As part of our daily audit checks, we currently filter our AD server event viewer for event IDs 4625 and 4740, for the last 24 hours.
We then look at each event and make a tally of the number of failures for each user account the event relates to. Even though have 190 users, it is still a very manual process and I was wondering if there are any tools which will apply a filter to the security events, and then compile a report with the number of these events for each user? We will then raise incidents as appropriate.
I have tried a couple of tools that both seem to just display event viewer the same as the inbuilt Windows program without any extra functionality.
Any suggestions would be greatly appreciated.