Active Directory Security Best Practices Includes Monitoring for Signs of Compromise
Fun Fact: Most types of network and computer compromises could have been discovered much sooner if the organization had enabled proper event log monitoring using an appropriate server monitoring solution that alerted them to the issue. Without such a software application or not taking the time to configure it correctly, it takes much longer to uncover the compromise if it is ever discovered at all.