High Fidelity LDAP alerting

Anyone have any killer detections they’ve created to monitor suspicious LDAP Activity in their environments? Right now we have created a baseline for what we’ve considered to be normal processes querying LDAP/LDAPS Global LDAP/S and Microsoft ADWS, and then we alert on the anomalies… but nowadays it seems like more and more applications running on Windows are using LDAP. Zoom used to be an exclusion for example, and now they have a use case??? Just wondering what others typically alert …

alert alerting applications blueteamsec detections environments fidelity global high killer ldap ldaps microsoft monitor normal processes running windows