( subtype eq crypto ) and ( severity eq critical )

( eventid eq private-key-export ) and ( description contains 'Private key nameofcert was exported by user admin' )

( eventid eq cert-expiry ) and ( description contains 'Shared certificate nameofcert and corresponding key have expired' )