Systemevents

Unter Systemevents erhalten Sie die Ergebnisse und eine Aufbereitung des Mitschnitts der Log-Daten Ihrer Server und Clients durch den Pulsar-Agent.

Um die Ansicht zu durchsuchen und zu filtern, nutzen Sie die Searchbar. Um zum Beispiel alle Anmeldeversuche angezeigt zu bekommen, wählen Sie die Kategorie Logon. Weiter modifizieren können Sie Ihre Auswahl, indem Sie den Status auf failure bzw. success beschränken.

Weiterhin können Sie oben den Zeitraum der angezeigten Systemevents bestimmen oder die Ergebnisse als Liste (.csv) exportieren.

Die Systemevents werden in der SaaS-Plattform für 14 Tage gespeichert. Nutzen Sie eine eigene On-Premises-Instanz, können Sie die Speicherzeiten anpassen.

Mitschnitt der Systemevents aktivieren

Um Systemevents mit Enginsight zu überwachen, muss der Mitschnitt sicherheitsrelevanter Ereignisse für die entsprechenden Hosts aktiviert werden.

Gehen Sie dazu entweder in die Einstellungen des einzelnen Hosts oder nutzen Sie den Policy Manager.

Beachten Sie, dass der Pulsar-Agent nur jene Systemevents überwachen kann, die auch vom Betriebssystem geloggt werden. Ist beispielsweise bei Windows das Login Auditing deaktiviert oder unter Linux das Linux Auditing System nicht installiert, kann auch Enginsight nicht mehr auf die Events zugreifen.

Objektzugriffe loggen und überwachen (Windows)

Mit Enginsight lassen sich Zugriffe auf sensible Dateien und Verzeichnisse unter Windows loggen und Alarme auf ungewöhnliche Zugriffe schalten. Dazu muss das Logging zunächst bei Windows über eine Gruppenrichtlinie aktiviert werden und auf dem Server definiert werden, welche Ordner überwacht werden sollen. Erst anschließend lassen sich die Ergebnisse bei Enginsight einsehen und Alarme schalten.

Überwachung von Objektzugriffen in Gruppenrichtlinien aktivieren

Sie können die Überwachung von Objektzugriffen entweder als lokale oder domänenweite Gruppenrichtlinie aktivieren.

Aktivieren Sie die Überwachung von Objektzugriffen nur auf Servern, bei denen Sie die Funktion auch nutzen möchten. Windows generiert in bestimmten Fällen Events für Ordner, die Sie nicht zur Überwachung bestimmt haben. Dies kann in der Folge zu Fehlalarmen führen.

1. Öffnen Sie den Editor für Gruppenrichtlinien.

2. Navigieren Sie zu Computerkonfigurationen → Windows-Einstellungen → Sicherheitseinstellungen → Lokale Richtlinien → Überwachungsrichtlinien.

3. Öffnen Sie „Objektzugriffsversuche überwachen“

4. Setzen Sie einen Haken unter „Diese Versuche überwachen“ sowohl bei Erfolgreich als auch bei Fehler.

5. Klicken Sie auf OK.

6. Führen Sie gpupdate /force in der Eingabeaufforderung aus, um die Gruppenrichtlinie zu aktivieren.

Ordner und/oder Dateien zur Überwachung festlegen

1. Gehen Sie auf den File Server, auf dem Sie Zugriffe überwachen möchten.

2. Öffnen Sie die Eigenschaften des entsprechenden Ordners bzw. der entsprechenden Datei.

3. Navigieren Sie auf den Reiter Sicherheit und wählen die Schaltfläche Erweitert.

4. Navigieren Sie auf den Reiter Überwachung und wählen die Schaltfläche Hinzufügen.

5. Geben Sie als Prinzipal/Objektnamen „Jeder“ an.

6. Setzen Sie unter Erweiterte Berechtigungen alle Haken.

7. Klicken Sie auf OK.

8. Aktivieren Sie die Option: „Alle Überwachungseinträge für untergeordnete Objekte durch vererbbare Überwachungseinträge von diesem Objekt ersetzen“.

9. Klicken Sie auf OK, um die Konfiguration abzuschließen.

Mitschnitt sicherheitsrelevanter Ereignisse (Systemevents) aktivieren

Stellen Sie sicher, dass Sie den Mitschnitt sicherheitsrelevanter Ereignisse für die gewünschten Hosts aktiviert haben, damit Sie die Ergebnisse der Zugriffsüberwachung abrufen können.

Gehen Sie dazu entweder in die Einstellungen des einzelnen Hosts oder nutzen Sie den Policy Manager.

Zugriffe unter Systemevents einsehen

Um die Systemevents über alle Hosts hinweg einzusehen, navigieren Sie zu Hosts → Systemevents.

Wollen Sie nur einen Host untersuchen, wählen Sie den entsprechenden Host aus der Übersicht aus und navigieren von der Übersicht des Hosts zu den hostspezifischen Systemevents.

Um die Ergebnisse der Systemevents nach Zugriffen auf die definierten Ordner/Dateien zu filtern, wählen Sie die Kategorie „Audit Object Access“. Zur weiteren Spezifikation können Sie die folgenden Unterkategorien wählen:

• Audit Object Read Access: Lesender Zugriff

• Audit Object Modify Access: Bearbeitender Zugriff (Inhalt und/oder Attribute)

• Audit Object Create Access: Erstellender Zugriff

• Audit Object Delete Access Löschender Zugriff

Sie erhalten zu jedem Zugriff die folgenden Informationen:

• Benutzer (Down-Level Logon Name), der zugegriffen hat.

