Collect Microsoft Windows Event data
This document describes the deployment architecture, installation steps, and required configuration that produce logs supported by the Google Security Operations parser for Windows events. This document also includes information about how the parser maps fields in the original log to Google Security Operations Unified Data Model fields. For an overview of Google Security Operations data ingestion, see Data ingestion to Google Security Operations.
To ingest Windows event logs to Google Security Operations, you can use the BindPlane Agent or Google Cloud built-in ingestion. For more information regarding built-in ingestion, see Ingest Google Cloud data to Google Security Operations.
Information in this document applies to the parser with the WINEVTLOG ingestion label. The ingestion label identifies which parser normalizes raw log data to structured UDM format.
Before you begin
Review the recommended deployment architecture
If your deployment includes a Windows server on Google Cloud, then we recommend that you use Google Cloud built-in ingestion. Otherwise, you can use the BindPlane Agent.
Google Cloud built-in ingestion architecture
If the Windows events have the Provider value Microsoft-Windows-Security-Auditing
, then the WINEVTLOG parser supports Google Cloud built-in ingestion.
Configure Ops Agent to ingest Microsoft Windows Event logs into Google Security Operations
- Deploy a Windows server in Google Cloud.
- Configure an Ops Agent on Windows Server.
- Install the Cloud Logging agent on Windows Server.
- Enable the following export filter in the Google Security Operations instance:
(log_id("winevt.raw") OR log_id("windows_event_log"))
. For more information, see Ingest Google Cloud data to Google Security Operations.
Configure the BindPlane Agent to ingest Microsoft Windows Event logs into Google Security Operations
Collect the Windows Event logs by using the BindPlane Agent. After installation, the BindPlane Agent service appears as the observerIQ
service in the list of Windows services.
Install and configure the Windows servers. For more information about configuring the Windows servers, see Configure Windows server overview.
Install the BindPlane Agent on the collector that is running on a Windows server. For more information about installing the BindPlane Agent, see the BindPlane Agent installation instructions.
Create a configuration file for the BindPlane agent with the following contents.
receivers: windowseventlog/dfsn_serv: channel: Microsoft-Windows-DFSN-Server/Admin raw: true windowseventlog/operational: channel: Microsoft-Windows-Forwarding/Operational raw: true windowseventlog/source0__application: channel: application raw: true windowseventlog/source0__security: channel: security raw: true windowseventlog/source0__system: channel: system raw: true processors: batch: exporters: chronicle/winevtlog: endpoint: https://malachiteingestion-pa.googleapis.com creds: '{ "type": "service_account", "project_id": "malachite-projectname", "private_key_id": `PRIVATE_KEY_ID`, "private_key": `PRIVATE_KEY`, "client_email":"`SERVICE_ACCOUNT_NAME`@malachite-`PROJECT_ID`.iam.gserviceaccount.com", "client_id": `CLIENT_ID`, "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token", "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs", "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/`SERVICSERVICE_ACCOUNT_NAME`%40malachite-`PROJECT_ID`.iam.gserviceaccount.com", "universe_domain": "googleapis.com" }' log_type: 'WINEVTLOG' override_log_type: false raw_log_field: body customer_id: `CUSTOMER_ID` service: pipelines: logs/winevtlog: receivers: - windowseventlog/source0__application - windowseventlog/source0__security - windowseventlog/source0__system - windowseventlog/dfsn_serv - windowseventlog/operational processors: [batch] exporters: [chronicle/winevtlog]
Replace the
PRIVATE_KEY_ID
,PRIVATE_KEY
SERVICSERVICE_ACCOUNT_NAME
,PROJECT_ID
,CLIENT_ID
andCUSTOMER_ID
with the respective values from the service account JSON file which you can download from Google Cloud Platform. For more information about service account keys, see Create and delete service account keys documentation.To start the observerIQ agent service, select Services > Extended > observerIQ Service > start.
NXLog forwarder ingestion deployment architecture
This diagram illustrates the recommended foundational components in a deployment architecture to collect and send Microsoft Windows Event data to Google Security Operations. Compare this information with your environment to be sure these components are installed. Each customer deployment will differ from this representation and may be more complex. The following is required:
- Systems in the deployment architecture are configured with the UTC time zone.
- NXLog is installed on the collector Microsoft Windows server.
- The collector Microsoft Windows server receives logs from servers, endpoints, and domain controllers.
- Microsoft Windows systems in the deployment architecture use.
- Source Initiated Subscriptions to collect events across multiple devices.
- WinRM service is enabled for remote system management.
- NXLog is installed on the collector Window server to forward logs to Google Security Operations forwarder.
Google Security Operations forwarder is installed on the collector Microsoft Windows or Linux server.
Review the supported devices and versions
The Google Security Operations parser supports logs from the following Microsoft Windows server versions. Microsoft Windows server is released with the following editions: Foundation, Essentials, Standard, and Datacenter. The event schema of logs generated by each edition do not differ.
- Microsoft Windows Server 2019
- Microsoft Windows Server 2016
- Microsoft Windows Server 2012
Google Security Operations parser supports logs from Microsoft Windows 10 and higher client systems.
Google Security Operations parser supports logs collected by NXLog Community or Enterprise Edition.
