Welche Systemereignisse werden von Enginsight auf überwachten Hosts mitgeschnitten?
Enginsight kann verschiedene sicherheitsrelevante Ereignisse aus den Event-Logs von Hosts (Servern und Clients) mit installiertem Pulsar mitschneiden.
Diese Systemereignisse kannst du in der Plattform unter Hosts → Management → Systemevents zentral einsehen. Je nach installiertem Betriebssystem werden unterschiedliche Systemereignisse mitgeschnitten.
Linux/Unix-Systeme
Secure Shell Daemon (sshd)
sshd ist der Server-Prozess, der sichere, verschlüsselte Fernverbindungen zu einem Linux-System über das SSH-Protokoll ermöglicht und Benutzer authentifiziert.
Folgende Systemereignisse können angezeigt werden (engl.):
An account was successfully logged on.
A logon was attempted using explicit credentials.
Pluggable Authentication Module (pam_unix)
pam-unix ist das Standard-Modul in Unix-ähnlichen Systemen für die traditionelle Passwort-Authentifizierung.
Folgendes Systemereignis kann angezeigt werden (engl.):
A logon was attempted using explicit credentials.
MySQL (mysql)
Für den mysql-Dienst kann folgendes Systemereignis angezeigt werden (engl.):
A logon was attempted using explicit credentials.
Linux Audit Daemon (auditd)
auditd ist ein Userspace-Framework in Linux, das sicherheitsrelevante Ereignisse und Systemaktivitäten überwacht und protokolliert.
Bitte beachte: Um Systemereignisse über den Linux Audit Daemon abzurufen, kann es bei manchen Linux-Distributionen notwendig sein, auditd manuell zu installieren. Führe dazu folgende Befehle aus:
ACCT_LOCK
User-space user account is locked by the administrator.
ACCT_UNLOCK
User-space user account is unlocked by the administrator.
ADD_GROUP
User-space group is added.
ADD_USER
User-space user account is added.
ANOM_ABEND
Processes ends abnormally (with a signal that could cause a core dump, if enabled).
ANOM_ACCESS_FS
File or a directory access ends abnormally.
ANOM_ADD_ACCT
User-space account addition ends abnormally.
ANOM_AMTU_FAIL
Failure of the Abstract Machine Test Utility (AMTU) is detected.
ANOM_CRYPTO_FAIL
Failure in the cryptographic system is detected.
ANOM_DEL_ACCT
User-space account deletion ends abnormally.
ANOM_EXEC
Execution of a file ends abnormally.
ANOM_LINK
Suspicious use of file links is detected.
ANOM_LOGIN_ACCT
Account login attempt ends abnormally.
ANOM_LOGIN_FAILURES
Limit of failed login attempts is reached.
ANOM_LOGIN_LOCATION
Login attempt is made from a forbidden location.
ANOM_LOGIN_SESSIONS
Login attempt reaches the maximum amount of concurrent sessions.
ANOM_LOGIN_TIME
Login attempt is made at a time when it is prevented by, for example, pam_time.
ANOM_MAX_DAC
Maximum amount of Discretionary Access Control (DAC) failures is reached.
ANOM_MAX_MAC
Maximum amount of Mandatory Access Control (MAC) failures is reached.
ANOM_MK_EXEC
File is made executable.
ANOM_MOD_ACCT
User-space account modification ends abnormally.
ANOM_PROMISCUOUS
Device enables or disables promiscuous mode.
ANOM_RBAC_FAIL
Role-Based Access Control (RBAC) self-test failure is detected.
ANOM_RBAC_INTEGRITY_FAIL
Role-Based Access Control (RBAC) file integrity test failure is detected.
ANOM_ROOT_TRANS
User becomes root.
AVC
Record an SELinux permission check.
AVC_PATH
Record the dentry and vfsmount pair when an SELinux permission check occurs.
BPRM_FCAPS
User executes a program with a file system capability.
CAPSET
Record the capabilities being set for process-based capabilities, for example, running as root to drop capabilities.
CHGRP_ID
User-space group ID is changed.
CHUSER_ID
User-space user ID is changed.
CONFIG_CHANGE
Audit system configuration is modified.
