any where event.code == "4662" and
  winlog.event_data.Properties : (

    /* Control Access Rights/Permissions Symbol */

    "*DS-Replication-Get-Changes*",
    "*DS-Replication-Get-Changes-All*",
    "*DS-Replication-Get-Changes-In-Filtered-Set*",

    /* Identifying GUID used in ACE */

    "*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*",
    "*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*",
    "*89e95b76-444d-4c62-991a-0facbeda640c*")

    /* The right to perform an operation controlled by an extended access right. */

    and winlog.event_data.AccessMask : "0x100" and
    not winlog.event_data.SubjectUserName : (
          "*$", "MSOL_*", "OpenDNS_Connector", "adconnect", "SyncADConnect",
          "SyncADConnectCM", "aadsync", "svcAzureADSync", "-"
        )

    /* The Umbrella AD Connector uses the OpenDNS_Connector account to perform replication */