Review the supported log types
The Google Security Operations parser supports the following log types generated by Microsoft Windows systems. For more information about these log types, see the Microsoft Windows Event Log documentation. It supports logs generated with English language text and is not supported with logs generated in non-English languages.
Log Type | Notes |
---|---|
Security | Security audit and event logs. |
Application | Events logged by applications or programs. If the manifest isn't installed locally, application logs will have missing / hex values. |
System | Events logged by Microsoft Windows system components. |
Configure the Microsoft Windows servers, endpoints, and domain controllers
- Install and configure the servers, endpoints, and domain controllers.
- Configure all systems with the UTC time zone.
- Configure devices to forward logs to a collector Microsoft Windows server.
- Configure a Source Initiated Subscription on Microsoft Windows server (Collector). For information, see Setting up a Source Initiated Subscription.
- Enable WinRM on Microsoft Windows servers and clients. For information, see Installation and configuration for Microsoft Windows Remote Management.
Configure the Microsoft Windows collector server
Set up a collector Microsoft Windows server to collect from systems.
- Configure the system with the UTC time zone.
- Install NXLog. Follow the NXLog documentation.
Create a configuration file for NXLog. Use im_msvistalog input module for Microsoft Windows server security channel logs. Replace
<hostname>
and<port>
values with information about the central Microsoft Windows or Linux server. See the NXLog documentation for information about the om_tcp module.define ROOT C:\Program Files (x86)\nxlog define WINEVTLOG_OUTPUT_DESTINATION_ADDRESS <hostname> define WINEVTLOG_OUTPUT_DESTINATION_PORT <port> define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log LogFile %LOGFILE% Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data <Extension _json> Module xm_json </Extension> <Input windows_security_eventlog> Module im_msvistalog <QueryXML> <QueryList> <Query Id="0"> <Select Path="Application">*</Select> <Select Path="System">*</Select> <Select Path="Security">*</Select> </Query> </QueryList> </QueryXML> ReadFromLast False SavePos False </Input> <Output out_chronicle_windevents> Module om_tcp Host %WINEVTLOG_OUTPUT_DESTINATION_ADDRESS% Port %WINEVTLOG_OUTPUT_DESTINATION_PORT% Exec $EventTime = integer($EventTime) / 1000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000; Exec to_json(); </Output> <Route r2> Path windows_security_eventlog => out_chronicle_windevents </Route>
Start the NXLog service.
Configure the central Microsoft Windows or Linux server
See the Installing and configuring the forwarder on Linux or Installing and configuring the forwarder on Microsoft Windows for information about installing and configuring the forwarder.
- Configure the system with the UTC time zone.
- Install the Google Security Operations forwarder on the central Microsoft Windows or Linux server.
Configure the Google Security Operations forwarder to send logs to Google Security Operations. Here is an example forwarder configuration.
- syslog: common: enabled: true data_type: WINEVTLOG batch_n_seconds: 10 batch_n_bytes: 1048576 tcp_address: 0.0.0.0:10518 connection_timeout_sec: 60
Field mapping reference: Common device event fields to UDM fields
The following fields are common across multiple Event IDs and are mapped the same way.
NXLog field | UDM field | |
---|---|---|
EventTime |
metadata.event_timestamp |
|
Hostname |
principal.hostname |
principal.asset.hostname |
EventID |
product_event_type is set to "%{EventID}"security_result.rule_name is set to "EventID: %{EventID}" |
|
SourceName |
metadata.product_name is set to "%25%7BSourceName}"metadata.vendor_name is set to "Microsoft" |
|
|
|
|
|
|
|
Severity |
Values mapped to security_result.severity field as follows:Original value 0 (None), is set to UNKNOWN_SEVERITY Original value 1 (Critical) is set to INFORMATIONAL Original value 2 (Error) is set to ERROR Original value 3 (Warning) is set to ERROR Original value 4 (Informational) is set to INFORMATIONAL Original value 5 (Verbose) is set to INFORMATIONAL |
|
UserID |
principal.user.windows_sid |
|
ExecutionProcessID |
principal.process.pid |
|
ProcessID |
principal.process.pid |
|
ProviderGuid |
metadata.product_deployment_id |
|
RecordNumber |
metadata.product_log_id |
|
SourceModuleName |
|
|
SourceModuleType |
observer.application |
|
|
|
|
|
|
|
ActivityID |
security_result.detection_fields.key/value |
Field mapping reference: device event field to UDM field by EventID
The following section describes how NXlog/EventViewer fields are mapped to UDM fields. Data may be mapped differently for different Microsoft Windows Event IDs.
The section heading identifies the Event Id, plus version (e.g. version 0) and operatiing system (e.g. Microsoft Windows 10 client) if applicable. There may be more than one section for an Event ID when the map for a specific version or operating system is different.
Event ID 0
Provider: Directory Synchronization
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Provider: gupdate
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: hcmon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: edgeupdate
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1
Provider: Microsoft-Windows-FilterManager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
version 0 / Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Sysmon
NXLog field |
Event Viewer field |
UDM field |
|
|
If |
|
|
Based on Hash algorithm.