CRED_ACQ
User acquires user-space credentials.
CRED_DISP
User disposes of user-space credentials.
CRED_REFR
User refreshes their user-space credentials.
CRYPTO_FAILURE_USER
Decrypt, encrypt, or randomize cryptographic operation fails.
CRYPTO_IKE_SA
Internet Key Exchange Security Association is established.
CRYPTO_IPSEC_SA
Internet Protocol Security Association is established.
CRYPTO_KEY_USER
Record the cryptographic key identifier used for cryptographic purposes.
CRYPTO_LOGIN
Cryptographic officer login attempt is detected.
CRYPTO_LOGOUT
Cryptographic officer logout attempt is detected.
CRYPTO_PARAM_CHANGE_USER
Change in a cryptographic parameter is detected.
CRYPTO_REPLAY_USER
Replay attack is detected.
CRYPTO_SESSION
Record parameters set during a TLS session establishment.
CRYPTO_TEST_USER
Record cryptographic test results as required by the FIPS-140 standard.
CWD
Record the current working directory.
DAC_CHECK
Record DAC check results.
DAEMON_ABORT
Daemon is stopped due to an error.
DAEMON_ACCEPT
Auditd daemon accepts a remote connection.
DAEMON_CLOSE
Auditd daemon closes a remote connection.
DAEMON_CONFIG
Daemon configuration change is detected.
DAEMON_END
Daemon is successfully stopped.
DAEMON_ERR
Auditd daemon internal error is detected.
DAEMON_RESUME
Auditd daemon resumes logging.
DAEMON_ROTATE
Auditd daemon rotates the Audit log files.
DAEMON_START
Auditd daemon is started.
DEL_GROUP
User-space group is deleted
DEL_USER
User-space user is deleted
DEV_ALLOC
Device is allocated.
DEV_DEALLOC
Device is deallocated.
EOE
Record the end of a multi-record event.
EXECVE
Record arguments of the execve(2) system call.
FANOTIFY
Fanotify access decision is made.
FD_PAIR
Record the use of the pipe and socketpair system calls.
FEATURE_CHANGE
Audit feature changed value.
FS_RELABEL
File system relabel operation is detected.
GRP_AUTH
Group password is used to authenticate against a user-space group.
GRP_CHAUTHTOK
Group account password or PIN is modified.
GRP_MGMT
Record user-space group account attribute modification.
INTEGRITY_DATA
Record a data integrity verification event run by the kernel.
INTEGRITY_EVM_XATTR
EVM-covered extended attribute is modified.
INTEGRITY_HASH
Record a hash type integrity verification event run by the kernel.
INTEGRITY_METADATA
Record a metadata integrity verification event run by the kernel.
INTEGRITY_PCR
Record Platform Configuration Register (PCR) invalidation messages.
INTEGRITY_RULE
Record a policy rule.
INTEGRITY_STATUS
Record the status of integrity verification.
IPC
Record information about a Inter-Process Communication object referenced by a system call.
IPC_SET_PERM
Record information about new values set by an IPC_SET control operation on an IPC object.
KERN_MODULE
Record a kernel module name on load or unload.
KERNEL
Record the initialization of the Audit system.
KERNEL_OTHER
Record information from third-party kernel modules.
LABEL_LEVEL_CHANGE
Object's level label is modified.
LABEL_OVERRIDE
Administrator overrides an object's level label.
LOGIN
Record relevant login information when a user log in to access the system.
MAC_CALIPSO_ADD
NetLabel CALIPSO DOI entry is added.
MAC_CALIPSO_DEL
NetLabel CALIPSO DOI entry is deleted.
MAC_CHECK
User space MAC (Mandatory Access Control) decision is made.
MAC_CIPSOV4_ADD
Commercial Internet Protocol Security Option (CIPSO) user adds a new Domain of Interpretation (DOI). Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_CIPSOV4_DEL
CIPSO user deletes an existing DOI. Adding DOIs is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_CONFIG_CHANGE
SELinux Boolean value is changed.
MAC_IPSEC_EVENT
Record information about an IPSec event, when one is detected, or when the IPSec configuration changes.
