| Abnormal Authentication & Access | account-creation
↳syslog-json-4720
↳cef-4720
↳sk4-json-4720
↳s-xml-4720
↳raw-windows-account-624
↳wls-4720
↳s-4720-jp
↳mcafee-siem-4720
↳windows-xml-4720
↳raw-windows-account-4720
↳cef-624
↳ad-json-4720
↳json-4720-1
↳json-4720
↳s-windows-event-4720
↳l-4720
↳s-xml-4726
↳raw-windows-account-4726
↳json-4726
↳s-4726-jp
↳nxlog-json-4726
↳wls-4726
↳mcafee-siem-4726
↳raw-windows-account-630
↳ad-audit-4722
account-deleted
↳s-xml-4725
↳raw-windows-account-629
↳syslog-json-4725
↳cef-4725
↳wls-4725
↳sk4-json-4725
↳n-forwarded-cef-4725
↳mcafee-siem-4725
↳raw-windows-account-4725
↳json-4725
↳s-4725-jp
↳l-4725
↳s-windows-event-4725
↳s-windows-event-629
↳ad-audit-4728
account-disabled
↳syslog-json-4722
↳cef-4722
↳sk4-json-4722
↳mcafee-siem-4722
↳n-forwarded-cef-4722
↳json-4722
↳raw-windows-account-4722
↳windows-xml-4722
↳ad-json-4722
↳l-4722
↳s-windows-event-626
↳s-windows-event-4722
↳s-4722-jp
↳ad-audit-4726
account-enabled
↳ad-audit-4723
account-lockout
↳json-4767
↳syslog-json-4767
↳l-4767
↳xml-4767
↳ad-json-4767
↳sk4-json-4767
↳wazuh-4767
↳raw-4767
↳ad-audit-4778
account-password-change
↳s-xml-4723
↳syslog-json-4723
↳cef-4723
↳s-627
↳raw-4723
↳mcafee-siem-4723
↳wls-4723
↳json-4723
↳nic-627
↳emc-syslog-4723
↳wls-627
↳l-4723
↳raw-627
↳s-4723-jp
↳s-windows-event-4723
↳s-windows-event-627
↳json-4723-1
↳json-4723-2
↳s-xml-4724
↳syslog-json-4724
↳cef-4724
↳ad-json-4724
↳wls-4724
↳sk4-json-4724
↳mcafee-siem-4724
↳q-628
↳n-forwarded-cef-4724
↳raw-4724
↳json-4724
↳raw-628
↳s-windows-event-4724
↳l-4724
↳s-4724-jp
↳json-4724-1
↳ad-audit-4724
account-password-reset
↳ad-audit-4725
account-switch
↳cef-4740
↳s-4740-2
↳s-windows-event-644
↳s-4740-1
↳raw-windows-account-644
↳raw-windows-account-4740
↳n-forwarded-cef-4740
↳s-windows-event-4740
↳wls-4740
↳mcafee-siem-4740
↳s-xml-4740
↳json-4740-1
↳json-4740
↳ad-json-4740
↳l-4740
↳wls-644
↳emc-syslog-4740
↳q-microsoft-4740
↳s-4740-jp
↳syslog-json-4740
↳raw-552
↳s-windows-event-552
↳json-4648-1
↳n-forwarded-cef-4648
↳n-forwarded-cef-552
↳xml-4648
↳json-4648
↳json-4648-2
↳emc-syslog-4648
↳s-windows-event-4648
↳s-4648-jp
↳exalms-552
↳raw-4648-2
↳syslog-4648
↳cef-4648
↳raw-4648-3
↳s-windows-4648
↳raw-4648-4
↳cef-snare-552
↳raw-4648-5
↳mcafee-siem-4648
↳raw-4648
↳cef-snare-4648
↳raw-4648-1
↳windows-events-4648
account-unlocked
↳s-xml-4723
↳syslog-json-4723
↳cef-4723
↳s-627
↳raw-4723
↳mcafee-siem-4723
↳wls-4723
↳json-4723
↳nic-627
↳emc-syslog-4723
↳wls-627
↳l-4723
↳raw-627
↳s-4723-jp
↳s-windows-event-4723
↳s-windows-event-627
↳json-4723-1
↳json-4723-2
↳ad-audit-4800
app-activity
↳ad-audit-4663
app-login
↳wazuh-sql-login
↳cef-azure-authentication
