Alert Rules

1. How it works

Alert rules are evaluated in-memory as events arrive. There is no polling; a rule fires within a second of the event being ingested.

An audit event flows in from a Domain Controller, computer, or Microsoft 365 tenant and passes the ingest filter (Settings > Event Filters).
The event is written to the database and simultaneously handed to the Alert Engine.
The engine checks every enabled rule in order:
- Does the event's type match the rule's Event Type?
- Does the event's source (AD or M365) match the rule's Source?
- If a Target Filter is set, does the event's target match the wildcard pattern?
- If an Actor Filter is set, does the event's actor match the wildcard pattern?
- For Threshold rules, has the trigger count been reached inside the window?
If all checks pass, the rule fires: an Alert row is written (visible in Alerts and the bell badge), and an email is sent to the configured recipients.

2. Create a rule

Go to Alerts > Alert Rules.
Click Add Alert Rule.
Fill in the fields (see reference below).
Click Save. The rule is active immediately; the next matching event fires it.

Field reference

Field	Purpose
Rule Name	Free-text label for the rule, shown in the Alert Rules grid and in every alert this rule raises. Pick something you'll recognize in an inbox, e.g. `Domain Admins Changed`.
Event Type	The high-level activity to match. Each Event Type is backed by one or more Windows event IDs and Microsoft 365 operation names (e.g. "User Deleted" matches `4726` from AD and `Delete user` from M365). Pick from the list.
Source	AD, M365, or Both. Restricts the rule to events from that source. Useful when the same Event Type exists in both worlds and you only care about one.
Severity	Info, Warning, Critical. Sets the badge color and email subject prefix. Purely display; does not affect whether the rule fires.
Target Filter	Wildcard pattern applied to the event's target. Leave empty to match any target. See Wildcard patterns below.
Actor Filter	Wildcard pattern applied to the event's actor (who performed the action). Leave empty to match any actor.
Trigger Mode	Immediate (fire on every occurrence) or Threshold (fire when N occurrences happen within M minutes). See Trigger modes below.
Enabled	Off keeps the rule in the list without evaluating it. Handy for pausing an alert temporarily.
Log to database	Writes an Alert row so the fire shows in the Alerts page and the bell badge. Usually on.
Send email notification	Emails the recipients when the rule fires. Requires SMTP or M365 email configured under Settings > Email Server.
Recipients	Comma-separated email addresses. Only shown when Send email notification is checked.

3. Trigger modes

Two ways to decide when a rule fires.

Immediate. Fires on every single matching event. Best for high-impact activity where every occurrence deserves attention. Rule: Domain Admins Changed. Event: any add or remove on the Domain Admins group. Result: one alert per event, no matter how frequent.

Threshold. Fires when the rule sees N or more matches within a rolling M-minute window. Best for behavioral signals where one occurrence is normal but a burst is not. Rule: Password Spray, N=10 failed logons in 5 minutes. Result: no alerts on a typo, one alert on a burst.

Threshold limits

Count: 2 to 1000
Window: 1 to 30 minutes
The window is a rolling look-back: at each new match the engine counts how many matches happened in the last M minutes.
After a threshold fires, the counter resets so you get one alert per burst, not one per event past the threshold.

4. Wildcard patterns

Target Filter and Actor Filter accept simple wildcard patterns with *. Case-insensitive.

Pattern	Matches
(empty)	Anything. The filter is not applied.
`jsmith`	Exactly `jsmith` (exact match, still case-insensitive).
`Admins`	Any value that contains "Admins", matches Domain Admins, Enterprise Admins, Backup Admins.
`svc-*`	Any value that starts with "svc-", matches svc-adaudit, svc-backup, svc-monitor.
`*@contoso.com`	Any value that ends with "@contoso.com", matches every UPN in the contoso.com domain.

Target and Actor come from the event itself. "Target" is what the action was done to (the user who was deleted, the group that was modified). "Actor" is who performed the action.

5. Default rules

AD Audit Pro seeds a starter set of rules on first launch. All are disabled by default except DC Watcher Failed, so nothing fires until you explicitly turn a rule on and add recipients.

Rule	Severity	Source	Enabled by default
User Deleted	Critical	Both	Off
Admin Group Member Added (target `Admin`)	Critical	Both	Off
Domain Admins Changed (target `Domain Admins`)	Critical	AD	Off
MFA Disabled	Critical	M365	Off
User Locked Out	Warning	AD	Off
Account Re-Enabled	Warning	Both	Off
Password Reset by Admin	Warning	Both	Off
Group Deleted	Warning	Both	Off
User Created	Info	Both	Off
MFA Enabled	Info	M365	Off
License Changed	Info	M365	Off
DC Watcher Failed	Critical	AD	On

To use a default rule, edit it, add email recipients (if you want notifications), and flip Enabled on. Delete or edit any default freely, none of them are protected.

6. Manage rules

Enable or disable

Open the rule, toggle Enabled, and Save. Disabled rules stay in the list but never evaluate against incoming events. Handy for pausing without losing configuration.

Edit

Click the edit icon on the rule's row. Every field can be changed except the underlying event mapping (edit means editing the rule, not the Event Type catalog).

Delete

Click the delete icon and confirm. Existing Alert rows created by this rule are not removed; only the rule itself.

Where alerts appear

Alerts page, the full list of fired alerts, sortable and filterable, with an acknowledge action.
Bell badge in the title bar, shows the number of unacknowledged alerts.
Email, if Send email notification was on when the rule fired. Requires Email Server configured under Settings.