MAC_MAP_ADD
New Linux Security Module (LSM) domain mapping is added. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_MAP_DEL
Existing LSM domain mapping is deleted. LSM domain mapping is a part of the packet labeling capabilities of the kernel provided by NetLabel.
MAC_POLICY_LOAD
SELinux policy file is loaded.
MAC_STATUS
SELinux mode (enforcing, permissive, off) is changed.
MAC_UNLBL_ALLOW
Unlabeled traffic is allowed when using the packet labeling capabilities of the kernel provided by NetLabel.
MAC_UNLBL_STCADD
Static label is added when using the packet labeling capabilities of the kernel provided by NetLabel.
MAC_UNLBL_STCDEL
Static label is deleted when using the packet labeling capabilities of the kernel provided by NetLabel.
MMAP
Record a file descriptor and flags of the mmap(2) system call.
MQ_GETSETATTR
Record the mq_getattr(3) and mq_setattr(3) message queue attributes.
MQ_NOTIFY
Record arguments of the mq_notify(3) system call.
MQ_OPEN
Record arguments of the mq_open(3) system call.
MQ_SENDRECV
Record arguments of the mq_send(3) and mq_receive(3) system calls.
NETFILTER_CFG
Netfilter chain modifications are detected.
NETFILTER_PKT
Record packets traversing Netfilter chains.
OBJ_PID
Record information about a process to which a signal is sent.
PATH
Record file name path information.
PROCTITLE
Gives the full command-line that triggered this Audit event, triggered by a system call to the kernel.
RESP_ACCT_LOCK
User account is locked.
RESP_ACCT_LOCK_TIMED
User account is locked for a specified period of time.
RESP_ACCT_REMOTE
User account is locked from a remote session.
RESP_ACCT_UNLOCK_TIMED
User account is unlocked after a configured period of time.
RESP_ALERT
Alert email is sent.
RESP_ANOMALY
Anomaly was not acted upon.
RESP_EXEC
Intrusion detection program responds to a threat originating from the execution of a program.
RESP_HALT
System is shut down.
RESP_KILL_PROC
Process is terminated.
RESP_SEBOOL
SELinux Boolean value is set.
RESP_SINGLE
System is put into single-user mode.
RESP_TERM_ACCESS
Session is terminated.
RESP_TERM_LOCK
Terminal is locked.
ROLE_ASSIGN
Administrator assigns a user to an SELinux role.
ROLE_MODIFY
Administrator modifies an SELinux role.
ROLE_REMOVE
Administrator removes a user from an SELinux role.
SECCOMP
SECure COMPuting event is detected.
SELINUX_ERR
Internal SELinux error is detected.
SERVICE_START
Service is started.
SERVICE_STOP
Service is stopped.
SOCKADDR
Record a socket address.
SOCKETCALL
Record arguments of the sys_socketcall system call (used to multiplex many socket-related system calls).
SOFTWARE_UPDATE
Record software update events.
SYSCALL
Record a system call to the kernel.
SYSTEM_BOOT
System is booted up.
SYSTEM_RUNLEVEL
System's run level is changed.
SYSTEM_SHUTDOWN
System is shut down.
TEST
Record the success value of a test message.
TIME_ADJNTPVAL
System clock is modified.
TIME_INJOFFSET
Timekeeping offset is injected to the sytem clock.
TRUSTED_APP
The record of this type can be used by third party application that require auditing.
TTY
TTY input was sent to an administrative process.
USER_ACCT
User-space user authorization attempt is detected.
USER_AUTH
User-space user authentication attempt is detected.
USER_AVC
User-space AVC message is generated.
USER_CHAUTHTOK
User account password or PIN is modified.
USER_CMD
User-space shell command is executed.
USER_DEVICE
User-space hotplug device is changed.
USER_END
User-space session is terminated.
USER_ERR
User account state error is detected.
USER_LABELED_EXPORT
Object is exported with an SELinux label.
USER_LOGIN
User logs in.
USER_LOGOUT
User logs out.
USER_MAC_POLICY_LOAD
User-space daemon loads an SELinux policy.
USER_MGMT
Record user-space user account attribute modification.
USER_ROLE_CHANGE
User's SELinux role is changed.
