AD FS Messages

Classification

Rule Name	Rule Type	Common Event	Classification
AD FS Messages	Base Rule	General Active Directory Information	Information
EVID 516 : Account Locked - Too Many Attempts	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
EVID 1200 : Federation Service Issued Valid Token	Sub Rule	Token Modified	Other Audit Success
EVID 1201 : Federation Service Failed IssuingToken	Sub Rule	Token Error	Error
EVID 1202 : Federation Service ValidatedCredential	Sub Rule	Accounts Validated	Other Audit Success
EVID 1203 : Federation Service Failed Credentials	Sub Rule	Request Failed To Validate	Warning
EVID 1206 : Signout Request Successfully Processed	Sub Rule	Logoff	Other Audit Success
EVID 1210 : Extranet Lockout Event Occurred	Sub Rule	Authentication Failure Activity	Authentication Failure
EVID 512 : Account Locked - Bad Password Attempt	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
EVID 431 : Request Received	Sub Rule	Request Received	Other Audit Success
EVID 515 : Suspicious Authentication Activity	Sub Rule	Authentication Activity	Authentication Success