MD5 set to
SHA256 set to
SHA1 set to |
|
|
Domain set to
Username set to |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: SecurityCenter
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: telegraf
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: WudfUsbccidDriver
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 2
Provider: MEIx64
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: SecurityCenter
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: vmci
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-WHEA-Logger
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 3
version 3 / Provider: Microsoft-Windows-Power-Troubleshooter
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Security-Kerberos
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Virtual Disk Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: vmci
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4
Provider: Microsoft-Windows-Security-Kerberos
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Virtual Disk Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5
Provider: iScsiPrt
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: McAfee Service Controller
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Search-ProfileNotify
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 6
Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-FilterManager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: WudfUsbccidDriver
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7
Provider: AdmPwd
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Provider: WudfUsbccidDriver
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 8
Provider: CylanceSvc
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: WSH
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Data_1 |
|
|
Data_2 |
|
|
Data_3 |
principal.process.command_line |
|
Message |
metadata.description |
Event ID 9
Provider: volsnap
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 10
Provider: WudfUsbccidDriver
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 11
Provider: Microsoft-Windows-Hyper-V-Netvsc
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: WudfUsbccidDriver
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-Wininit
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 12
Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Sysmon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-UserModePowerService
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 13
Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Sysmon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-CertificateServicesClient-CertEnroll
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Format:
|
Provider: NPS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 14
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Wininit
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider:TPM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 15
Provider: Disk
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: SecurityCenter
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider:TPM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 16
Provider: Microsoft-Windows-HAL
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
version 0 / Provider: Microsoft-Windows-HAL
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 17
Provider: Microsoft-Windows-WHEA-Logger
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
Category set to
|
|
|
|
|
|
|
|
|
|
Event ID 18
Provider: BTHUSB
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: TPM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 19
version 0 / Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Intel-SST-OED
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WHEA-Logger
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 20
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 21
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 22
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
Category set to
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-UserModePowerService
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 23
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 24
Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 0 / Provider: Microsoft-Windows-Kernel-General
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider:TPM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 25
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 26
Provider: Application Popup
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-CertificationAuthority
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 27
version 0 / Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 28
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 29
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 30
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 31
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 32
Provider: e1iexpress
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 33
Provider: volsnap
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 34
Provider: Oracle.xstore
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 35
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: NPS
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 37
Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-Processor-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 38
Provider: Microsoft-Windows-CertificationAuthority
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 40
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 42
version 0 Windows 10 client / Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
version 2 Windows 10 client /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 43
Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 44
version 0 Windows 10 client / Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 45
Provider: Symantec AntiVirus
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 47
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WHEA-Logger
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 49
Provider: Microsoft-Windows-Hyper-V-Netvsc
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 50
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Ntfs
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 51
Provider: Disk
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 55
version 0 Windows 10 client / Provider: Microsoft-Windows-Kernel-Processor-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Ntfs
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 57
Provider: hpqilo3
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 58
Provider: partmgr
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: volsnap
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 59
Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 60
Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 61
Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 64
Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 75
Provider: Microsoft-Windows-CertificationAuthority
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 77
Provider: Microsoft-Windows-CertificationAuthority
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 80
Provider: ocz10xx
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 81
Provider: hpqilo2
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-FailoverClustering-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 98
Provider: Microsoft-Windows-Ntfs
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 100
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 101
Provider: Application Management Group Policy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 102
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
Extract PID and map it to UDM field |
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 103
Provider: Application Management Group Policy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
Extract PID and map it to UDM field |
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: ocz10xx
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 104
Windows 10 client / Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Windows Server 2019 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Forwarding
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: WudfUsbccidDriver
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 105
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: VMTools
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: WudfUsbccidDriver
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 106
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 107
version 0 Windows 10 client / Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 108
Provider: Application Management Group Policy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: VMTools
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 109
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 110
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 111
version 0/ Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
version 0/ Provider: Microsoft-Windows-AppReadiness
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 112
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 115
Provider: Directory Synchronization
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 129
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 130
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 131
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 132
Provider: Microsoft-Windows-WinRM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 134
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 137
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Ntfs
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 138
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 139
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 140
Provider: Microsoft-Windows-Ntfs
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 142
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WinRM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 143
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 145
Provider: Microsoft-Windows-WinRM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 146
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 153
Provider: Disk
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
Event ID 156
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 157
Provider: disk
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 158
Provider: Disk
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Time-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 159
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 160
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 161
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 163
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 164
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 165
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 167
Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 169
Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 170
Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 171
version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 172
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 173
Provider: Microsoft-Windows-Hyper-V-Hypervisor
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 181
version 0 / Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 185
version 0 / Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 187
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 195
Provider: Microsoft-Windows-USB-USBHUB3
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 196
Provider: Microsoft-Windows-USB-USBHUB3
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 200
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 201
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 202
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 203
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 204
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Security-Kerberos
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 205
version 0 Windows Server 2019 / Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
version 1 / Windows 10 client /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
version 2 / Windows 10 client /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 216
version 1 / Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 219
Provider: Microsoft-Windows-Kernel-PnP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 218
version 0 / Provider: Microsoft-Windows-WindowsUpdateClient
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 221
version 0 / Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 225
Provider: Microsoft-Windows-Kernel-PnP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 0 / Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 233
Provider: Microsoft-Windows-Hyper-V-VmSwitch
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 231
version 0 / Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 234
Provider: Microsoft-Windows-Hyper-V-VmSwitch
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 238
Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
version 0 / Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
version 1 / Provider: Microsoft-Windows-Kernel-Boot
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 258
Provider: VMUpgradeHelper
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 260
Provider: VMUpgradeHelper
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 263
version 0 / Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 271
Provider: VMUpgradeHelper
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 272
Provider: VMUpgradeHelper
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 299
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 300
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned
Extract PID and map it to |
Event ID 301
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned
Extract PID and map it to |
Event ID 302
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned
Extract PID and map it to |
Event ID 304
version 0 / Provider: Microsoft-Windows-Ntfs
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 313
version 0 / Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 325
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
||
|
|
If required fields for above mentioned
Extract PID and map it |
NXLog field |
Event Viewer field |
UDM field |
|
|
|
TaskName
|
|
|
QueuedTaskInstanceId
|
|
|
Domain
|
|
|
AccountName
|
|
|
UserID
|
|
|
AccountType
|
|
|
Event ID 326
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned
Extract PID and map it to |
Event ID 400
Provider: PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
version 1 /Provider: PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 403
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 404
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 405
Provider: ADSync
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
Event ID 410
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 412
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 424
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 500
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 501
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 506
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 507
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
version 10 / Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 508
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned
Extract PID and map it to |
Event ID 510
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 517
Provider: Microsoft-Windows-DFSN-Server
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 521
Provider: Security
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 529