USER_SELINUX_ERR
User-space SELinux error is detected.
USER_START
User-space session is started.
USER_TTY
Explanatory message about TTY input to an administrative process is sent from user-space.
USER_UNLABELED_EXPORT
Object is exported without SELinux label.
USYS_CONFIG
User-space system configuration change is detected.
VIRT_CONTROL
Virtual machine is started, paused, or stopped.
VIRT_MACHINE_ID
Record the binding of a label to a virtual machine.
VIRT_RESOURCE
Record resource assignment of a virtual machine.
Windows-Systeme
Auf Windows-Systemen werden folgende Events (Ereignisse) mitgeschnitten:
Bitte beachte: Falls verfügbar, findest du in der folgenden Tabelle Verlinkungen zur offiziellen Dokumentation von Microsoft. Für die Inhalte und Aktualität der Dokumentation von Drittanbietern übernimmt Enginsight keine Gewähr.
The event logging service has shut down.
1101
Audit events have been dropped by the transport.
The security log is now full.
Event log automatic backup
The event logging service encountered an error.
Windows is starting up.
4609
Windows is shutting down.
An authentication package has been loaded by the Local Security Authority.
A trusted logon process has been registered with the Local Security Authority.
Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
A notification package has been loaded by the Security Account Manager.
Invalid use of LPC port
The system time was changed.
A monitored security event pattern has occurred.
Administrator recovered system from CrashOnAuditFail.
A security package has been loaded by the Local Security Authority.
An account was successfully logged on.
An account failed to log on.
User/Device claims information.
4646
IKE DoS-prevention mode started.
User initiated logoff (Success)
A replay attack was detected (Success)
4650
An IPsec Main Mode security association was established (Success)
4651
An IPsec Main Mode security association was established (Success)
4652
An IPsec Main Mode negotiation failed (Failure)
4653
An IPsec Main Mode negotiation failed (Failure)
4654
An IPsec Quick Mode negotiation failed (Failure)
4655
An IPsec Main Mode security association ended (Success)
A handle to an object was requested
A registry value was modified (Success)
The handle to an object was closed
4659
A handle to an object was requested with intent to delete (Success)
An object was deleted
A handle to an object was requested (Success)
An attempt was made to access an object
An attempt was made to create a hard link (Success)
4665
An attempt was made to create an application client context. (Success)
4666
An application attempted an operation (Success)
4667
An application client context was deleted (Success)
4668
An application was initialized (Success)
Permissions on an object were changed (Success)
An application attempted to access a blocked ordinal through the TBS (Success)
A privileged service was called (Success)
An operation was attempted on a privileged object (Success)
SIDs were filtered (Success)
Indirect access to an object was requested (Success)
Backup of data protection master key was attempted (Success)
Recovery of data protection master key was attempted (Success)
Protection of auditable protected data was attempted (Success)
Unprotection of auditable protected data was attempted (Failure)
A primary token was assigned to process (Success)
A service was installed in the system (Success)
A scheduled task was created (Success)
A scheduled task was deleted (Success)
A scheduled task was enabled (Success)
A scheduled task was disabled (Success)
A token right was adjusted (Success)
A user right was assigned (Success)
A user right was removed (Success)
A new trust was created to a domain (Success)
A trust to a domain was removed (Success)
4709
IPsec Services was started (Success)
4710
IPsec Services was disabled (Success)
4711
PAStore Engine (1%) (Success)
4712
IPsec Services encountered a potentially serious failure (Failure)
Kerberos policy was changed (Success)
Encrypted data recovery policy was changed (Success)
The audit policy (SACL) on an object was changed (Success)
Trusted domain information was modified (Success)
System security access was granted to an account (Success)
System security access was removed from an account (Success)
System audit policy was changed (Success)
A user account was created (Success)
A user account was enabled (Success)
An attempt was made to change an account's password (Success)
An attempt was made to reset an accounts password (Success)
A user account was disabled (Success)
A user account was deleted (Success)
4727
A security-enabled global group was created (Success)
4728
A member was added to a security-enabled global group (Success)
4729
A member was removed from a security-enabled global group (Success)
4730
A security-enabled global group was deleted (Success)
A security-enabled local group was created (Success)
A member was added to a security-enabled local group (Success)
A member was removed from a security-enabled local group (Success)
A security-enabled local group was deleted (Success)
A security-enabled local group was changed (Success)
4737
A security-enabled global group was changed (Success)
A user account was changed (Success)
