spl Enterprise Security Query to see incidents logged by correlation search in ES incident review dashboard
spl WinEventLog:Security Accounts Deleted via EventID's that Correspond with Post XP/2003 Operating Systems
spl opensense Networking Blocked Firewall Scanning Activity with indicator if Source has been allowed.
