====== NTP Syslog ======
===== Medium =====
<code>( subtype eq ntpd ) and ( severity eq medium )</code>
<code>( eventid eq auth ) and ( description contains 'NTP sync to server 192.168.1.1 failed, authentication type none' )</code>

===== Informational =====
<code>( subtype eq ntpd ) and ( severity eq informational )</code>
<code>( eventid eq sync ) and ( description contains 'NTP sync to server 192.168.1.1' )</code>
<code>( eventid eq time-learn ) and ( description contains 'NTP time learnt from 192.168.1.1; New time is: Fri Apr 24 16:43:53 BST 2020 and old time was Fri Apr 24 16:43:47 BST 2020' )</code>
<code>( eventid eq restart ) and ( description contains 'NTP restart synchronization performed' )</code>