↳azure-app-auth-events
↳azure-app-logon
↳azure-app-logon-2
audit-log-clear
↳s-4719-1
↳q-microsoft-4719
↳cef-snare-4719
↳xml-4719
↳s-612
↳s-windows-event-4719
↳raw-4719
↳snare-4719
↳json-4719
↳s-4719
↳snare-612
↳exalms-4719
audit-policy-change
↳raw-4663-10
↳exalms-4663
↳exalms-567
↳cef-snare-4663
↳xml-4663
↳n-forwarded-cef-4663
↳cef-snare-567
↳ad-audit-4663-1
↳raw-4663
↳s-560-jp
↳cef-4663
↳raw-4663-9
↳u-4663
↳wls-4663
↳s-4663-jp
↳s-xml-4663
↳raw-4663-5
↳raw-4663-6
↳raw-4663-7
↳raw-4663-8
↳s-560
↳raw-4663-1
↳raw-4663-2
↳syslog-json-4663
↳raw-4663-3
↳raw-567
↳raw-4663-4
authentication-failed
↳q-adfs-auth-successful-1
↳q-adfs-auth-successful
↳cef-ad-fs-audit-516
↳s-516
authentication-successful
↳q-adfs-auth-failed-2
↳q-adfs-auth-failed
↳q-adfs-auth-failed-1
↳adfs-auth-failed
↳s-adfs-auth-failed
↳cef-ad-fs-audit-299
↳cef-ad-fs-audit-501
↳cef-ad-fs-audit-500
↳cef-ad-fs-audit-411
↳cef-ad-fs-audit-413
↳cef-azure-authentication
↳azure-app-auth-events
↳json-windows-auth
computer-logon
↳cef-4776
↳raw-4776
↳cef-snare-680
↳wazuh-4776
↳s-windows-4776
↳evntslog-680
↳wls-4776
↳exalms-680
↳u-680
↳n-forwarded-cef-680
↳greenbay-4776
↳cef-windows-4776
↳q-680
↳exalms-4776
↳s-4776-jp
↳raw-680
↳n-forwarded-cef-4776
↳raw-4776-1
↳syslog-4776-multiline
↳xml-4776
↳raw-4776-5
↳raw-4776-4
↳raw-4776-3
↳raw-4776-2
↳mcafee-siem-4776
↳syslog-4776-ch
↳emc-syslog-4776
↳json-4776-1
↳s-680
↳json-4776-2
↳json-4776
database-query
↳xml-4649
dcom-activation-failed
↳raw-4929
↳raw-4928
dlp-alert
↳raw-672
↳json-4768-3
↳syslog-4768-ch
↳xml-4768
↳raw-4768-2
↳n-forwarded-cef-4768
↳raw-4768-1
↳raw-4768-5
↳json-4768
↳raw-4768-4
↳raw-4768-3
↳emc-syslog-4768
↳windows-4768-1
↳json-4768-1
↳cef-672
↳json-4768-2
↳s-672
↳extrahop-4768
↳cef-4768
↳evntslog-672
↳wls-4768
↳mcafee-siem-4768
↳raw-4768
↳s-4768-jp
↳q-672
↳logstash-4768
↳cef-windows-4768
↳json-xml-4768
↳s-xml-windows-member-11
↳s-xml-windows-member-9
↳s-xml-windows-member-13
↳s-xml-windows-member-7
dlp-email-alert-out-failed
↳raw-552
↳s-windows-event-552
↳q-microsoft-4648
↳json-4648-1
↳n-forwarded-cef-4648
↳n-forwarded-cef-552
↳xml-4648
↳json-4648
↳json-4648-2
↳emc-syslog-4648
↳s-windows-event-4648
↳s-4648-jp
↳exalms-552
↳raw-4648-2
↳syslog-4648
↳cef-4648
↳raw-4648-3
↳s-windows-4648
↳raw-4648-4
↳cef-snare-552
↳raw-4648-5
↳mcafee-siem-4648
↳raw-4648
↳cef-snare-4648
↳raw-4648-1
↳windows-events-4648
dns-query
↳windows-dns-response-1
↳cef-windows-dns-response
↳json-windows-dns-response
↳windows-dns-response-2
↳windows-dns-response
↳cef-windows-dns-response-1
dns-response
↳sysmon-windows-dns-query
↳windows-dns-query
↳windows-dns-query-3
↳windows-dns-query-1
↳json-windows-dns-query