Provider: Security
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 566
Provider: Microsoft-Windows-Kernel-Power
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 600
Provider: PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 601
Provider: Directory Synchronization
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 642
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned
Extract PID map it to |
Event ID 653
Provider: Directory Synchronization
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 654
Provider: Directory Synchronization
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 663
Provider: Directory Synchronization
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 700
Provider: NTDS ISAM
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 701
Provider: NTDS ISAM
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 719
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 781
Provider: Microsoft-Windows-Complus
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 800
Provider: PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 888
Provider: top_5
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 900
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 902
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 903
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 904
Provider: Directory Synchronization
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 1000
Provider: Microsoft-Windows-SCPNP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-LoadPerf
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1001
Provider: Microsoft Antimalware
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-WER-SystemErrorReporting
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: SNMP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Windows Error Reporting
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-LoadPerf
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1003
Provider: Microsoft-Windows-Search
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1004
Provider: IPMIDRV
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: Microsoft-Windows-Search
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: SNMP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: TdIca
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1005
Provider: Microsoft-Windows-Search
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1007
Provider: TdIca
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1008
Provider: Microsoft-Windows-Perflib
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Search
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 1010
Provider: Microsoft-Windows-Search
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1013
Provider: Microsoft-Windows-Search
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1014
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1016
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1023
Provider: Microsoft-Windows-Perflib
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1025
Provider: Microsoft-Windows-TPM-WMI
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1026
Provider: Microsoft-Windows-TPM-WMI
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1027
Provider: Microsoft-Windows-TPM-WMI
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1030
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Kernel-PnP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1031
Provider: Microsoft-Windows-Kernel-PnP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1033
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1034
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1037
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1040
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
|
Extract process_id and map it to |
|
|
|
|
|
|
|
|
|
|
|
Event ID 1042
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
|
Extract process_id and map it to |
|
|
|
|
|
|
|
|
|
|
|
Event ID 1053
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1054
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1055
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1056
Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1057
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1058
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1064
Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1066
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1067
Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1068
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1069
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1073
Provider: User32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1074
Provider: User32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: USER32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: User32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: USER32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: User32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: USER32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: User32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 1076
Provider: User32
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1085
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1096
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1100
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1101
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1102
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: DFS Replication
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1103
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1104
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1105
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1106
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1107
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 1108
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1112
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1126
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1127
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1128
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1129
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1130
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1134
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1150
Provider: Microsoft Antimalware
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1162
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1173
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1196
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1200
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
Event ID 1201
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
Event ID 1202
Provider: SceCli
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1203
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1204
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1205
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 1206
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
Event ID 1207
Provider: AD FS Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
Event ID 1213
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
Event ID 1216
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
Event ID 1226
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1254
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1257
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1282
Provider: Microsoft-Windows-TPM-WMI
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 1307
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1311
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1317
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
Event ID 1500
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1501
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1502
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1503
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1531
Provider: Microsoft-Windows-User Profiles Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1532
Provider: Microsoft-Windows-User Profiles Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1535
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1564
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1566
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1573
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1593
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1643
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1644
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1645
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1653
Provider: Microsoft-Windows-FailoverClustering
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1699
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1704
Provider: SceCli
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 1865
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1925
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1955
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2000
Provider: Microsoft Antimalware
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 2001
Provider: Microsoft Antimalware
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: NTDS ISAM
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 2004
Provider: Microsoft-Windows-Resource-Exhaustion-Detector
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2041
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
Event ID 2042
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2053
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2065
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2085
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2089
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2108
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2811
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2887
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2889
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2896
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2904
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2946
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2947
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2974
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 3005
Provider: LogRhythm Agent
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 3006
Provider: LogRhythm Agent
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
ip is set to port is set to |
Event ID 3040
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 3041
Provider: Microsoft-Windows-ActiveDirectory_DomainService
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 3072
Provider: Foundation Agents
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 3096
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 3260
Provider: Workstation
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 3261
Provider: Workstation
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4000
version 0 Windows 10 client / Provider: Microsoft-Windows-Diagnostics-Networking
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WLAN-AutoConfig
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4001
Provider: Microsoft-Windows-WLAN-AutoConfig
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4003
Provider: Microsoft-Windows-WLAN-AutoConfig
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4005
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4006
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4016
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4017
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4096
Provider: NetJoin
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4097
Provider: Microsoft-Windows-CAPI2
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: NetJoin
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4100
Provider: Microsoft-Windows-Diagnostics-Networking
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4101
Provider: Display
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4103
version 1 / Provider: Microsoft-Windows-PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4104
Provider: Microsoft-Windows-PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4108
Provider: Microsoft-Windows-CAPI2
NXLog field |
Event Viewer field |
UDM field |
|
|
Extract information from |
Event ID 4109
Provider: Microsoft-Windows-CAPI2
NXLog field |
Event Viewer field |
UDM field |
|
|
Extract information from |
Event ID 4111
Provider: Microsoft-Windows-MSDTC
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4112
Provider: Microsoft-Windows-CAPI2
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4113
Provider: Microsoft-Windows-CAPI2
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4115
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4116
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4117
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4124
Provider: Microsoft-Windows-BitLocker-API
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4125
Provider: Microsoft-Windows-BitLocker-API
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4126
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4127
Provider: Microsoft-Windows-BitLocker-API
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4133
Provider: Microsoft-Windows-BitLocker-API
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4199
Provider: Tcpip
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4200
Provider: Microsoft-Windows-Iphlpsvc
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4202
Provider: Microsoft-Windows-MSDTC 2
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4227
Provider: Tcpip
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4230
Provider: Tcpip
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4257
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4319
Provider: NetBT
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4321
Provider: NetBT
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4326
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4400
Provider: NPS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4608
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4609
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4610
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4611
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4612
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4614
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4615
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4616
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4618
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4621
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4622
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4624
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
version 2 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4625
Provider: Microsoft-Windows-EventSystem
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Populate description corresponding to the status codes. Format: Status(%{Status}): %{status_description}. If the value coming is 0xc000006d, then store the value 'The cause is either a bad username or authentication information (referred from doc table.' |
|
|
Populate description corresponding to the substatus codes. Format: SubStatus(%{SubStatus}): %{sub_status_description} If the value coming is 0xc000006d, then store the value 'The cause is either a bad username or authentication information (referred from doc table.' |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4626
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4627
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4634
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4646
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4647
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4648
