event viewer - security

Expression

product = "event viewer - security"

Fields

Field	Core	Detection	Informational
login_id			✓
event_id			✓
log_name	✓
user_id			✓
event_code	✓	✓
domain		✓
event_name			✓
fallback_user_name
domain_user_name
src_host	✓	✓
user	✓	✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
audit_policy-modify	policy_changes			✓
	audit_subcategory	Legacy			✓
	audit_category	Legacy			✓
ds_object-create
ds_object-delete
ds_object-modify	access	Default			✓
	access_mask	Default			✓
	attribute	Default			✓
	attribute_value	Default			✓
	operation	Default			✓
ds_object-move
ds_object-restore
endpoint-authentication	src_ip	Default		✓
	src_port	Default			✓
	ticket_options	Default			✓
	ticket_encryption_type	Default			✓
	kerberos_service_name	Default			✓
endpoint-delete
endpoint-domain-join	process_id				✓
	dest_user_sid	Default			✓
	user_sid
endpoint-lock	session_id				✓
endpoint-login	result	Default			✓
	src_ip	Default		✓
	src_port	Default			✓
	auth_package	Default			✓
	process_id	Default			✓
	sub_status	Default			✓
	process_name	Default			✓
	process_dir	Default			✓
	process_path	Default			✓
	auth_process	Default			✓
endpoint-logout	src_ip
	src_port
	session_name
endpoint-modify	old_attribute			✓
	new_attribute			✓
	attribute				✓
endpoint-unlock	session_id				✓
file-delete	handle_id				✓
	process_id				✓
	login_id
	access	Legacy		✓
	access_mask				✓
	process_name	Legacy			✓
	process_dir	Legacy			✓
	process_path	Legacy			✓
	object_id
	object_class
	object_server
	object
file-read	handle_id				✓
	process_id				✓
	access	Legacy		✓
	access_mask				✓
	process_name	Legacy			✓
	process_dir	Legacy			✓
	process_path	Legacy		✓
file-write	handle_id				✓
	process_id				✓
	access	Legacy		✓
	access_mask				✓
	process_name	Legacy			✓
	process_dir	Legacy			✓
	process_path	Legacy		✓
group-member-add	member_id				✓
	group_id	Legacy		✓
group-member-remove	member_id				✓
	group_id	Legacy		✓
	group_type	Legacy			✓
log-clear
network-session	process_id	Default			✓
	process_name	Default			✓
	process_dir	Default			✓
	process_path	Default			✓
	direction	Default			✓
peripheral_storage-insert	device_product				✓
	device_name			✓
	compatible_id				✓
	device_pid				✓
	class_id				✓
	vendor_id				✓
	device_description				✓
	device_class				✓
	device_vendor				✓
	device_vid				✓
	class_name			✓	✓
	location_information				✓
process-create	process_integrity	Default			✓
	elevation_type	Default			✓
scheduled_task-create	file_path			✓
	file_ext			✓
	dest_domain_user_name
	file_name			✓
	file_dir			✓
	dest_domain			✓
	description	Legacy			✓
	dest_user			✓
	dest_user_id				✓
	triggers	Legacy			✓
	run_level	Legacy			✓
service-create	file_path			✓
	service_command_line			✓
	service_type			✓
	file_ext			✓
	dest_domain_user_name
	file_name			✓
	file_dir			✓
	dest_domain			✓
	service_start_type	Legacy			✓
	dest_user
	dest_user_id				✓
share-access	task_name	Default			✓
	process_id	Default			✓
	privileges	Default			✓
	access	Default			✓
	login_type	Default			✓
	sid_history	Default			✓
	dest_user_sid	Default			✓
	src_ip	Default		✓
	thread_id	Default			✓
	process_guid	Default			✓
	dest_domain_user_name
	file_type	Default			✓
	process_name	Default			✓
	key_length	Default			✓
	operation_id	Default			✓
	provider_name	Default			✓
	auth_process	Default			✓
	service_name	Default			✓
	file_name	Default			✓
	file_dir	Default			✓
	process_dir	Default			✓
	dest_user	Default		✓
	process_command_line	Default			✓
	object_server	Default			✓
	src_port	Default			✓
	auth_package	Default			✓
	service_type	Default			✓
	file_ext	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	user_sid	Default			✓
	dest_domain	Default			✓
	dest_host	Default		✓
	process_path	Default			✓
	object	Default			✓
share-create	src_ip	Legacy		✓
	src_port	Legacy		✓
	d_name
	d_parent
	dest_ip
	dest_host	Legacy	✓	✓
	aid
share-delete	src_ip	Legacy		✓
	src_port	Legacy		✓
	dest_ip
	user_sid
	dest_host	Legacy	✓	✓
share-modify	src_ip	Legacy		✓
	src_port	Legacy		✓
	dest_ip
	user_sid
	dest_host	Legacy	✓	✓
user-create	dest_user_type				✓
	domain_controller				✓
	dest_user_id				✓
user-delete	dest_user_id				✓
user-disable	dest_user_id				✓
user-enable	dest_user_id				✓
user-lock	dest_user_id				✓
user-modify	old_attribute			✓
	operation_type			✓
	new_attribute			✓
	uac_status			✓
	attribute			✓
	attribute_value			✓
user-name-modify	old_user_name	Default			✓
	new_user_name	Default			✓
user-password-modify	dest_user_id	Default			✓
user-password-reset
user-privilege-assign
user-privilege-use	process_id	Legacy			✓
	object_type	Legacy			✓
	object_handle				✓
	service_name				✓
	process_name	Legacy	✓	✓
	object_name	Legacy	✓	✓
	process_dir	Legacy			✓
	process_path	Legacy		✓
	object_server	Legacy			✓
user-switch	src_ip			✓
	src_port				✓
	dest_login_id				✓
	process_id			✓
	process_name			✓
	dest_service_name				✓
	dest_host
	process_dir			✓
	dest_user_id				✓
	process_path			✓
user-unlock	dest_user_id				✓