What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.
You should log everything and analyze anything. People trying to brute your sites and servers. All of these are relevant incidents as they pose a threat.
It's not relevant to say to what is an incident, as every attempt might be a relevant event some time. What is important is to catalog them with different levels. Some threats pose greater danger than others. Some of them might contain a lot of "normal behavior". The thing is that some things only become relevant after analyzing over a longer period of time. You might notice one attacker is doing his best extra hard to get in. You might get a hacked server and then you'd have to be able to go back and look for related security events to learn from the incident.