Windows · xml
Windows Security 4624 — Successful logon
A logon session was created on the accessed computer.
Log sources tagged windows
Log sources tagged windows. Browse source profiles associated with windows.
Matching source profiles
Windows · xml
Windows Security 4625 — Failed logon
A logon attempt failed on the computer recording the event.
Windows · xml
Windows Security 4688 — Process creation
A new process was created, with fields that depend on the event version and audit policy.
Windows · xml
Windows Security 4698 — Scheduled task created
A scheduled task was created; TaskContent carries the task definition XML.
Windows · xml
Windows Security 4720 — User account created
A user account was created in the local account database or directory context of the reporting host.
Windows · xml
Windows Security 4732 — Member added to local security group
A member was added to a security-enabled local group.
Windows · xml
Windows Security 4740 — Account locked out
An account was locked out under the applicable account-lockout policy.
Windows · xml
Windows Security 4768 — Kerberos TGT request
The domain controller handled a Kerberos authentication-service request.
Windows · xml
Windows Security 4769 — Kerberos service ticket request
A domain controller recorded a Kerberos service-ticket request.
Windows · xml
Windows Security 4776 — NTLM credential validation
The authoritative computer attempted to validate credentials with NTLM.
Windows · xml
Windows Security 1102 — Security audit log cleared
The Windows Security log was cleared.
Windows · xml
Windows Security 5156 — Filtering Platform connection permitted
Windows Filtering Platform permitted a connection.
Windows · xml
Windows Security 4663 — Object access
An audited object access was recorded for the configured object and access mask.
Windows · xml
Windows Security 5136 — Directory object modified
A directory object attribute was modified on a domain controller.