↳windows-dns-query-2
↳cef-windows-dns-query
↳cef-windows-dns-query-1
ds-access
↳jp-4662
↳exalms-4742
↳raw-4742
↳xml-4742-jp
↳sk4-json-4662
↳json-4662-1
↳raw-4662
↳xml-4662
↳exalms-4662
↳raw-4662-1
↳n-forwarded-cef-4662
↳windows-xml-4742
↳s-4662
↳cef-windows-4742
↳xml-4662-jp
↳json-4662
↳q-4662
↳raw-4662-2
↳raw-4662-3
↳cef-ad-fs-audit-299
↳cef-ad-fs-audit-501
↳cef-ad-fs-audit-500
failed-app-login
↳s-4625-jp
↳cef-4625
↳s-windows-4625
↳exalms-4625
↳syslog-4625-ch
↳rs-4625
↳s-windows-event-534
↳wls-4625
↳xml-4625
↳wazuh-4625
↳xml-4625-1
↳json-4625-1
↳mcafee-siem-4625
↳n-forwarded-cef-4625
↳json-4625-2
↳raw-4625
↳json-4625
↳spanish-raw-4625
↳emc-syslog-4625
↳raw-failed-logon-2003
↳s-windows-event-4625
↳cef-windows-4625
↳n-forwarded-cef-failed-logon-2003
↳raw-4625-1
↳wazuh-sql-login
failed-logon
↳ad-audit-4768
↳ad-audit-4720
↳xml-5861
↳xml-1310
failed-vpn-login
↳json-windows-auth
file-close
↳raw-10016
file-delete
↳xml-5144
↳xml-5145
↳raw-5145
↳raw-5145-1
↳raw-5145-2
↳raw-5143
↳raw-5145-11
↳raw-5145-5
↳cef-5142
↳raw-5145-6
↳raw-5145-3
↳raw-5145-4
↳raw-5145-9
↳cef-5145
↳raw-5145-7
↳cef-5144
↳raw-5145-8
↳cef-5143
↳syslog-5145-ch
↳cef-5142-1
↳json-5145
↳raw-5140-2
↳jp-share-access-5140
↳raw-5140-1
↳xml-5143
↳json-5140
↳raw-5145-10
↳cef-snare-5140
↳s-windows-event-5140
↳cef-5140
↳syslog-5140-ch
↳s-windows-5140
↳json-xml-5140
↳xml-5145-1
↳ad-json-5140
↳raw-5140
↳xml-5140
↳jp-share-access-5145
↳ad-audit-4688
↳cef-azure-process-created
file-read
↳raw-4663-10
↳exalms-4663
↳exalms-567
↳cef-snare-4663
↳n-forwarded-cef-4663
↳cef-snare-567
↳ad-audit-4663-1
↳raw-4663
↳s-560-jp
↳cef-4663
↳raw-4663-9
↳u-4663
↳wls-4663
↳s-4663-jp
↳s-xml-4663
↳raw-4663-5
↳raw-4663-6
↳raw-4663-7
↳raw-4663-8
↳s-560
↳raw-4663-1
↳raw-4663-2
↳syslog-json-4663
↳raw-4663-3
↳raw-567
↳raw-4663-4
↳ad-audit-4663
↳raw-327
file-write
↳raw-4663-10
↳exalms-4663
↳exalms-567
↳cef-snare-4663
↳n-forwarded-cef-4663
↳cef-snare-567
↳ad-audit-4663-1
↳raw-4663
↳s-560-jp
↳cef-4663
↳raw-4663-9
↳u-4663
↳wls-4663
↳s-4663-jp
↳s-xml-4663
↳raw-4663-5
↳raw-4663-6
↳raw-4663-7
↳raw-4663-8
↳s-560
↳raw-4663-1
↳raw-4663-2
↳syslog-json-4663
↳raw-4663-3
↳raw-567
↳raw-4663-4
↳ad-audit-4663
↳raw-326
kerberos-logon
↳ad-audit-4624
local-logon
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-4624
↳cef-528
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
logout-remote
↳raw-216
↳raw-325
member-added
↳nic-member-removed-2008
↳s-member-removed-2003
↳s-windows-event-633
↳ad-json-member-removed-2008
↳s-windows-event-4729
↳cef-member-removed-2008
↳s-member-removed-2008
↳raw-member-removed-2008
↳raw-member-removed-2008-2
↳sk4-json-member-removed-2008
↳raw-member-removed-2008-3
