Failed login attempts, locked accounts, uncategorized website attempts (based off of Websense), outbound compressed file traffic, cleared event logs, specific query alerts, etc. ... View more