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4649
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4650
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4651
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4652
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4653
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4654
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4655
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4656
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4657
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4658
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4659
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4660
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4661
event version 1 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
version 0 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4662
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4663
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
Object Type | UDM Field --------------------------+------------------------------------
File, SymbolicLink |
Key |
Process |
Event | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4664
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4665
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4666
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4667
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4668
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4670
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
Object Type | UDM Field --------------------------+------------------------------------
File, SymbolicLink |
Key |
Process |
Event | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4671
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4672
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4673
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4674
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4675
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4688
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
version 2 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4689
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4690
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4691
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
Object Type | UDM Field --------------------------+------------------------------------
File, SymbolicLink |
Key |
Process |
Event | |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4692
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4693
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4694
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4695
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4696
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4697
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 10 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4698
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 10 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4699
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 10 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4700
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 10 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4701
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 10 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4702
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
Extract the XML data from the |
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 10 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4703
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4704
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Extract userId from
Extract domain from |
Event ID 4705
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4706
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4707
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4709
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4710
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4711
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4712
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4713
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4714
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4715
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4716
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4717
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4718
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4719
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4720
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4722
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4723
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4724
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4725
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4726
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4727
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4728
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Extracted OU, CN, DC fields from the |
|
|
|
|
|
|
Event ID 4729
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4730
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4731
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4732
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
Event ID 4733
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4734
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4735
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4737
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4738
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
target.user.last_password_change_time |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4739
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4740
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4741
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4742
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4743
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4744
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4745
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4746
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4747
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4748
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4749
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4750
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4751
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4752
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4753
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4754
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4755
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4756
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4757
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4758
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4759
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4760
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4761
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4762
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4763
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4764
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4765
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4766
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4767
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4768
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4769
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4770
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4771
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4772
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4773
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4774
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4775
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4776
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4777
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4778
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4779
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4780
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4781
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4782
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4783
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4784
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4785
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4786
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4787
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4788
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4789
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4790
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4791
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4792
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4793
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4794
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4797
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4798
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4799
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4800
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4801
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4816
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4817
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4818
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4819
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4820
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4821
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4822
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4823
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4824
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4825
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4826
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4830
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4864
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4865
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4866
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4867
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4868
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4869
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4870
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4871
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4872
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4873
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4874
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4875
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4876
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4877
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4878
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4879
Provider: Microsoft-Windows-MSDTC Client 2
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4880
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4881
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4882
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4883
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4884
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4885
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4886
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4887
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4888
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4889
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4890
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4891
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4892
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4893
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4894
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4895
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4896
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4897
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4898
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4899
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4900
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4902
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4904
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4905
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4906
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4907
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
Object Type | UDM Field --------------------------+------------------------------------
File, SymbolicLink |
Key |
Process |
Event | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4908
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4909
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4910
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4911
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4912
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4913
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4928
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4929
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4930
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4931
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4932
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4933
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4934
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
Event ID 4935
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4936
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4937
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4944
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4945
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4946
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4947
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4948
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4949
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4950
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4951
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4952
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4953
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4954
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 4956
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4957
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4958
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4960
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4961
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4962
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4963
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4964
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4965
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 4976
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4977
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4978
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 4979
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4980
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4981
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4982
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4983
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4984
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 4985
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5002
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5005
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5007
Provider: Microsoft Antimalware
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5009
Provider: Microsoft-Windows-WAS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5016
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5017
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5024
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5025
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5027
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5028
