation_mode>

            <correlation_tag/>

            <url/>

            <status>0</status>

            <priority>2</priority>

            <description/>

            <type>0</type>

            <manual_close>0</manual_close>

            <dependencies/>

            <tags/>

        </trigger>

    </triggers>

</zabbix_export>