↳raw-member-removed-2008-1
↳q-member-removed-2003
↳raw-member-removed-2003
↳n-forwarded-cef-member-removed-2008
↳cef-windows-member-removed-2003
↳u-member-removed-2008
↳json-4729
↳xml-member-removed-2008
↳s-windows-event-637
↳s-windows-event-4733
↳nic-member-removed-2003
↳q-member-removed-2008
↳json-member-removed
↳s-xml-windows-member-4
↳s-xml-windows-member-5
↳s-xml-windows-member-6
↳ad-audit-4729
member-removed
↳q-microsoft-dhcp-update
↳microsoft-dns-renew-jp
↳microsoft-dns-renew-jp-5
↳s-microsoft-dns-update
↳microsoft-dns-update-successful
↳s-microsoft-dns-renew
↳microsoft-dns-renew-jp-1
↳n-forwarded-cef-dns-update
↳microsoft-dns-renew-jp-2
↳s-microsoft-dhcp
↳q-microsoft-dhcp
↳q-microsoft-dhcp-renew
↳syslog-microsoft-dhcp
↳ad-audit-4740
nac-logon
↳q-6272
↳xml-6272
↳xml-nps-logon
↳q-6273
↳xml-nps-logon
netflow-connection
↳ad-audit-4771
network-alert
↳json-member-added-2008
↳wls-member-added-2008-notype
↳emc-syslog-member-added-2008
↳s-member-added-2008-jp
↳n-forwarded-cef-member-added-2008
↳sk4-json-member-added-2008
↳ad-json-member-added-2008
↳raw-member-added-2003
↳s-member-added-2003
↳json-4728
↳s-member-added-2008
↳snare-cef-member-added-2008
↳syslog-json-member-added-2008
↳u-member-added-2008
↳raw-member-added-2008
↳l-member-added-2008
↳cef-windows-member-added-2003
↳cef-member-added-2008
↳q-member-added-2008
↳cef-member-added-2003
↳windows-xml-member-added-2008
↳jp-member-added-3
↳jp-member-added-1
↳jp-member-added-2
↳s-windows-event-636
↳evntslog-member-added-2003
↳s-windows-event-4728
↳s-xml-windows-member-3
↳s-xml-windows-member-1
↳s-xml-windows-member-2
↳s-windows-event-4732
↳raw-4743
↳raw-4743-1
↳ad-audit-4743
network-connection-failed
↳windows-rdp-login
privileged-access
↳s-4674-jp
↳raw-4674
↳cef-4674
↳exalms-4674
↳xml-4674
↳s-windows-event-578
↳snare-578
↳windows-xml-4674
↳cef-snare-578
↳s-windows-4674
↳xml-4674-1
↳s-windows-event-4674
↳cef-windows-4674
↳raw-4674-2
↳json-4674
↳l-4674
↳emc-syslog-4674
↳raw-4674-1
↳wls-windows-privileged-access
↳raw-4674-4
↳raw-4674-3
privileged-object-access
↳mcafee-siem-process-created
↳cef-4688
↳u-4688
↳cef-snare-4688
↳n-forwarded-cef-4688
↳json-process-created
↳s-windows-4688
↳l-4688-v2
↳xml-4688
↳wls-4688
↳raw-process-created-1
↳cef-snare-process-created
↳json-process-created-1
↳snare-592
↳json-process-created-2
↳s-windows-process-created
↳nic-4688
↳spanish-raw-4688
↳emc-syslog-4688
↳raw-process-created
↳s-4688-jp
↳s-592
↳s-windows-event-4688
process-created
↳ad-audit-5140
process-network
↳jp-5158
↳xml-5156
↳metricbeat-5156
↳raw-5156
↳syslog-5156-ch
↳jp-process-network
↳xml-5158
↳syslog-5158
↳windows-kinesis-firehose-5156
↳json-xml-5156