• Prozess, über den der Zugriff erfolgt ist.

• Datei/Verzeichnis, auf das zugegriffen wurde.

Alarme konfigurieren

Um über ungewöhnliche oder unautorisierte Zugriffe informiert zu werden können Sie zwei Alarme schalten.

• Objektzugriff außerhalb der Geschäftszeiten: Legen Sie einen Zeitraum fest, zu dem Zugriffe gewöhnlich sind. Findet ein Zugriff außerhalb dieses Zeitraums statt, wird der Alarm ausgelöst.

• Unautorisierter Objektzugriff: Legen Sie Benutzer fest, denen ein Zugriff erlaubt ist. Geben Sie die Benutzer in der Down-Level Logon Name-Schreibweise (d.h. DOMAIN\UserName, z.B. AzureAD\MaxMustermann) an. Greift ein anderer Benutzer auf das Objekt zu, wird der Alarm ausgelöst.

Schalten Sie den Alarm nur auf Server, die Sie tatsächlich überwachen möchten (via Referenz oder entsprechenden Tag). Windows generiert in bestimmten Fällen Events für Ordner, die Sie nicht zur Überwachung bestimmt haben. Dies kann in der Folge zu Fehlalarmen führen.

Übersicht aller mittgeschnittenen Events

Linux

sshd

• An account was successfully logged on. (Success)

• A logon was attempted using explicit credentials. (Failure)

pam_unix

• A logon was attempted using explicit credentials. (Failure)

MySQL

• A logon was attempted using explicit credentials. (Failure)

Linux Auditing System: auditd

Um die Systemevents über das Linux Auditing System abzurufen, kann es notwendig sein, auditd manuell nachzuinstallieren.

sudo apt-get install auditd
auditd start

Bei manchen Distributionen ist auditd jedoch bereits standardmäßig installiert.

• ACCT_LOCK: User-space user account is locked by the administrator.

• ACCT_UNLOCK: User-space user account is unlocked by the administrator.

• ADD_GROUP: User-space group is added.

• ADD_USER: User-space user account is added.

• ANOM_ABEND: Processes ends abnormally (with a signal that could cause a core dump, if enabled).

• ANOM_ACCESS_FS: File or a directory access ends abnormally.

• ANOM_ADD_ACCT: User-space account addition ends abnormally.

• ANOM_AMTU_FAIL: Failure of the Abstract Machine Test Utility (AMTU) is detected.

• ANOM_CRYPTO_FAIL: Failure in the cryptographic system is detected.

• ANOM_DEL_ACCT: User-space account deletion ends abnormally.

• ANOM_EXEC: Execution of a file ends abnormally.

• ANOM_LINK: Suspicious use of file links is detected.

• ANOM_LOGIN_ACCT: Account login attempt ends abnormally.

• ANOM_LOGIN_FAILURES: Limit of failed login attempts is reached.

• ANOM_LOGIN_LOCATION: Login attempt is made from a forbidden location.

• ANOM_LOGIN_SESSIONS: Login attempt reaches the maximum amount of concurrent sessions.

• ANOM_LOGIN_TIME: Login attempt is made at a time when it is prevented by, for example, pam_time.

• ANOM_MAX_DAC: Maximum amount of Discretionary Access Control (DAC) failures is reached.

• ANOM_MAX_MAC: Maximum amount of Mandatory Access Control (MAC) failures is reached.

• ANOM_MK_EXEC: File is made executable.

• ANOM_MOD_ACCT: User-space account modification ends abnormally.

• ANOM_PROMISCUOUS: Device enables or disables promiscuous mode.

• ANOM_RBAC_FAIL: Role-Based Access Control (RBAC) self-test failure is detected.

• ANOM_RBAC_INTEGRITY_FAIL: Role-Based Access Control (RBAC) file integrity test failure is detected.

• ANOM_ROOT_TRANS: User becomes root.

• AVC: Record an SELinux permission check.

• AVC_PATH: Record the dentry and vfsmount pair when an SELinux permission check occurs.

• BPRM_FCAPS: User executes a program with a file system capability.

• CAPSET: Record the capabilities being set for process-based capabilities, for example, running as root to drop capabilities.

• CHGRP_ID: User-space group ID is changed.

• CHUSER_ID: User-space user ID is changed.

• CONFIG_CHANGE: Audit system configuration is modified.

• CRED_ACQ: User acquires user-space credentials.

• CRED_DISP: User disposes of user-space credentials.

• CRED_REFR: User refreshes their user-space credentials.

• CRYPTO_FAILURE_USER: Decrypt, encrypt, or randomize cryptographic operation fails.

• CRYPTO_IKE_SA: Internet Key Exchange Security Association is established.

• CRYPTO_IPSEC_SA: Internet Protocol Security Association is established.

• CRYPTO_KEY_USER: Record the cryptographic key identifier used for cryptographic purposes.

• CRYPTO_LOGIN: Cryptographic officer login attempt is detected.

• CRYPTO_LOGOUT: Cryptographic officer logout attempt is detected.

• CRYPTO_PARAM_CHANGE_USER: Change in a cryptographic parameter is detected.

