Security log-source library

Security log-source library. 82 documented log profiles grouped by system, with native examples, field structure, collection guidance and investigation uses.

A curated, expandable catalogue of concrete producer formats. It is not an exhaustive inventory of every product, event ID or release. Reviewed 2026-11-10.

What “real example” means here

Examples are preserved publisher documentation or pinned upstream parser fixtures, with provenance and any extraction or repair disclosed. They are not independently captured incidents. Offline syntax checks do not certify a vendor schema, collector or detector.

Find a source

Search source, event ID or tagSystem group

82 profiles

Windows and Active Directory

Windows · xml

Windows Security 4624 — Successful logon

A logon session was created on the accessed computer.

Windows · xml

Windows Security 4625 — Failed logon

A logon attempt failed on the computer recording the event.

windows xml authentication failure

Windows · xml

Windows Security 4688 — Process creation

A new process was created, with fields that depend on the event version and audit policy.

windows xml process execution

Windows · xml

Windows Security 4698 — Scheduled task created

A scheduled task was created; TaskContent carries the task definition XML.

windows xml scheduled-task persistence

Windows · xml

Windows Security 4720 — User account created

A user account was created in the local account database or directory context of the reporting host.

windows xml identity account-management

Windows · xml

Windows Security 4732 — Member added to local security group

A member was added to a security-enabled local group.

windows xml identity privilege

Windows · xml

Windows Security 4740 — Account locked out

An account was locked out under the applicable account-lockout policy.

windows xml authentication lockout

Windows · xml

Windows Security 4768 — Kerberos TGT request

The domain controller handled a Kerberos authentication-service request.

windows xml kerberos active-directory

Windows · xml

Windows Security 4769 — Kerberos service ticket request

A domain controller recorded a Kerberos service-ticket request.

windows xml kerberos active-directory

Windows · xml

Windows Security 4776 — NTLM credential validation

The authoritative computer attempted to validate credentials with NTLM.

windows xml ntlm authentication

Windows · xml

Windows Security 1102 — Security audit log cleared

The Windows Security log was cleared.

windows xml audit-integrity defense-evasion

Windows · xml

Windows Security 5156 — Filtering Platform connection permitted

Windows Filtering Platform permitted a connection.

windows xml firewall network

Windows · xml

Windows Security 4663 — Object access

An audited object access was recorded for the configured object and access mask.

windows xml file object-access

Windows · xml

Windows Security 5136 — Directory object modified

A directory object attribute was modified on a domain controller.

windows xml active-directory directory-change

Sysmon · xml

Sysmon 1 — Process creation

Sysmon records process creation through its Windows Operational channel.

sysmon xml endpoint process process-creation

Sysmon · xml

Sysmon 3 — Network connection

Sysmon records network connection through its Windows Operational channel.

sysmon xml endpoint process network-connection

Sysmon · xml

Sysmon 7 — Image loaded

Sysmon records image loaded through its Windows Operational channel.

sysmon xml endpoint process image-loaded

Sysmon · xml

Sysmon 8 — CreateRemoteThread

Sysmon records createremotethread through its Windows Operational channel.

sysmon xml endpoint process createremotethread

Sysmon · xml

Sysmon 13 — Registry value set

Sysmon records registry value set through its Windows Operational channel.

sysmon xml endpoint process registry-value-set

Sysmon · xml

Sysmon 22 — DNS query

Sysmon records dns query through its Windows Operational channel.

sysmon xml endpoint process dns-query

Sysmon · xml

Sysmon 23 — File deletion archived

Sysmon records file deletion archived through its Windows Operational channel.

sysmon xml endpoint process file-deletion-archived

PowerShell · xml

PowerShell 4103 — Module logging

PowerShell logs pipeline execution details for configured modules.

powershell xml script execution

PowerShell · xml

PowerShell 4104 — Script block logging

PowerShell logs script-block text with an identifier and multipart sequence fields.

powershell xml script execution

Linux and Unix

Linux · syslog

Linux SSH authentication — auth.log / secure

OpenSSH authentication messages are routed through the host logging configuration.

linux syslog authentication ssh var-log

Linux · syslog

Linux sudo audit messages

sudo can record attempted privilege transitions and command context through syslog or its configured logs.

linux syslog privilege sudo var-log

Linux Audit · audit

Linux Audit syscall

Kernel audit syscall records include identity, architecture, return status and process context.

linux-audit audit var-log syscall

Linux Audit · audit

Linux Audit command arguments

EXECVE records describe arguments associated with an audited exec call.

linux-audit audit var-log execve

Linux Audit · audit

Linux Audit object paths

PATH records describe objects associated with a kernel audit event.

linux-audit audit var-log path

Linux Audit · audit

SELinux AVC denials

SELinux access-vector-cache messages record an access-control decision and security contexts.

linux-audit audit var-log avc

systemd · json

systemd journal — JSON export

journalctl serializes journal entries to JSON; strings, arrays, byte arrays and null have distinct meanings.

systemd json journal var-log parser

Endpoint and virtualization

macOS · json

macOS Unified Logging — JSON event

Unified Logging exposes structured application and operating-system messages with subsystem and process context.

macos json endpoint authentication

osquery · json

osquery differential results

Scheduled query differential results describe rows added or removed relative to the query’s prior state.

osquery json endpoint inventory process

Microsoft Defender · json

Microsoft Defender for Endpoint alerts API

Alert objects describe a detection and its workflow state in Defender for Endpoint.

microsoft-defender json edr alerts

CrowdStrike · json

CrowdStrike Falcon event stream

Falcon event-stream objects carry a metadata envelope and an event-specific payload.

crowdstrike json edr alerts

VMware · syslog

VMware vCenter audit and event syslog

vCenter emits management and session activity through service logs and remote syslog.

vmware syslog virtualization administration

Network and perimeter

PAN-OS · csv

Palo Alto PAN-OS traffic

Session traffic and policy decisions.

pan-os csv network perimeter

PAN-OS · csv

Palo Alto PAN-OS threat

Threat log records; this fixture is a URL subtype.

pan-os csv network perimeter

PAN-OS · csv

Palo Alto PAN-OS configuration

Management-plane configuration activity.

pan-os csv network perimeter

FortiGate · key-value

FortiGate UTM security events

FortiOS UTM records with typed key=value fields.

fortigate key-value network perimeter

Cisco ASA · syslog

Cisco ASA TCP connection creation

ASA message 302013 records a TCP connection built by the firewall.

cisco-asa syslog network perimeter

Cisco ASA · syslog

Cisco ASA TCP teardown

ASA message 302014 describes a connection teardown.

cisco-asa syslog network perimeter

Cisco ASA · syslog

Cisco ASA address translation

ASA translation messages relate local and translated addresses.

cisco-asa syslog network perimeter

pfSense · csv

pfSense packet filter

filterlog emits a syslog envelope followed by packet-filter CSV.

pfsense csv network perimeter

Juniper SRX · syslog

Juniper SRX session flow

RT_FLOW_SESSION_CREATE uses structured session fields in a syslog message.

juniper-srx syslog network perimeter

Zscaler · json

Zscaler NSS web — configured JSON

A configured NSS web JSON export with an event envelope.

zscaler json network perimeter