↳json-xml-5158
↳json-5156
↳json-5158
↳q-5158
↳q-5156
↳raw-5157
↳raw-5157-1
↳xml-5157
↳json-xml-5157
↳s-windows-5157-2
↳s-windows-5157
process-network-failed
↳s-4801
↳cef-4801
↳s-4801-1
↳q-4801
↳sk4-json-4801
↳xml-4801
↳s-windows-event-4801
↳raw-4801
remote-access
↳raw-674
↳nic-4770
↳s-4770-jp
↳raw-4770
↳n-forwarded-cef-4770
↳raw-4770-1
↳mcafee-siem-4770
↳json-xml-4770
↳json-4770
↳extrahop-4770
↳s-xml-4770
↳cef-4770
↳s-4624-jp
↳exalms-540
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳r-nic-540
↳raw-4624-6
↳raw-540
↳raw-4624-5
↳s-windows-event-540
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳n-forwarded-cef-540
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳cef-540
↳raw-4624-2
↳raw-4624-1
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳raw-552
↳s-windows-event-552
↳json-4648-1
↳n-forwarded-cef-4648
↳n-forwarded-cef-552
↳xml-4648
↳json-4648
↳json-4648-2
↳emc-syslog-4648
↳s-windows-event-4648
↳s-4648-jp
↳exalms-552
↳raw-4648-2
↳syslog-4648
↳cef-4648
↳raw-4648-3
↳s-windows-4648
↳raw-4648-4
↳cef-snare-552
↳raw-4648-5
↳mcafee-siem-4648
↳raw-4648
↳cef-snare-4648
↳raw-4648-1
↳windows-events-4648
remote-logon
↳json-4769-2
↳raw-673
↳xml-4769-1
↳n-forwarded-cef-4769
↳raw-4769-1
↳xml-4769
↳raw-4769-5
↳s-673
↳raw-4769-4
↳raw-4769-3
↳json-4769
↳raw-4769-2
↳emc-syslog-4769
↳syslog-4769-ch
↳raw-4769-7
↳s-4769-jp
↳raw-4769-6
↳cef-673
↳json-4769-1
↳ad-audit-4769
↳extrahop-4769
↳cef-4769
↳evntslog-673
↳wls-4769
↳mcafee-siem-4769
↳raw-4769
↳logstash-4769
↳cef-snare-4769
↳cef-windows-4769
↳q-673
↳windows-events-4769
↳json-xml-4769
↳raw-674
↳nic-4770
↳s-4770-jp
↳raw-4770
↳n-forwarded-cef-4770
↳raw-4770-1
↳mcafee-siem-4770
↳json-xml-4770
↳json-4770
↳extrahop-4770
↳s-xml-4770
↳cef-4770
↳s-4624-jp
↳exalms-540
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳r-nic-540
↳raw-4624-6
↳raw-540
↳s-windows-event-540
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳n-forwarded-cef-540
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳cef-540
↳raw-4624-2
↳raw-4624-1
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳json-4778
↳xml-4778
↳raw-4778
↳s-windows-event-4778
↳raw-4778-1
↳mcafee-siem-4778
↳json-4779
↳sk4-json-4779
↳xml-4779
↳s-windows-event-4779
↳wazuh-4779
↳mcafee-siem-4779
↳raw-4779
↳cef-snare-5136
↳xml-5137
↳xml-5138
↳sk4-json-5137
↳xml-5136
↳raw-4738
↳s-5137
↳xml-5139
↳n-forwarded-cef-5136
↳nic-5141
↳s-5141-1
↳mcafee-siem-5137
↳mcafee-siem-5136
↳s-windows-event-4780
↳nic-5136
↳wazuh-4738
↳nic-5137
↳json-5136
↳ad-audit-5139
↳raw-5138
↳json-4738-1
↳raw-5139
↳raw-5136
↳s-5141
↳raw-5137
↳xml-4738
↳json-4738
↳r-syslog-5136
↳raw-5141
↳mcafee-siem-5141
↳json-5136-1