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5029
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5030
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5031
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5032
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5033
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5034
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5035
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5037
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5038
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5039
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5040
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5041
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5042
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5043
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5044
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5045
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5046
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5047
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5048
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5049
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5050
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5051
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5056
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5057
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5058
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5059
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5060
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5061
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5062
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5063
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5064
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5065
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5066
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5067
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5068
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5069
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5070
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5071
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5074
Provider: Microsoft-Windows-WAS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5077
Provider: Microsoft-Windows-WAS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5116
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5117
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5120
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5121
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5122
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5123
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5124
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5125
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5126
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5127
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5136
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
If |
|
|
If |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5137
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5138
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5139
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If If If |
|
|
|
Provider: Microsoft-Windows-WAS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5140
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5141
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If If If else
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5142
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5143
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5144
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5145
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5146
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5147
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5148
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5149
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5150
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5151
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5152
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 11 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5153
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 / Windows 11 and Windows Server 2022/
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5154
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5155
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5156
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5157
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5158
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5159
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5168
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5169
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5170
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5186
Provider: Microsoft-Windows-WAS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5257
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5308
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5309
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5310
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5311
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5312
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5313
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5314
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5315
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5320
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5321
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5324
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5326
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5327
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5340
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5351
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5376
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5377
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5378
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5379
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5380
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5381
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5382
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5440
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5441
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5442
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5443
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5444
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5446
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5447
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5448
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5449
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5450
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5451
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5452
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5453
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5456
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5457
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5458
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5459
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5460
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5461
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5462
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5463
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5464
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5465
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5466
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5467
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5468
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5471
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5472
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5473
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5474
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5477
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5478
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5479
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5480
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5483
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5484
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5485
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5615
Provider: Microsoft-Windows-WMI
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5617
Provider: Microsoft-Windows-WMI
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5632
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5633
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5712
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5719
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5721
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5722
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 5723
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5774
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5775
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5781
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5782
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5802
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5805
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5807
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5823
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5827
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 5830
Provider: NETLOGON
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5857
Provider: Microsoft-Windows-WMI-Activity
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5858
Provider: Microsoft-Windows-WMI-Activity
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5859
Provider: Microsoft-Windows-WMI-Activity
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5860
Provider: Microsoft-Windows-WMI-Activity
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5861
Provider: Microsoft-Windows-WMI-Activity
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5888
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5889
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 5890
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6000
Windows 10 client / Provider: Microsoft-Windows-Winlogon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Eventlog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6001
Windows 10 client / Provider: Microsoft-Windows-Winlogon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6003
Windows 10 client / Provider: Microsoft-Windows-Winlogon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6005
Windows Server 2019 / Provider: Microsoft-Windows-Winlogon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: EventLog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 6006
Windows 10 client / Provider: EventLog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-W3LOGSVC
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6008
Provider: EventLog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6009
Provider: EventLog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6011
Provider: EventLog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
Extract hostnames and map old value with |
Event ID 6013
Provider: EventLog
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6038
Provider: LsaSrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6062
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6100
Provider: Microsoft-Windows-Diagnostics-Networking
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6144
Provider: LsaSrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6145
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6148
Provider: LsaSrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6149
Provider: LsaSrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6272
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6273
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6274
version 1 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6275
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6276
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6277
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6278
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6279
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6280
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6281
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6313
Provider: ADSync
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 6400
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6401
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6402
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6403
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6404
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6405
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6406
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6407
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6408
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6409
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 6410
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 6416
version 0 / Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
version 1 /
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 6417
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 6418
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 6419
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6420
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6421
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6422
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6423
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6424
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 6946
Provider: ADSync
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 6952
Provider: ADSync
NXLog field |
Event Viewer field |
UDM field |
|
|
If required fields for above mentioned |
|
|
|
Event ID 7000
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
Extract error and map it to |
|
|
|
Event ID 7001
Provider: Microsoft-Windows-Winlogon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7002
Provider: Microsoft-Windows-Winlogon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7003
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7005
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7009
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 7010
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7011
Windows Server 2019 / Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7012
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7017
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7021
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7022
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 7023
Windows 10 client / Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
Extract error and map it to |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7024
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 7025
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 7026
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 7031
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 7032
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7034
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 7036
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
If the param2 log field value is equal to stopped , then the
metadata.event_type UDM field is set to SERVICE_STOP .Else, if the param2 log field value is equal to start , then the
metadata.event_type UDM field is set to SERVICE_START .Else, if the param2 log field value is equal to running ,
then the metadata.event_type UDM field is set to SERVICE_UNSPECIFIED .