• CRYPTO_REPLAY_USER: Replay attack is detected.

• CRYPTO_SESSION: Record parameters set during a TLS session establishment.

• CRYPTO_TEST_USER: Record cryptographic test results as required by the FIPS-140 standard.

• CWD: Record the current working directory.

• DAC_CHECK: Record DAC check results.

• DAEMON_ABORT: Daemon is stopped due to an error.

• DAEMON_ACCEPT: Auditd daemon accepts a remote connection.

• DAEMON_CLOSE: Auditd daemon closes a remote connection.

• DAEMON_CONFIG: Daemon configuration change is detected.

• DAEMON_END: Daemon is successfully stopped.

• DAEMON_ERR: Auditd daemon internal error is detected.

• DAEMON_RESUME: Auditd daemon resumes logging.

• DAEMON_ROTATE: Auditd daemon rotates the Audit log files.

• DAEMON_START: Auditd daemon is started.

• DEL_GROUP: User-space group is deleted

• DEL_USER: User-space user is deleted

• DEV_ALLOC: Device is allocated.

• DEV_DEALLOC: Device is deallocated.

• EOE: Record the end of a multi-record event.

• EXECVE: Record arguments of the execve(2) system call.

• FANOTIFY: Fanotify access decision is made.

• FD_PAIR: Record the use of the pipe and socketpair system calls.

• FEATURE_CHANGE: Audit feature changed value.

• FS_RELABEL: File system relabel operation is detected.

• GRP_AUTH: Group password is used to authenticate against a user-space group.

• GRP_CHAUTHTOK: Group account password or PIN is modified.

• GRP_MGMT: Record user-space group account attribute modification.

• INTEGRITY_DATA: Record a data integrity verification event run by the kernel.

• INTEGRITY_EVM_XATTR: EVM-covered extended attribute is modified.

• INTEGRITY_HASH: Record a hash type integrity verification event run by the kernel.

• INTEGRITY_METADATA: Record a metadata integrity verification event run by the kernel.

• INTEGRITY_PCR: Record Platform Configuration Register (PCR) invalidation messages.

• INTEGRITY_RULE: Record a policy rule.

• INTEGRITY_STATUS: Record the status of integrity verification.

• IPC: Record information about a Inter-Process Communication object referenced by a system call.

• IPC_SET_PERM: Record information about new values set by an IPC_SET control operation on an IPC object.

• KERN_MODULE: Record a kernel module name on load or unload.

• KERNEL: Record the initialization of the Audit system.

• KERNEL_OTHER: Record information from third-party kernel modules.

• LABEL_LEVEL_CHANGE: Object's level label is modified.

• LABEL_OVERRIDE: Administrator overrides an object's level label.

• LOGIN: Record relevant login information when a user log in to access the system.

• MAC_CALIPSO_ADD: NetLabel CALIPSO DOI entry is added.

• MAC_CALIPSO_DEL: NetLabel CALIPSO DOI entry is deleted.

• MAC_CHECK: User space MAC (Mandatory Access Control) decision is made.

• MAC_CIPSOV4_ADD: Commercial Internet Protocol Security Option (CIPSO) user adds a new Domain of Interpretation (DOI). Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.

• MAC_CIPSOV4_DEL: CIPSO user deletes an existing DOI. Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.

• MAC_CONFIG_CHANGE: SELinux Boolean value is changed.

• MAC_IPSEC_EVENT: Record information about an IPSec event, when one is detected, or when the IPSec configuration changes.

• MAC_MAP_ADD: New Linux Security Module (LSM) domain mapping is added. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.

• MAC_MAP_DEL: Existing LSM domain mapping is deleted. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.

• MAC_POLICY_LOAD: SELinux policy file is loaded.

• MAC_STATUS: SELinux mode (enforcing, permissive, off) is changed.

• MAC_UNLBL_ALLOW: Unlabeled traffic is allowed when using the packet labeling capabilities of the kernel provided by NetLabel.

• MAC_UNLBL_STCADD: Static label is added when using the packet labeling capabilities of the kernel provided by NetLabel.

• MAC_UNLBL_STCDEL: Static label is deleted when using the packet labeling capabilities of the kernel provided by NetLabel.

• MMAP: Record a file descriptor and flags of the mmap(2) system call.

• MQ_GETSETATTR: Record the mq_getattr(3) and mq_setattr(3) message queue attributes.

• MQ_NOTIFY: Record arguments of the mq_notify(3) system call.

• MQ_OPEN: Record arguments of the mq_open(3) system call.

• MQ_SENDRECV: Record arguments of the mq_send(3) and mq_receive(3) system calls.

• NETFILTER_CFG: Netfilter chain modifications are detected.

• NETFILTER_PKT: Record packets traversing Netfilter chains.

• OBJ_PID: Record information about a process to which a signal is sent.

• PATH: Record file name path information.

• PROCTITLE: Gives the full command-line that triggered this Audit event, triggered by a system call to the kernel.

• RESP_ACCT_LOCK: User account is locked.

• RESP_ACCT_LOCK_TIMED: User account is locked for a specified period of time.

• RESP_ACCT_REMOTE: User account is locked from a remote session.

• RESP_ACCT_UNLOCK_TIMED: User account is unlocked after a configured period of time.

• RESP_ALERT: Alert email is sent.