Domain Policy was changed (Success)
A user account was locked out (Success)
A computer account was created (Success)
A computer account was changed (Success)
A computer account was deleted (Success)
4744
A security-disabled local group was created (Success)
4745
A security-disabled local group was changed (Success)
4746
A member was added to a security-disabled local group (Success)
4747
A member was removed from a security-disabled local group (Success)
4748
A security-disabled local group was deleted (Success)
A security-disabled global group was created (Success)
A security-disabled global group was changed (Success)
A member was added to a security-disabled global group (Success)
A member was removed from a security-disabled global group (Success)
A security-disabled global group was deleted (Success)
4754
A security-enabled universal group was created (Success)
4755
A security-enabled universal group was changed (Success)
4756
A member was added to a security-enabled universal group (Success)
4757
A member was removed from a security-enabled universal group (Success)
4758
A security-enabled universal group was deleted (Success)
4759
A security-disabled universal group was created (Success)
4760
A security-disabled universal group was changed (Success)
4761
A member was added to a security-disabled universal group (Success)
4762
A member was removed from a security-disabled universal group (Success)
4763
A security-disabled universal group was deleted (Success)
A groups type was changed (Success)
SID History was added to an account (Success)
An attempt to add SID History to an account failed (Failure)
A user account was unlocked (Success)
Kerberos pre-authentication failed (Failure)
A Kerberos authentication ticket request failed (Failure)
A Kerberos service ticket request failed (Failure)
An account was mapped for logon (Success)
An account could not be mapped for logon (Failure)
A session was reconnected to a Window Station (Success)
A session was disconnected from a Window Station (Success)
The ACL was set on accounts which are members of administrators groups (Success)
The name of an account was changed (Success)
The password hash an account was accessed (Success)
4783
A basic application group was created (Success)
4784
A basic application group was changed (Success)
4785
A member was added to a basic application group (Success)
4786
A member was removed from a basic application group (Success)
4787
A non-member was added to a basic application group (Success)
4788
A non-member was removed from a basic application group.. (Success)
4789
A basic application group was deleted (Success)
4790
An LDAP query group was created (Success)
4791
A basic application group was changed (Success)
4792
An LDAP query group was deleted (Success)
The Password Policy Checking API was called (Success)
An attempt was made to set the Directory Services Restore Mode administrator password (Success)
4797
An attempt was made to query the existence of a blank password for an account (Success)
The workstation was locked (Success)
The workstation was unlocked (Success)
The screen saver was dismissed (Success)
RPC detected an integrity violation while decrypting an incoming message (Success)
Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy (Success)
Central Access Policies on the machine have been changed (Success)
4820
A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions (Failure)
4821
A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions (Failure)
4822
NTLM authentication failed because the account was a member of the Protected User group (Failure)
4823
NTLM authentication failed because access control restrictions are required (Failure)
4824
Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group (Failure)
4825
A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group (Success)
Boot Configuration Data loaded (Success)
4830
SID History was removed from an account (Success)
A namespace collision was detected (Success)
A trusted forest information entry was added (Success)
A trusted forest information entry was removed (Success)
A trusted forest information entry was modified (Success)
4868
The certificate manager denied a pending certificate request (Success)
4869
Certificate Services received a resubmitted certificate request (Success)
4870
Certificate Services revoked a certificate (Success)
4871
Certificate Services received a request to publish the certificate revocation list (CRL) (Success)
4872
Certificate Services published the certificate revocation list (CRL) (Success)
4873
A certificate request extension changed (Success)
4874
One or more certificate request attributes changed. (Success)
4875
Certificate Services received a request to shut down (Success)
4876
Certificate Services backup started (Success)
4877
Certificate Services backup completed (Success)
4878
Certificate Services restore started (Success)
4879
Certificate Services restore completed (Success)
4880
Certificate Services started (Success)
4881
Certificate Services stopped (Success)
4882
The security permissions for Certificate Services changed (Success)
4883
Certificate Services retrieved an archived key (Success)
4884