|
|
|
|
|
|
If the |
Event ID 7038
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7040
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7042
Windows Server 2019 / Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7045
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8000
Provider: Netwtw10
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 8003
Provider: bowser
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8004
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8005
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8006
Provider: Microsoft-Windows-GroupPolicy
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8007
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8008
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 8009
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 8010
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8015
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8017
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8018
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8019
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8020
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8021
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: BROWSER
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8022
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8025
Provider: Microsoft-Windows-AppLocker
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8027
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8030
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 8033
Provider: Microsoft-Windows-DNS-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8191
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 8193
Provider: VSS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 8198
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 8222
Provider: VSSAudit
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8223
Provider: VSSAudit
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 8224
Provider: VSS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 8225
Provider: VSS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 8230
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 9007
Provider: nhi
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 9008
Provider: nhi
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 9027
Provider: Desktop Window Manager
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 10000
Windows Server 2019 / Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-DriverFrameworks-UserMode
NXLog field |
Event Viewer field |
UDM field |
||
|
|
|
|
|
|
|
|
Event ID 10001
Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-WLAN-AutoConfig
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-DriverFrameworks-UserMode
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 10002
Provider: Microsoft-Windows-WLAN-AutoConfig
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: Microsoft-Windows-DriverFrameworks-UserMode
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 10004
Provider: Microsoft-Windows-WLAN-AutoConfig
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 10005
Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 10010
Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 10016
Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 10100
Provider: Microsoft-Windows-DriverFrameworks-UserMode
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 10111
Provider: Microsoft-Windows-DriverFrameworks-UserMode
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 10118
Provider: Microsoft-Windows-DriverFrameworks-UserMode
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 10020
Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 10028
Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 10036
Provider: Microsoft-Windows-DistributedCOM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 10110
Provider: Microsoft-Windows-DriverFrameworks-UserMode
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 10148
Windows 10 client / Provider: Microsoft-Windows-WinRM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 10149
Windows 10 client / Provider: Microsoft-Windows-WinRM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 10154
Windows 10 client / Provider: Microsoft-Windows-WinRM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 10317
Provider: Microsoft-Windows-NDIS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 10400
Provider: Microsoft-Windows-NDIS
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 11707
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
target.application Extract product_name from |
|
|
Event ID 12294
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 14204
Provider: Microsoft-Windows-WMPNSS-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 14205
Provider: Microsoft-Windows-WMPNSS-Service
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 14531
Provider: Microsoft-Windows-DfsSvc
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 14533
Provider: Microsoft-Windows-DfsSvc
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 14554
Provider: Microsoft-Windows-DfsSvc
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 15007
Provider: Microsoft-Windows-HttpEvent
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 15008
Provider: Microsoft-Windows-HttpEvent
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 15021
Provider: Microsoft-Windows-HttpEvent
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 15301
Provider: Microsoft-Windows-HttpEvent
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 16384
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
version 0 / Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 16385
version 0 / Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16388
version 0 / Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 16392
version 0 / Provider: Microsoft-Windows-Bits-Client
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 16394
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 16401
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16413
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16647
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16648
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16962
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16963
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16966
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 16969
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 16977
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
version 0 / Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 16978
version 0 / Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
Event ID 16979
version 0 / Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 16982
version 0 / Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 16983
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
version 0 / Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 16984
Provider: Microsoft-Windows-Directory-Services-SAM
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 18452
Provider: MSSQL$ENTERPRISE191
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 18456
Provider: MSSQL$ENTERPRISE100
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Provider: MSSQLSERVER
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 20001
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 20003
Provider: Microsoft-Windows-UserPnp
NXLog field |
Event Viewer field |
UDM field |
|
|
Category set to
|
|
|
|
Event ID 20063
Provider: RemoteAccess
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 20171
Provider: RemoteAccess
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 20192
Provider: RemoteAccess
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 28680
Provider: PRIVMAN
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 28701
Provider: PRIVMAN
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 33205
Provider: MSSQL$LABX2010$AUDIT
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: MSSQL$SQL16$AUDIT
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
Provider: MSSQL$SYNEL$AUDIT
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Provider: MSSQLSERVER$AUDIT
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36867
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36868
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36870
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36871
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36874
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36877
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36880
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36881
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36882
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36886
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36887
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 36888
Provider: Schannel
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 40960
Provider: LsaSrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 40970
Provider: LsaSrv
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
Event ID 2147487656
version 0 / Provider: Microsoft-Windows-Winlogon
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 3221228478
Provider: Microsoft-Windows-Wininit
NXLog field |
Event Viewer field |
UDM field |