• RESP_ANOMALY: Anomaly was not acted upon.

• RESP_EXEC: Intrusion detection program responds to a threat originating from the execution of a program.

• RESP_HALT: System is shut down.

• RESP_KILL_PROC: Process is terminated.

• RESP_SEBOOL: SELinux Boolean value is set.

• RESP_SINGLE: System is put into single-user mode.

• RESP_TERM_ACCESS: Session is terminated.

• RESP_TERM_LOCK: Terminal is locked.

• ROLE_ASSIGN: Administrator assigns a user to an SELinux role.

• ROLE_MODIFY: Administrator modifies an SELinux role.

• ROLE_REMOVE: Administrator removes a user from an SELinux role.

• SECCOMP: SECure COMPuting event is detected.

• SELINUX_ERR: Internal SELinux error is detected.

• SERVICE_START: Service is started.

• SERVICE_STOP: Service is stopped.

• SOCKADDR: Record a socket address.

• SOCKETCALL: Record arguments of the sys_socketcall system call (used to multiplex many socket-related system calls).

• SOFTWARE_UPDATE: Record software update events.

• SYSCALL: Record a system call to the kernel.

• SYSTEM_BOOT: System is booted up.

• SYSTEM_RUNLEVEL: System's run level is changed.

• SYSTEM_SHUTDOWN: System is shut down.

• TEST: Record the success value of a test message.

• TIME_ADJNTPVAL: System clock is modified.

• TIME_INJOFFSET: Timekeeping offset is injected to the sytem clock.

• TRUSTED_APP: The record of this type can be used by third party application that require auditing.

• TTY: TTY input was sent to an administrative process.

• USER_ACCT: User-space user authorization attempt is detected.

• USER_AUTH: User-space user authentication attempt is detected.

• USER_AVC: User-space AVC message is generated.

• USER_CHAUTHTOK: User account password or PIN is modified.

• USER_CMD: User-space shell command is executed.

• USER_DEVICE: User-space hotplug device is changed.

• USER_END: User-space session is terminated.

• USER_ERR: User account state error is detected.

• USER_LABELED_EXPORT: Object is exported with an SELinux label.

• USER_LOGIN: User logs in.

• USER_LOGOUT: User logs out.

• USER_MAC_POLICY_LOAD: User-space daemon loads an SELinux policy.

• USER_MGMT: Record user-space user account attribute modification.

• USER_ROLE_CHANGE: User's SELinux role is changed.

• USER_SELINUX_ERR: User-space SELinux error is detected.

• USER_START: User-space session is started.

• USER_TTY: Explanatory message about TTY input to an administrative process is sent from user-space.

• USER_UNLABELED_EXPORT: Object is exported without SELinux label.

• USYS_CONFIG: User-space system configuration change is detected.

• VIRT_CONTROL: Virtual machine is started, paused, or stopped.

• VIRT_MACHINE_ID: Record the binding of a label to a virtual machine.

• VIRT_RESOURCE: Record resource assignment of a virtual machine.

Windows

• 1100: The event logging service has shut down (Success)

• 1101: Audit events have been dropped by the transport. (Success)

• 1104: The security Log is now full (Success)

• 1105: Event log automatic backup (Success)

• 1108: The event logging service encountered an error (Failure)

• 4608: Windows is starting up (Success)

• 4609: Windows is shutting down (Success)

• 4610: An authentication package has been loaded by the Local Security Authority (Success)

• 4611: A trusted logon process has been registered with the Local Security Authority (Success)

• 4612: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. (Success)

• 4614: A notification package has been loaded by the Security Account Manager. (Success)

• 4615: Invalid use of LPC port (Success)

• 4616: The system time was changed. (Success)

• 4618: A monitored security event pattern has occurred (Success)

• 4621: Administrator recovered system from CrashOnAuditFail (Success)

• 4622: A security package has been loaded by the Local Security Authority. (Success)

• 4624: An account was successfully logged on (Success)

• 4625: An account failed to log on (Failure)

• 4626: User/Device claims information (Success)

• 4646: IKE DoS-prevention mode started (Success)

• 4647: User initiated logoff (Success)

• 4649: A replay attack was detected (Success)

• 4650: An IPsec Main Mode security association was established (Success)

• 4651: An IPsec Main Mode security association was established (Success)

• 4652: An IPsec Main Mode negotiation failed (Failure)

• 4653: An IPsec Main Mode negotiation failed (Failure)

• 4654: An IPsec Quick Mode negotiation failed (Failure)

• 4655: An IPsec Main Mode security association ended (Success)

• 4656: A handle to an object was requested

• 4657: A registry value was modified (Success)

• 4658: The handle to an object was closed

• 4659: A handle to an object was requested with intent to delete (Success)

• 4660: An object was deleted

• 4661: A handle to an object was requested (Success)

• 4663: An attempt was made to access an object

• 4664: An attempt was made to create a hard link (Success)

• 4665: An attempt was made to create an application client context. (Success)

• 4666: An application attempted an operation (Success)

• 4667: An application client context was deleted (Success)

• 4668: An application was initialized (Success)

• 4670: Permissions on an object were changed (Success)

• 4671: An application attempted to access a blocked ordinal through the TBS (Success)

• 4673: A privileged service was called (Success)

• 4674: An operation was attempted on a privileged object (Success)

• 4675: SIDs were filtered (Success)