Certificate Services imported a certificate into its database (Success)
4885
The audit filter for Certificate Services changed (Success)
4886
Certificate Services received a certificate request (Success)
4887
Certificate Services approved a certificate request and issued a certificate (Success)
4888
Certificate Services denied a certificate request (Failure)
4889
Certificate Services set the status of a certificate request to pending (Success)
4890
The certificate manager settings for Certificate Services changed. (Success)
4891
A configuration entry changed in Certificate Services (Success)
4892
A property of Certificate Services changed (Success)
4893
Certificate Services archived a key (Success)
4894
Certificate Services imported and archived a key (Success)
4895
Certificate Services published the CA certificate to Active Directory Domain Services (Success)
4896
One or more rows have been deleted from the certificate database (Success)
4897
Role separation enabled (Success)
4898
Certificate Services loaded a template (Success)
4899
A Certificate Services template was updated (Success)
4900
Certificate Services template security was updated (Success)
The Per-user audit policy table was created (Success)
An attempt was made to register a security event source (Success)
An attempt was made to unregister a security event source (Success)
The CrashOnAuditFail value has changed (Success)
Special Groups Logon table modified (Success)
The local policy settings for the TBS were changed (Success)
The group policy settings for the TBS were changed (Success)
Resource attributes of the object were changed (Success)
Per User Audit Policy was changed (Success)
Central Access Policy on the object was changed (Success)
An Active Directory replica source naming context was established (Success)
An Active Directory replica source naming context was removed (Success)
An Active Directory replica source naming context was modified (Success)
An Active Directory replica destination naming context was modified (Success)
Synchronization of a replica of an Active Directory naming context has begun (Success)
Synchronization of a replica of an Active Directory naming context has ended (Success)
Attributes of an Active Directory object were replicated (Success)
Replication failure begins (Success)
Replication failure ends (Success)
A lingering object was removed from a replica (Success)
The following policy was active when the Windows Firewall started (Success)
A rule was listed when the Windows Firewall started (Success)
A change has been made to Windows Firewall exception list. A rule was added (Success)
A change has been made to Windows Firewall exception list. A rule was modified (Success)
A change has been made to Windows Firewall exception list. A rule was deleted (Success)
Windows Firewall settings were restored to the default values (Success)
A Windows Firewall setting has changed (Success)
A rule has been ignored because its major version number was not recognized by Windows Firewall (Success)
Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall (Success)
A rule has been ignored by Windows Firewall because it could not parse the rule (Success)
Windows Firewall Group Policy settings has changed. The new settings have been applied (Success)
Windows Firewall has changed the active profile (Success)
Windows Firewall did not apply the following rule (Failure)
Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer (Success)
4960
IPsec dropped an inbound packet that failed an integrity check (Success)
4961
IPsec dropped an inbound packet that failed a replay check (Success)
4962
IPsec dropped an inbound packet that failed a replay check (Success)
4963
IPsec dropped an inbound clear text packet that should have been secured (Success)
Special groups have been assigned to a new logon (Success)
4965
IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). (Success)
4976
During Main Mode negotiation, IPsec received an invalid negotiation packet. (Success)
4977
During Quick Mode negotiation, IPsec received an invalid negotiation packet. (Success)
4978
During Extended Mode negotiation, IPsec received an invalid negotiation packet. (Success)
4979
IPsec Main Mode and Extended Mode security associations were established. (Success)
4980
IPsec Main Mode and Extended Mode security associations were established (Success)
4981
IPsec Main Mode and Extended Mode security associations were established (Success)
4982
IPsec Main Mode and Extended Mode security associations were established (Success)
4983
An IPsec Extended Mode negotiation failed (Success)
4984
An IPsec Extended Mode negotiation failed (Success)
The state of a transaction has changed (Success)
The Windows Firewall Service has started successfully (Success)
The Windows Firewall Service has been stopped (Success)
The Windows Firewall Service was unable to retrieve the security policy from the local storage (Success)
The Windows Firewall Service was unable to parse the new security policy. (Success)
The Windows Firewall Service failed to initialize the driver (Success)
The Windows Firewall Service failed to start (Success)
The Windows Firewall Service blocked an application from accepting incoming connections on the network. (Failure)
Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network (Failure)
The Windows Firewall Driver has started successfully (Success)
The Windows Firewall Driver has been stopped (Success)
The Windows Firewall Driver failed to start (Failure)
The Windows Firewall Driver detected critical runtime error. Terminating (Failure)
Code integrity determined that the image hash of a file is not valid (Failure)
A registry key was virtualized. (Success)
5040
A change has been made to IPsec settings. An Authentication Set was added. (Success)
5041
A change has been made to IPsec settings. An Authentication Set was modified (Success)
5042
A change has been made to IPsec settings. An Authentication Set was deleted (Success)
5043
A change has been made to IPsec settings. A Connection Security Rule was added (Success)
5044
A change has been made to IPsec settings. A Connection Security Rule was modified (Success)
5045
A change has been made to IPsec settings. A Connection Security Rule was deleted (Success)
5046
A change has been made to IPsec settings. A Crypto Set was added (Success)
5047
A change has been made to IPsec settings. A Crypto Set was modified (Success)
5048
A change has been made to IPsec settings. A Crypto Set was deleted (Success)
5049
An IPsec Security Association was deleted (Success)
5050
An attempt to programmatically disable the Windows Firewall using a call to INetFwProfile.FirewallEnabled(FALSE (Failure)
A file was virtualized (Success)
A cryptographic self test was performed (Success)
A cryptographic primitive operation failed (Failure)
Verification operation failed (Failure)
A kernel-mode cryptographic self test was performed (Success)
A cryptographic provider operation was attempted (Success)
A cryptographic context operation was attempted (Success)
A cryptographic context modification was attempted (Success)
A cryptographic function operation was attempted (Success)
A cryptographic function modification was attempted (Success)
A cryptographic function provider operation was attempted (Success)
A cryptographic function property operation was attempted (Success)
A cryptographic function property operation was attempted (Success)
5071
Key access denied by Microsoft key distribution service (Failure)
5120
OCSP Responder Service Started (Success)
5121
OCSP Responder Service Stopped (Success)
5122
A Configuration entry changed in the OCSP Responder Service (Success)
5123
A configuration entry changed in the OCSP Responder Service (Success)
5124
A security setting was updated on OCSP Responder Service (Success)
5125
A request was submitted to OCSP Responder Service (Success)
5126
Signing Certificate was automatically updated by the OCSP Responder Service (Success)
5127
The OCSP Revocation Provider successfully updated the revocation information (Success)
A directory service object was modified (Success)
A directory service object was created (Success)
A directory service object was undeleted (Success)
A directory service object was moved (Success)
A network share object was accessed (Success)
A directory service object was deleted (Failure)
A network share object was added. (Success)
A network share object was modified (Success)
A network share object was deleted. (Success)
A network share object was checked to see whether client can be granted desired access (Success)
5146
The Windows Filtering Platform has blocked a packet (Failure)
5147
A more restrictive Windows Filtering Platform filter has blocked a packet (Failure)
The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. (Success)
The DoS attack has subsided and normal processing is being resumed. (Success)
The Windows Filtering Platform has blocked a packet. (Success)
A more restrictive Windows Filtering Platform filter has blocked a packet. (Success)
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections (Success)
The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections (Success)
The Windows Filtering Platform has blocked a connection (Failure)
The Windows Filtering Platform has blocked a bind to a local port (Failure)
Spn check for SMB/SMB2 fails. (Success)
5169
A directory service object was modified (Success)
5170
A directory service object was modified during a background cleanup task (Success)
Credential Manager credentials were backed up (Success)
Credential Manager credentials were restored from a backup (Success)
The requested credentials delegation was disallowed by policy (Failure)
5380
Vault Find Credential (Success)
5381
Vault credentials were read (Success)
5382
Vault credentials were read (Success)
5440
The following callout was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5441
The following filter was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5442
The following provider was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5443
The following provider context was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5444
The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started (Success)
5446
A Windows Filtering Platform callout has been changed (Success)
A Windows Filtering Platform filter has been changed (Success)
5448
A Windows Filtering Platform provider has been changed (Success)