|
|
|
Event ID 5447
Provider: Microsoft Corporation
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 403
Provider: PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
metadata.description NewEngineState is set to target.labels.key/value PreviousEngineState is set to target.labels.key/value HostName is set to additional.fields.key/value.string_value HostVersion is set to target.labels.key/value HostId is set to target.labels.key/value HostApplication is set to principal.process.command_line EngineVersion is set to target.labels.key/value RunspaceId is set to target.labels.key/value PipelineId is set to target.labels.key/value CommandName is set to target.labels.key/value CommandType is set to target.labels.key/value ScriptName is set to target.file.names CommandPath is set to target.process.file.full_path CommandLine is set to target.process.command_line NewEngineState is set to additional.fields.key and additional.fields.value.string_value PreviousEngineState is set to additional.fields.key and additional.fields.value.string_value HostVersion is set to additional.fields.key and additional.fields.value.string_value HostId is set to additional.fields.key and additional.fields.value.string_value EngineVersion is set to additional.fields.key and additional.fields.value.string_value RunspaceId is set to additional.fields.key and additional.fields.value.string_value PipelineId is set to additional.fields.key and additional.fields.value.string_value CommandName is set to additional.fields.key and additional.fields.value.string_value CommandType is set to additional.fields.key and additional.fields.value.string_value |
Event ID 4105
Provider: Microsoft-Windows-PowerShell
NXLog field |
Event Viewer field |
UDM field |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 105
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description pid is set to target.process.pid additional_data is set to about.labels.key/value additional_data is set to additional.fields.key and additional.fields.value.string_value |
Event ID 4440
Provider: Microsoft-Windows-Complus
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
|
|
|
Event ID 8200
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 1004
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 1014
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 8197
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
security_result.description RuleId is set to security_result.rule_id Action is set to security_result.action_details app_name is set to target.application AppId is set to target.labels.key/value SkuId is set to target.labels.key/value NotificationInterval is set to target.labels.key/value Trigger is set to target.labels.key/value AppId is set to additional.fields.key and additional.fields.value.string_value SkuId is set to additional.fields.key and additional.fields.value.string_value NotificationInterval is set to additional.fields.key and additional.fields.value.string_value Trigger is set to additional.fields.key and additional.fields.value.string_value |
Event ID 20482
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 1033
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
security_result.description DirectiveName is set to target.labels.key/value AppId is set to target.labels.key/value SkuId is set to target.labels.key/value DirectiveName is set to additional.fields.key and additional.fields.value.string_value AppId is set to additional.fields.key and additional.fields.value.string_value SkuId is set to additional.fields.key and additional.fields.value.string_value |
Event ID 1013
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
metadata.description SkuId is set to target.labels.key/value SkuId is set to additional.fields.key and additional.fields.value.string_value |
|
Event ID 1067
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 12304
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 1036
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 20489
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 20481
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 1025
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description product_name is set to target.application ProcessPath is set to target.process.file.full_path ProcessName is set to target.process.command_line ProcessId is set to target.process.pid |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 12305
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 12311
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 20488
Provider: Microsoft-Windows-Security-SPP
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
Event ID 1281
Provider: Microsoft-Windows-TPM-WMI
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 63
Provider: Microsoft-Windows-WMI
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description |
Event ID 1025
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description product_name is set to target.application ProcessPath is set to target.process.file.full_path ProcessName is set to target.process.command_line ProcessId is set to target.process.pid |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 11724
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description Product is set to target.application |
Event ID 1005
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1038
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 1029
Provider: MsiInstaller
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
metadata.description |
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 7030
Provider: Service Control Manager
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED
target.appliaction is set to Printer Extensions and Notifications service
|
||
|
|
|
Event ID 202
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 103
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 119
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 141
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_DELETION target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 106
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 108
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 110
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 118
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 142
Provider: Microsoft-Windows-TaskScheduler
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SCHEDULED_TASK_DISABLE target.resource.resource_type = TASK |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 2006
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED |
||
|
Extract PID and map it to UDM field |
Event ID 2001
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED |
||
|
Extract PID and map it to UDM field |
Event ID 216
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED |
||
|
Extract PID and map it to UDM field |
Event ID 2003
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED |
||
|
Extract PID and map it to UDM field |
Event ID 2005
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED |
||
|
Extract PID and map it to UDM field |
Event ID 637
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED |
||
|
Extract PID and map it to UDM field |
Event ID 327
Provider: ESENT
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_UNSPECIFIED |
||
|
Extract PID and map it to UDM field
Extract src_path and map it to UDM field
Extract target_path and map it to UDM field |
Event ID 17063
Provider: MSSQLSERVER
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = STATUS_UPDATE |
||
|
|
Event ID 17137
Provider: MSSQLSERVER
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_START |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
Extract database_name and map it to UDM field |
Event ID 49930
Provider: MSSQLSERVER
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = STATUS_UPDATE |
||
|
|
Event ID 852
Provider: MSSQLSERVER
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = STATUS_UPDATE |
||
|
|
Event ID 53504
Provider: Microsoft-Windows-PowerShell
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_START target.application = IPC |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 40962
Provider: Microsoft-Windows-PowerShell
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = STATUS_UPDATE |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 40961
Provider: Microsoft-Windows-PowerShell
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = SERVICE_START |
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Event ID 530
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 531
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 532
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 533
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 534
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 535
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 536
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 537
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 539
Provider: Microsoft-Windows-Security-Auditing
NXLog field |
Event Viewer field |
UDM field |
metadata.event_type = USER_LOGIN
|
Event ID 1116
Provider: Microsoft-Windows-Windows Defender
NXLog field |
Event Viewer field |
UDM field |
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
security_result.category = SOFTWARE_PUA
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-10-30 UTC.