• 4691: Indirect access to an object was requested (Success)

• 4692: Backup of data protection master key was attempted (Success)

• 4693: Recovery of data protection master key was attempted (Success)

• 4694: Protection of auditable protected data was attempted (Success)

• 4695: Unprotection of auditable protected data was attempted (Failure)

• 4696: A primary token was assigned to process (Success)

• 4697: A service was installed in the system (Success)

• 4698: A scheduled task was created (Success)

• 4699: A scheduled task was deleted (Success)

• 4700: A scheduled task was enabled (Success)

• 4701: A scheduled task was disabled (Success)

• 4703: A token right was adjusted (Success)

• 4704: A user right was assigned (Success)

• 4705: A user right was removed (Success)

• 4706: A new trust was created to a domain (Success)

• 4707: A trust to a domain was removed (Success)

• 4709: IPsec Services was started (Success)

• 4710: IPsec Services was disabled (Success)

• 4711: PAStore Engine (1%) (Success)

• 4712: IPsec Services encountered a potentially serious failure (Failure)

• 4713: Kerberos policy was changed (Success)

• 4714: Encrypted data recovery policy was changed (Success)

• 4715: The audit policy (SACL) on an object was changed (Success)

• 4716: Trusted domain information was modified (Success)

• 4717: System security access was granted to an account (Success)

• 4718: System security access was removed from an account (Success)

• 4719: System audit policy was changed (Success)

• 4720: A user account was created (Success)

• 4722: A user account was enabled (Success)

• 4723: An attempt was made to change an account's password (Success)

• 4724: An attempt was made to reset an accounts password (Success)

• 4725: A user account was disabled (Success)

• 4726: A user account was deleted (Success)

• 4727: A security-enabled global group was created (Success)

• 4728: A member was added to a security-enabled global group (Success)

• 4729: A member was removed from a security-enabled global group (Success)

• 4730: A security-enabled global group was deleted (Success)

• 4731: A security-enabled local group was created (Success)

• 4732: A member was added to a security-enabled local group (Success)

• 4733: A member was removed from a security-enabled local group (Success)

• 4734: A security-enabled local group was deleted (Success)

• 4735: A security-enabled local group was changed (Success)

• 4737: A security-enabled global group was changed (Success)

• 4738: A user account was changed (Success)

• 4739: Domain Policy was changed (Success)

• 4740: A user account was locked out (Success)

• 4741: A computer account was created (Success)

• 4742: A computer account was changed (Success)

• 4743: A computer account was deleted (Success)

• 4744: A security-disabled local group was created (Success)

• 4745: A security-disabled local group was changed (Success)

• 4746: A member was added to a security-disabled local group (Success)

• 4747: A member was removed from a security-disabled local group (Success)

• 4748: A security-disabled local group was deleted (Success)

• 4749: A security-disabled global group was created (Success)

• 4750: A security-disabled global group was changed (Success)

• 4751: A member was added to a security-disabled global group (Success)

• 4752: A member was removed from a security-disabled global group (Success)

• 4753: A security-disabled global group was deleted (Success)

• 4754: A security-enabled universal group was created (Success)

• 4755: A security-enabled universal group was changed (Success)

• 4756: A member was added to a security-enabled universal group (Success)

• 4757: A member was removed from a security-enabled universal group (Success)

• 4758: A security-enabled universal group was deleted (Success)

• 4759: A security-disabled universal group was created (Success)

• 4760: A security-disabled universal group was changed (Success)

• 4761: A member was added to a security-disabled universal group (Success)

• 4762: A member was removed from a security-disabled universal group (Success)

• 4763: A security-disabled universal group was deleted (Success)

• 4764: A groups type was changed (Success)

• 4765: SID History was added to an account (Success)

• 4766: An attempt to add SID History to an account failed (Failure)

• 4767: A user account was unlocked (Success)

• 4771: Kerberos pre-authentication failed (Failure)

• 4772: A Kerberos authentication ticket request failed (Failure)

• 4773: A Kerberos service ticket request failed (Failure)

• 4774: An account was mapped for logon (Success)

• 4775: An account could not be mapped for logon (Failure)

• 4778: A session was reconnected to a Window Station (Success)

• 4779: A session was disconnected from a Window Station (Success)

• 4780: The ACL was set on accounts which are members of administrators groups (Success)

• 4781: The name of an account was changed (Success)

• 4782: The password hash an account was accessed (Success)

• 4783: A basic application group was created (Success)

• 4784: A basic application group was changed (Success)

• 4785: A member was added to a basic application group (Success)

• 4786: A member was removed from a basic application group (Success)

• 4787: A non-member was added to a basic application group (Success)

• 4788: A non-member was removed from a basic application group.. (Success)

• 4789: A basic application group was deleted (Success)

• 4790: An LDAP query group was created (Success)

• 4791: A basic application group was changed (Success)

• 4792: An LDAP query group was deleted (Success)

• 4793: The Password Policy Checking API was called (Success)

• 4794: An attempt was made to set the Directory Services Restore Mode administrator password (Success)

• 4797: An attempt was made to query the existence of a blank password for an account (Success)

• 4800: The workstation was locked (Success)

• 4801: The workstation was unlocked (Success)

• 4803: The screen saver was dismissed (Success)

• 4816: RPC detected an integrity violation while decrypting an incoming message (Success)

