( subtype eq ntpd ) and ( severity eq medium )

( eventid eq auth ) and ( description contains 'NTP sync to server 192.168.1.1 failed, authentication type none' )

( subtype eq ntpd ) and ( severity eq informational )

( eventid eq sync ) and ( description contains 'NTP sync to server 192.168.1.1' )

( eventid eq time-learn ) and ( description contains 'NTP time learnt from 192.168.1.1; New time is: Fri Apr 24 16:43:53 BST 2020 and old time was Fri Apr 24 16:43:47 BST 2020' )

( eventid eq restart ) and ( description contains 'NTP restart synchronization performed' )