spl Enterprise Security Query to see incidents logged by correlation search in ES incident review dashboard
dashboard Dashboards Dashboard to measure Indexes and Sourcetypes, based upon first and last date of events
spl WinEventLog:Security Accounts Deleted via EventID's that Correspond with Post XP/2003 Operating Systems
spl opensense Networking Blocked Firewall Scanning Activity with indicator if Source has been allowed.