• 4818: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy (Success)

• 4819: Central Access Policies on the machine have been changed (Success)

• 4820: A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions (Failure)

• 4821: A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions (Failure)

• 4822: NTLM authentication failed because the account was a member of the Protected User group (Failure)

• 4823: NTLM authentication failed because access control restrictions are required (Failure)

• 4824: Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group (Failure)

• 4825: A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group (Success)

• 4826: Boot Configuration Data loaded (Success)

• 4830: SID History was removed from an account (Success)

• 4864: A namespace collision was detected (Success)

• 4865: A trusted forest information entry was added (Success)

• 4866: A trusted forest information entry was removed (Success)

• 4867: A trusted forest information entry was modified (Success)

• 4868: The certificate manager denied a pending certificate request (Success)

• 4869: Certificate Services received a resubmitted certificate request (Success)

• 4870: Certificate Services revoked a certificate (Success)

• 4871: Certificate Services received a request to publish the certificate revocation list (CRL) (Success)

• 4872: Certificate Services published the certificate revocation list (CRL) (Success)

• 4873: A certificate request extension changed (Success)

• 4874: One or more certificate request attributes changed. (Success)

• 4875: Certificate Services received a request to shut down (Success)

• 4876: Certificate Services backup started (Success)

• 4877: Certificate Services backup completed (Success)

• 4878: Certificate Services restore started (Success)

• 4879: Certificate Services restore completed (Success)

• 4880: Certificate Services started (Success)

• 4881: Certificate Services stopped (Success)

• 4882: The security permissions for Certificate Services changed (Success)

• 4883: Certificate Services retrieved an archived key (Success)

• 4884: Certificate Services imported a certificate into its database (Success)

• 4885: The audit filter for Certificate Services changed (Success)

• 4886: Certificate Services received a certificate request (Success)

• 4887: Certificate Services approved a certificate request and issued a certificate (Success)

• 4888: Certificate Services denied a certificate request (Failure)

• 4889: Certificate Services set the status of a certificate request to pending (Success)

• 4890: The certificate manager settings for Certificate Services changed. (Success)

• 4891: A configuration entry changed in Certificate Services (Success)

• 4892: A property of Certificate Services changed (Success)

• 4893: Certificate Services archived a key (Success)

• 4894: Certificate Services imported and archived a key (Success)

• 4895: Certificate Services published the CA certificate to Active Directory Domain Services (Success)

• 4896: One or more rows have been deleted from the certificate database (Success)

• 4897: Role separation enabled (Success)

• 4898: Certificate Services loaded a template (Success)

• 4899: A Certificate Services template was updated (Success)

• 4900: Certificate Services template security was updated (Success)

• 4902: The Per-user audit policy table was created (Success)

• 4904: An attempt was made to register a security event source (Success)

• 4905: An attempt was made to unregister a security event source (Success)

• 4906: The CrashOnAuditFail value has changed (Success)

• 4908: Special Groups Logon table modified (Success)

• 4909: The local policy settings for the TBS were changed (Success)

• 4910: The group policy settings for the TBS were changed (Success)

• 4911: Resource attributes of the object were changed (Success)

• 4912: Per User Audit Policy was changed (Success)

• 4913: Central Access Policy on the object was changed (Success)

• 4928: An Active Directory replica source naming context was established (Success)

• 4929: An Active Directory replica source naming context was removed (Success)

• 4930: An Active Directory replica source naming context was modified (Success)

• 4931: An Active Directory replica destination naming context was modified (Success)

• 4932: Synchronization of a replica of an Active Directory naming context has begun (Success)

• 4933: Synchronization of a replica of an Active Directory naming context has ended (Success)

• 4934: Attributes of an Active Directory object were replicated (Success)

• 4935: Replication failure begins (Success)

• 4936: Replication failure ends (Success)

• 4937: A lingering object was removed from a replica (Success)

• 4944: The following policy was active when the Windows Firewall started (Success)

• 4945: A rule was listed when the Windows Firewall started (Success)

• 4946: A change has been made to Windows Firewall exception list. A rule was added (Success)

• 4947: A change has been made to Windows Firewall exception list. A rule was modified (Success)

• 4948: A change has been made to Windows Firewall exception list. A rule was deleted (Success)

• 4949: Windows Firewall settings were restored to the default values (Success)

• 4950: A Windows Firewall setting has changed (Success)

• 4951: A rule has been ignored because its major version number was not recognized by Windows Firewall (Success)

• 4952: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall (Success)

• 4953: A rule has been ignored by Windows Firewall because it could not parse the rule (Success)

• 4954: Windows Firewall Group Policy settings has changed. The new settings have been applied (Success)

• 4956: Windows Firewall has changed the active profile (Success)

• 4957: Windows Firewall did not apply the following rule (Failure)

• 4958: Windows Firewall did not apply the following rule because the rule referred to items not configured

• on this computer (Success)

• 4960: IPsec dropped an inbound packet that failed an integrity check (Success)

• 4961: IPsec dropped an inbound packet that failed a replay check (Success)

• 4962: IPsec dropped an inbound packet that failed a replay check (Success)

• 4963: IPsec dropped an inbound clear text packet that should have been secured (Success)

• 4964: Special groups have been assigned to a new logon (Success)

• 4965: IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). (Success)