5449
A Windows Filtering Platform provider context has been changed (Success)
5450
A Windows Filtering Platform sub-layer has been changed (Success)
5451
An IPsec Quick Mode security association was established (Success)
5452
An IPsec Quick Mode security association ended (Success)
5453
An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started (Success)
5456
PAStore Engine applied Active Directory storage IPsec policy on the computer (Success)
5457
PAStore Engine failed to apply Active Directory storage IPsec policy on the computer (Success)
5458
PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer (Success)
5459
PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer (Failure)
5460
PAStore Engine applied local registry storage IPsec policy on the computer (Success)
5461
PAStore Engine failed to apply local registry storage IPsec policy on the computer (Failure)
5462
PAStore Engine failed to apply some rules of the active IPsec policy on the computer (Failure)
5463
PAStore Engine polled for changes to the active IPsec policy and detected no changes (Success)
5464
PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services (Success)
5465
PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully (Success)
5466
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead (Failure)
5467
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy (Failure)
5468
PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes (Success)
5471
PAStore Engine loaded local storage IPsec policy on the computer (Success)
5472
PAStore Engine failed to load local storage IPsec policy on the computer (Failure)
5473
PAStore Engine loaded directory storage IPsec policy on the computer (Success)
5474
PAStore Engine failed to load directory storage IPsec policy on the computer (Failure)
5477
PAStore Engine failed to add quick mode filter (Failure)
5478
IPsec Services has started successfully (Success)
5479
IPsec Services has been shut down successfully (Success)
5480
IPsec Services failed to get the complete list of network interfaces on the computer (Failure)
5483
IPsec Services failed to initialize RPC server. IPsec Services could not be started (Failure)
5484
IPsec Services has experienced a critical failure and has been shut down (Failure)
5485
IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces (Failure)
A request was made to authenticate to a wireless network (Success)
A request was made to authenticate to a wired network (Success)
A Remote Procedure Call (RPC) was attempted (Success)
An object in the COM+ Catalog was modified (Success)
An object was deleted from the COM+ Catalog (Success)
An object was added to the COM+ Catalog (Success)
Security policy in the group policy objects has been applied successfully (Success)
One or more errors occurred while processing security policy in the group policy objects (Failure)
6272
Network Policy Server granted access to a user (Success)
6273
Network Policy Server denied access to a user (Success)
6274
Network Policy Server discarded the request for a user (Success)
6275
Network Policy Server discarded the accounting request for a user (Success)
6276
Network Policy Server quarantined a user (Success)
6277
Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy (Success)
6278
Network Policy Server granted full access to a user because the host met the defined health policy (Success)
6279
Network Policy Server locked the user account due to repeated failed authentication attempts (Success)
6280
Network Policy Server unlocked the user account (Success)
Code Integrity determined that the page hashes of an image file are not valid... (Success)
BranchCache: Received an incorrectly formatted response while discovering availability of content. (Failure)
BranchCache: Received invalid data from a peer. Data discarded. (Failure)
BranchCache: The message to the hosted cache offering it data is incorrectly formatted. (Failure)
BranchCache: The hosted cache sent an incorrectly formatted response to the client's message to offer it data. (Failure)
BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate. (Failure)
BranchCache: %2 instance(s) of event id %1 occurred. (Success)
A module registered to Windows Firewall to control filtering (Success)
A module unregistered from Firewall (Success)
Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. (Failure)
BranchCache: A service connection point object could not be parsed (Failure)
Code integrity determined that a file does not meet the security requirements to load into a process. This could be due to the use of shared sections or other issues (Failure)
A new external device was recognized by the system. (Success)
6417
The FIPS mode crypto selftests succeeded (Success)
6418
The FIPS mode crypto selftests failed (Success)
A request was made to disable a device (Success)
A device was disabled (Success)
A request was made to enable a device (Success)
A device was enabled (Success)
The installation of this device is forbidden by system policy (Failure)
The installation of this device was allowed, after having previously been forbidden by policy (Success)
8191
Highest System-Defined Audit Message Value (Success)
Zuletzt aktualisiert
War das hilfreich?