For log analysis OSSEC has a few files with MS specific rules designed to extract interesting security events. To see individual rules one can peruse these files:
[/var/ossec/rules]# ls -l ms*
-r-xr-x--- 1 root ossec 31423 Sep 7 2010 msauth_rules.xml
-r-xr-x--- 1 root ossec 11978 Sep 7 2010 ms_dhcp_rules.xml
-r-xr-x--- 1 root ossec 1547 Sep 7 2010 ms-exchange_rules.xml
-r-xr-x--- 1 root ossec 2077 Sep 7 2010 ms_ftpd_rules.xml
-r-xr-x--- 1 root ossec 2190 Sep 7 2010 ms-se_rules.xml
For the latest copy of these rules files you can head over to bitbucket -> https://bitbucket.org/dcid/ossec-hids
(under Source -> ossec-hids / etc / rules /)