• 4976: During Main Mode negotiation, IPsec received an invalid negotiation packet. (Success)

• 4977: During Quick Mode negotiation, IPsec received an invalid negotiation packet. (Success)

• 4978: During Extended Mode negotiation, IPsec received an invalid negotiation packet. (Success)

• 4979: IPsec Main Mode and Extended Mode security associations were established. (Success)

• 4980: IPsec Main Mode and Extended Mode security associations were established (Success)

• 4981: IPsec Main Mode and Extended Mode security associations were established (Success)

• 4982: IPsec Main Mode and Extended Mode security associations were established (Success)

• 4983: An IPsec Extended Mode negotiation failed (Success)

• 4984: An IPsec Extended Mode negotiation failed (Success)

• 4985: The state of a transaction has changed (Success)

• 5024: The Windows Firewall Service has started successfully (Success)

• 5025: The Windows Firewall Service has been stopped (Success)

• 5027: The Windows Firewall Service was unable to retrieve the security policy from the local storage (Success)

• 5028: The Windows Firewall Service was unable to parse the new security policy. (Success)

• 5029: The Windows Firewall Service failed to initialize the driver (Success)

• 5030: The Windows Firewall Service failed to start (Success)

• 5031: The Windows Firewall Service blocked an application from accepting incoming connections on the network. (Failure)

• 5032: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network (Failure)

• 5033: The Windows Firewall Driver has started successfully (Success)

• 5034: The Windows Firewall Driver has been stopped (Success)

• 5035: The Windows Firewall Driver failed to start (Failure)

• 5037: The Windows Firewall Driver detected critical runtime error. Terminating (Failure)

• 5038: Code integrity determined that the image hash of a file is not valid (Failure)

• 5039: A registry key was virtualized. (Success)

• 5040: A change has been made to IPsec settings. An Authentication Set was added. (Success)

• 5041: A change has been made to IPsec settings. An Authentication Set was modified (Success)

• 5042: A change has been made to IPsec settings. An Authentication Set was deleted (Success)

• 5043: A change has been made to IPsec settings. A Connection Security Rule was added (Success)

• 5044: A change has been made to IPsec settings. A Connection Security Rule was modified (Success)

• 5045: A change has been made to IPsec settings. A Connection Security Rule was deleted (Success)

• 5046: A change has been made to IPsec settings. A Crypto Set was added (Success)

• 5047: A change has been made to IPsec settings. A Crypto Set was modified (Success)

• 5048: A change has been made to IPsec settings. A Crypto Set was deleted (Success)

• 5049: An IPsec Security Association was deleted (Success)

• 5050: An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE (Failure)

• 5051: A file was virtualized (Success)

• 5056: A cryptographic self test was performed (Success)

• 5057: A cryptographic primitive operation failed (Failure)

• 5060: Verification operation failed (Failure)

• 5062: A kernel-mode cryptographic self test was performed (Success)

• 5063: A cryptographic provider operation was attempted (Success)

• 5064: A cryptographic context operation was attempted (Success)

• 5065: A cryptographic context modification was attempted (Success)

• 5066: A cryptographic function operation was attempted (Success)

• 5067: A cryptographic function modification was attempted (Success)

• 5068: A cryptographic function provider operation was attempted (Success)

• 5069: A cryptographic function property operation was attempted (Success)

• 5070: A cryptographic function property operation was attempted (Success)

• 5071: Key access denied by Microsoft key distribution service (Failure)

• 5120: OCSP Responder Service Started (Success)

• 5121: OCSP Responder Service Stopped (Success)

• 5122: A Configuration entry changed in the OCSP Responder Service (Success)

• 5123: A configuration entry changed in the OCSP Responder Service (Success)

• 5124: A security setting was updated on OCSP Responder Service (Success)

• 5125: A request was submitted to OCSP Responder Service (Success)

• 5126: Signing Certificate was automatically updated by the OCSP Responder Service (Success)

• 5127: The OCSP Revocation Provider successfully updated the revocation information (Success)

• 5136: A directory service object was modified (Success)

• 5137: A directory service object was created (Success)

• 5138: A directory service object was undeleted (Success)

• 5139: A directory service object was moved (Success)

• 5140: A network share object was accessed (Success)

• 5141: A directory service object was deleted (Failure)

• 5142: A network share object was added. (Success)

• 5143: A network share object was modified (Success)

• 5144: A network share object was deleted. (Success)

• 5145: A network share object was checked to see whether client can be granted desired access (Success)

• 5146: The Windows Filtering Platform has blocked a packet (Failure)

• 5147: A more restrictive Windows Filtering Platform filter has blocked a packet (Failure)

• 5148: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. (Success)

• 5149: The DoS attack has subsided and normal processing is being resumed. (Success)

• 5150: The Windows Filtering Platform has blocked a packet. (Success)

• 5151: A more restrictive Windows Filtering Platform filter has blocked a packet. (Success)

• 5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections (Success)

• 5155: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections (Success)

• 5157: The Windows Filtering Platform has blocked a connection (Failure)

• 5159: The Windows Filtering Platform has blocked a bind to a local port (Failure)

• 5168: Spn check for SMB/SMB2 fails. (Success)

• 5169: A directory service object was modified (Success)

• 5170: A directory service object was modified during a background cleanup task (Success)

• 5376: Credential Manager credentials were backed up (Success)

