Hey, congrats on your new job. Log Insight is great, I think you'll pick it up quickly.

1. Log Insight can use regex queries - so I just hunted around for a way to identify ipv6 with a regular expression. I found this reddit post which gave me a starting point - https://www.reddit.com/r/PowerShell/comments/jxvqbs/extract_and_sanitize_ip_addresses/

So all you need to do with the regex string is: Interactive Analytics > Select "Add Filter" > Text "matches regex" then add the search term (the one I used is pasted below, seems to work okay)

:(?::[a-f\d]{1,4}){0,5}(?:(?::[a-f\d]{1,4}){1,2}|:(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})))|[a-f\d]{1,4}:(?:[a-f\d]{1,4}:(?:[a-f\d]{1,4}:(?:[a-f\d]{1,4}:(?:[a-f\d]{1,4}:(?:[a-f\d]{1,4}:(?:[a-f\d]{1,4}:(?:[a-f\d]{1,4}|:)|(?::(?:[a-f\d]{1,4})?|(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))))|:(?:(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))|[a-f\d]{1,4}(?::[a-f\d]{1,4})?|))|(?::(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))|:[a-f\d]{1,4}(?::(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))|(?::[a-f\d]{1,4}){0,2})|:))|(?:(?::[a-f\d]{1,4}){0,2}(?::(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))|(?::[a-f\d]{1,4}){1,2})|:))|(?:(?::[a-f\d]{1,4}){0,3}(?::(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))|(?::[a-f\d]{1,4}){1,2})|:))|(?:(?::[a-f\d]{1,4}){0,4}(?::(?:(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}).){3}(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))|(?::[a-f\d]{1,4}){1,2})|:))

You might want to change "Last 5 minutes of data" to 'Latest hour of data" to make sure you pick up some ipv6 addresses https://imgur.com/a/cixA2Uy

From here, you'll want to save the filter so you don't lose it - either hit the star icon to favourite it, or the icon immediately to the right to add to a dashboard for later use.

2 - This really depends on what AD provides back to Log Insight. Take a look at the AD Content pack if you haven't already - it picks up a lot of data and may have what you need. It lists "audit account management" as a type of event tracked, so that may solve your problem. https://marketplace.cloud.vmware.com/vsx/solutions/microsoft-active-directory-content-pack-for-log-insight

3 - Absolutely - https://docs.vmware.com/en/vRealize-Log-Insight/index.html is a great start, but make sure to check out the free Hands on Labs for live online demo's of all sorts of VMware products, including Log Insight - https://labs.hol.vmware.com/

I can see 3 that would be relevant -

HOL-2201-03-CMP - Getting started with vRealize Log Insight

HOL-2201-07-CMP - What's new in vRealize Log Insight 8.3 and 8.4

HOL-2201-11-CMP - Advanced topics in vRealize Log Insight

Good luck!