event viewer - nps
April 24, 2024 · View on GitHub
Expression
product = "event viewer - nps"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| src_mac | ✓ | ||
| auth_type | ✓ | ||
| access_type | ✓ | ||
| src_host | ✓ | ||
| network | ✓ | ||
| src_ip | ✓ | ||
| auth_method | ✓ | ||
| user_type | ✓ | ||
| additional_info | ✓ | ||
| event_code | ✓ | ||
| dest_ip | ✓ | ||
| location | ✓ | ||
| auth_server | ✓ |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| endpoint-authentication |