• 5377: Credential Manager credentials were restored from a backup (Success)

• 5378: The requested credentials delegation was disallowed by policy (Failure)

• 5380: Vault Find Credential (Success)

• 5381: Vault credentials were read (Success)

• 5382: Vault credentials were read (Success)

• 5440: The following callout was present when the Windows Filtering Platform Base Filtering Engine started (Success)

• 5441: The following filter was present when the Windows Filtering Platform Base Filtering Engine started (Success)

• 5442: The following provider was present when the Windows Filtering Platform Base Filtering Engine started (Success)

• 5443: The following provider context was present when the Windows Filtering Platform Base Filtering Engine started (Success)

• 5444: The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started (Success)

• 5446: A Windows Filtering Platform callout has been changed (Success)

• 5447: A Windows Filtering Platform filter has been changed (Success)

• 5448: A Windows Filtering Platform provider has been changed (Success)

• 5449: A Windows Filtering Platform provider context has been changed (Success)

• 5450: A Windows Filtering Platform sub-layer has been changed (Success)

• 5451: An IPsec Quick Mode security association was established (Success)

• 5452: An IPsec Quick Mode security association ended (Success)

• 5453: An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started (Success)

• 5456: PAStore Engine applied Active Directory storage IPsec policy on the computer (Success)

• 5457: PAStore Engine failed to apply Active Directory storage IPsec policy on the computer (Success)

• 5458: PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer (Success)

• 5459: PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer (Failure)

• 5460: PAStore Engine applied local registry storage IPsec policy on the computer (Success)

• 5461: PAStore Engine failed to apply local registry storage IPsec policy on the computer (Failure)

• 5462: PAStore Engine failed to apply some rules of the active IPsec policy on the computer (Failure)

• 5463: PAStore Engine polled for changes to the active IPsec policy and detected no changes (Success)

• 5464: PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services (Success)

• 5465: PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully (Success)

• 5466: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead (Failure)

• 5467: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy (Failure)

• 5468: PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes (Success)

• 5471: PAStore Engine loaded local storage IPsec policy on the computer (Success)

• 5472: PAStore Engine failed to load local storage IPsec policy on the computer (Failure)

• 5473: PAStore Engine loaded directory storage IPsec policy on the computer (Success)

• 5474: PAStore Engine failed to load directory storage IPsec policy on the computer (Failure)

• 5477: PAStore Engine failed to add quick mode filter (Failure)

• 5478: IPsec Services has started successfully (Success)

• 5479: IPsec Services has been shut down successfully (Success)

• 5480: IPsec Services failed to get the complete list of network interfaces on the computer (Failure)

• 5483: IPsec Services failed to initialize RPC server. IPsec Services could not be started (Failure)

• 5484: IPsec Services has experienced a critical failure and has been shut down (Failure)

• 5485: IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces (Failure)

• 5632: A request was made to authenticate to a wireless network (Success)

• 5633: A request was made to authenticate to a wired network (Success)

• 5712: A Remote Procedure Call (RPC) was attempted (Success)

• 5888: An object in the COM+ Catalog was modified (Success)

• 5889: An object was deleted from the COM+ Catalog (Success)

• 5890: An object was added to the COM+ Catalog (Success)

• 6144: Security policy in the group policy objects has been applied successfully (Success)

• 6145: One or more errors occured while processing security policy in the group policy objects (Failure)

• 6272: Network Policy Server granted access to a user (Success)

• 6273: Network Policy Server denied access to a user (Success)

• 6274: Network Policy Server discarded the request for a user (Success)

• 6275: Network Policy Server discarded the accounting request for a user (Success)

• 6276: Network Policy Server quarantined a user (Success)

• 6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy (Success)

• 6278: Network Policy Server granted full access to a user because the host met the defined health policy (Success)

• 6279: Network Policy Server locked the user account due to repeated failed authentication attempts (Success)

• 6280: Network Policy Server unlocked the user account (Success)

• 6281: Code Integrity determined that the page hashes of an image file are not valid... (Success)

• 6400: BranchCache: Received an incorrectly formatted response while discovering availability of content.

• (Failure)

• 6401: BranchCache: Received invalid data from a peer. Data discarded. (Failure)

• 6402: BranchCache: The message to the hosted cache offering it data is incorrectly formatted. (Failure)

• 6403: BranchCache: The hosted cache sent an incorrectly formatted response to the client's message to offer it data. (Failure)

• 6404: BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate. (Failure)

• 6405: BranchCache: %2 instance(s) of event id %1 occurred. (Success)

• 6406: A module registered to Windows Firewall to control filtering (Success)

• 6407: A module unregistered from Firewall (Success)

• 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. (Failure)

• 6409: BranchCache: A service connection point object could not be parsed (Failure)

• 6410: Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues (Failure)

• 6416: A new external device was recognized by the system. (Success)

• 6417: The FIPS mode crypto selftests succeeded (Success)

• 6418: The FIPS mode crypto selftests failed (Success)

• 6419: A request was made to disable a device (Success)

• 6420: A device was disabled (Success)

• 6421: A request was made to enable a device (Success)

• 6422: A device was enabled (Success)

• 6423: The installation of this device is forbidden by system policy (Failure)

• 6424: The installation of this device was allowed, after having previously been forbidden by policy (Success)

• 8191: Highest System-Defined Audit Message Value (Success)