Log sources tagged xml

Log sources tagged xml. Browse source profiles associated with xml.

Matching source profiles

Windows · xml

Windows Security 4624 — Successful logon

A logon session was created on the accessed computer.

Windows · xml

Windows Security 4625 — Failed logon

A logon attempt failed on the computer recording the event.

windows xml authentication failure

Windows · xml

Windows Security 4688 — Process creation

A new process was created, with fields that depend on the event version and audit policy.

windows xml process execution

Windows · xml

Windows Security 4698 — Scheduled task created

A scheduled task was created; TaskContent carries the task definition XML.

windows xml scheduled-task persistence

Windows · xml

Windows Security 4720 — User account created

A user account was created in the local account database or directory context of the reporting host.

windows xml identity account-management

Windows · xml

Windows Security 4732 — Member added to local security group

A member was added to a security-enabled local group.

windows xml identity privilege

Windows · xml

Windows Security 4740 — Account locked out

An account was locked out under the applicable account-lockout policy.

windows xml authentication lockout

Windows · xml

Windows Security 4768 — Kerberos TGT request

The domain controller handled a Kerberos authentication-service request.

windows xml kerberos active-directory

Windows · xml

Windows Security 4769 — Kerberos service ticket request

A domain controller recorded a Kerberos service-ticket request.

windows xml kerberos active-directory

Windows · xml

Windows Security 4776 — NTLM credential validation

The authoritative computer attempted to validate credentials with NTLM.

windows xml ntlm authentication

Windows · xml

Windows Security 1102 — Security audit log cleared

The Windows Security log was cleared.

windows xml audit-integrity defense-evasion

Windows · xml

Windows Security 5156 — Filtering Platform connection permitted

Windows Filtering Platform permitted a connection.

windows xml firewall network

Windows · xml

Windows Security 4663 — Object access

An audited object access was recorded for the configured object and access mask.

windows xml file object-access

Windows · xml

Windows Security 5136 — Directory object modified

A directory object attribute was modified on a domain controller.

windows xml active-directory directory-change

Sysmon · xml

Sysmon 1 — Process creation

Sysmon records process creation through its Windows Operational channel.

sysmon xml endpoint process process-creation

Sysmon · xml

Sysmon 3 — Network connection

Sysmon records network connection through its Windows Operational channel.

sysmon xml endpoint process network-connection

Sysmon · xml

Sysmon 7 — Image loaded

Sysmon records image loaded through its Windows Operational channel.

sysmon xml endpoint process image-loaded

Sysmon · xml

Sysmon 8 — CreateRemoteThread

Sysmon records createremotethread through its Windows Operational channel.

sysmon xml endpoint process createremotethread

Sysmon · xml

Sysmon 13 — Registry value set

Sysmon records registry value set through its Windows Operational channel.

sysmon xml endpoint process registry-value-set

Sysmon · xml

Sysmon 22 — DNS query

Sysmon records dns query through its Windows Operational channel.

sysmon xml endpoint process dns-query

Sysmon · xml

Sysmon 23 — File deletion archived

Sysmon records file deletion archived through its Windows Operational channel.

sysmon xml endpoint process file-deletion-archived

PowerShell · xml

PowerShell 4103 — Module logging

PowerShell logs pipeline execution details for configured modules.

powershell xml script execution

PowerShell · xml

PowerShell 4104 — Script block logging

PowerShell logs script-block text with an identifier and multipart sequence fields.

powershell xml script execution