Some events are further enriched to add context and additional information. This is currently done only on Windows and network type events. Furthermore, this is a best effort enrichment due to the use of disparate event sources that Logon Tracker must attempt to sync and then deduce relevant metadata from. Within the Logon Tracker UI, these are displayed as the category shown in table below. The enrichment only works for real-time events and is not available for backfilled ones.
Category | New | Available on Windows 7/2k8R2 | Description |
|---|---|---|---|
Network Share | N | N | A network share operation performed |
PSExec | Y | N | A PSExec style remote process creation performed |
WMI | Y | Y | A remote WMI operation performed |
WinRM | Y | Y | A WinRM logon performed |
RPC | Y | N | An RPC operation performed |
LDAP | Y | Y | A LDAP operation performed |