Windows Audit Checker

Assess Windows Security auditing coverage in your Microsoft Sentinel workspace. The workbook highlights two core gaps: (1) important events not being collected due to disabled or insufficient audit subcategories, and (2) noisy over-collection where outcomes/subcategories aren't required or filtering is missing. It also detects duplicate Event ID collection introduced by overlapping Data Collection Rules (DCRs), helping you eliminate redundant ingestion.