↳xml-5141
↳sk4-json-5141
↳cef-1102
↳raw-1102
↳s-xml-1102
↳s-517
↳xml-1102
↳xml-104
↳snare-517
↳s-1102
↳xml-1102-1
↳q-1102
↳s-windows-event-1102
↳snare-1102
↳raw-104
↳ad-audit-4779
↳windows-rdp-login
↳raw-148
security-alert
↳cef-4776
↳raw-4776
↳json-4768-3
↳cef-snare-680
↳raw-4771
↳wazuh-4776
↳xml-4768
↳s-windows-4776
↳cef-4771
↳s-windows-4771
↳xml-4769
↳s-4771-jp
↳cef-windows-4771
↳syslog-4769-ch
↳cef-windows-4776
↳emc-syslog-4768
↳json-4768-1
↳json-4768-2
↳q-680
↳raw-680
↳wls-4768
↳wls-4769
↳raw-4769
↳raw-4768
↳s-4768-jp
↳logstash-4769
↳json-4776-1
↳logstash-4768
↳windows-events-4769
↳s-680
↳json-4776-2
↳wls-675
↳json-4769-2
↳syslog-4768-ch
↳raw-4769-1
↳wls-4776
↳exalms-680
↳wls-4771
↳r-nic-4771
↳raw-4769-5
↳s-673
↳n-forwarded-cef-680
↳raw-4769-4
↳raw-4769-3
↳s-675
↳raw-4769-2
↳raw-4769-7
↳raw-4769-6
↳json-4769-1
↳s-672
↳ad-audit-4769
↳evntslog-672
↳evntslog-675
↳q-675
↳syslog-4776-ch
↳q-672
↳cef-snare-4769
↳q-673
↳s-windows-event-4776
↳extrahop-4771
↳raw-4768-2
↳evntslog-680
↳raw-4768-1
↳raw-4768-5
↳raw-4768-4
↳greenbay-4776
↳raw-4768-3
↳s-4769-jp
↳cef-673
↳cef-672
↳extrahop-4768
↳extrahop-4769
↳n-forwarded-cef-4776
↳raw-4776-1
↳syslog-4776-multiline
↳mcafee-siem-4768
↳raw-4776-5
↳mcafee-siem-4769
↳raw-4776-4
↳raw-4776-3
↳raw-4776-2
↳mcafee-siem-4776
↳mcafee-siem-4771
↳n-forwarded-cef-4771
↳raw-675
↳raw-672
↳raw-673
↳xml-4769-1
↳windows-events-4776
↳n-forwarded-cef-4769
↳n-forwarded-cef-4768
↳u-680
↳json-4768
↳json-4769
↳windows-4768-1
↳s-xml-4771
↳exalms-4776
↳cef-4768
↳raw-4771-2
↳cef-4769
↳s-4776-jp
↳json-xml-4771
↳xml-4776
↳json-4771
↳cef-windows-4769
↳cef-windows-4768
↳json-xml-4769
↳json-xml-4768
↳json-4776
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳json-windows-vpn-login
↳xml-8004
↳raw-8004-1
↳json-windows-events-netlogon
↳raw-5805
service-created
↳win-enable-device-request
↳win-disable-device
↳win-disable-device-request
service-logon
↳ad-audit-4625
↳xml-1149
↳raw-1149
share-access
↳xml-5145
↳raw-5145
↳raw-5145-1
↳raw-5145-2
↳raw-5145-11
↳raw-5145-5
↳raw-5145-6
↳raw-5145-3
↳raw-5145-4
↳raw-5145-9
↳cef-5145
↳raw-5145-7
↳raw-5145-8
↳syslog-5145-ch
↳xml-5145-1
↳json-5145
↳s-4800
↳json-4800
↳q-4800
↳cef-4800
↳xml-4800
↳sk4-json-4800
↳raw-4800
↳s-windows-event-4800
↳ad-audit-4767
task-created
↳s-windows-event-4697
↳s-xml-7045
↳xml-5478
↳s-4697
↳s-7045
↳sk4-json-4697
↳s-json-4697
↳s-xml-4697
↳raw-7045
↳q-4697
↳xml-4622
usb-activity
↳cef-windows-6416
↳win-external-device-recog
↳win-enable-device
usb-write
↳ad-audit-alert
vpn-login
↳json-windows-vpn-login
↳s-xml-windows-member-10
↳s-xml-windows-member-14
↳s-xml-windows-member-8
vpn-logout
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳raw-672
↳json-4768-3
↳syslog-4768-ch
↳xml-4768
↳raw-4768-2
↳n-forwarded-cef-4768
↳raw-4768-1
↳raw-4768-5
↳json-4768
↳raw-4768-4
↳raw-4768-3
↳emc-syslog-4768
↳windows-4768-1
↳json-4768-1
↳cef-672
↳json-4768-2
↳s-672
↳extrahop-4768
↳cef-4768
↳evntslog-672
↳wls-4768
↳mcafee-siem-4768
↳raw-4768
↳s-4768-jp
↳q-672
↳logstash-4768
↳cef-windows-4768
↳json-xml-4768
↳cef-powershell-300
↳raw-4104
↳cef-powershell-600
↳xml-powershell-4104
↳powershell-800-syslog
↳powershell-process-created
↳powershell-800
↳win-powershell-command
↳powershell-process-created-1
↳powershell-process-created-2
↳cef-windows-4104
↳raw-powershell-600
↳windows-xml-powershell-process-created
↳powershell-800-syslog-1
↳windows-xml-powershell-process-created-2
↳cef-powershell-4104
↳s-windows-event-601
↳windows-xml-powershell-process-created-1
↳cef-powershell-4102
↳powershell-4104
↳json-4104
↳windows-xml-powershell-800
↳s-xml-windows-member-15
↳s-xml-windows-member-16
web-activity-denied
↳azure-app-logon
↳azure-app-logon-2
↳windows-dns-network-connection
winsession-disconnect
↳s-4624-jp
↳rs-4624
↳xml-4624
↳xml-4624-1
↳json-4624-2
↳n-forwarded-cef-4624
↳json-4624-1
↳json-4624
↳evntslog-528
↳nic-528
↳emc-syslog-4624
↳s-windows-event-528
↳s-windows-event-4624
↳raw-4624-7
↳raw-4624-6
↳raw-4624-5
↳raw-4624-4
↳windows-events-4624
↳n-forwarded-cef-528
↳raw-4624-9
↳cef-528
↳cef-4624
↳raw-4624-8
↳wazuh-4624
↳r-nic-528
↳raw-4624
↳mcafee-siem-4624
↳wls-4624
↳raw-4624-10
↳cef-windows-4624
↳raw-528
↳logstash-4624
↳cef-snare-4624
↳raw-4624-3
↳raw-4624-2
↳raw-4624-1
↳ad-audit-5141
↳ad-audit-4738
↳ad-audit-5136
↳ad-audit-4662
↳ad-audit-5137
↳ad-audit-4742
workstation-locked
↳l-4673
↳l-4672
↳s-windows-event-576
↳s-4672-jp
↳raw-4673
↳raw-4672
↳snare-576
↳snare-577
↳cef-4672
↳wazuh-4673
↳windows-events-4672
↳s-windows-4672
↳cef-4673
↳s-windows-4673
↳cef-windows-4673
↳raw-4672-2
↳raw-4673-1
↳s-576
↳raw-4672-1
↳raw-4673-2
↳raw-4672-3
↳wls-windows-privileged-access
↳cef-576
↳cef-snare-4673
↳exalms-576
↳xml-4672
↳json-4672-1
↳json-4673-1
↳json-4672-2
↳cef-snare-576
↳xml-4673
↳json-xml-4673
↳cef-snare-577
↳json-4673-2
↳spanish-raw-4672
↳s-windows-event-4672
↳s-windows-event-4673
↳mcafee-siem-4672
↳n-forwarded-cef-4673
↳n-forwarded-cef-4672
↳greenbay-privileged-access
↳json-4672
↳json-4673
↳emc-syslog-4673
↳emc-syslog-4672
↳ad-audit-4801
workstation-unlocked
↳s-4698
↳s-xml-4698
↳windows-xml-4700
↳s-windows-event-602
↳q-4698
↳raw-4700
↳json-4698
| T1021 - Remote Services
T1071.001 - Application Layer Protocol: Web Protocols
T1078 - Valid Accounts
T1078.003 - Valid Accounts: Local Accounts
T1110 - Brute Force
T1133 - External Remote Services
| |