The Windows Security log is probably the most important Windows event log to be sending to Helix Enterprise. It has many components and extensions that are not enabled by default. The Security log records each event as defined by the audit policies you set on each object.
Security auditing is a powerful tool to help maintain the security of an enterprise. The logging available here is instrumental in forensic analysis, monitoring user activity, and troubleshooting. Additionally, security auditing can be used for forensic analysis, to help administrators detect anomalous behavior, to identify and mitigate gaps in security policies, and to deter irresponsible behavior by tracking critical user activities. The event IDs being utilized in rules from this event log are the cornerstone of Helix Enterprise’s ability to do detection based on behavioral analysis.
The table below lists all parts of the Security log currently utilized in rules.
Number of occurrences in rules | Eventid | Event source or category |
|---|---|---|
105 | 4697 | Security System Extension |
34 | 4688 | Process Tracking |
9 | 4689 | Process Tracking |
5 | 4698 | Microsoft-Windows-Security-Auditing |
4 | 4692 | Microsoft-Windows-Security-Auditing |
4 | 592 | Security |
4 | 602 | Security |
2 | 4768 | Account Logon |
2 | 4769 | Account Logon |
2 | 4625 | Microsoft-Windows-Security-Auditing |
2 | 4720 | Microsoft-Windows-Security-Auditing |
2 | 4732 | Microsoft-Windows-Security-Auditing |
2 | 624 | Security |
2 | 636 | Security |
2 | 4622 | Security System Extension |
1 | 4771 | Account Logon |
1 | 4776 | Account Logon |
1 | 517 | Microsoft-Windows-Eventlog |
1 | 1102 | Microsoft-Windows-Eventlog |
1 | 4657 | Microsoft-Windows-Security-Auditing |
1 | 4663 | Microsoft-Windows-Security-Auditing |
1 | 4704 | Microsoft-Windows-Security-Auditing |
1 | 4728 | Microsoft-Windows-Security-Auditing |
1 | 4756 | Microsoft-Windows-Security-Auditing |
1 | 5152 | Microsoft-Windows-Security-Auditing |
1 | 5038 | Microsoft-Windows-Security-Auditing |
1 | 4946 | Policy Change |
1 | 4947 | Policy Change |
1 | 4948 | Policy Change |
1 | 4950 | Policy Change |
1 | 4951 | Policy Change |
1 | 4952 | Policy Change |
1 | 4954 | Policy Change |
1 | 4957 | Policy Change |
1 | 4958 | Policy Change |
1 | 657 | Security |
1 | 660 | Security |
1 | 663 | Security |
1 | 675 | Security |
1 | 676 | Security |
1 | 680 | Security |
1 | 849 | Security |
1 | 850 | Security |
1 | 851 | Security |
1 | 852 | Security |
1 | 853 | Security |
1 | 854 | Security |
1 | 855 | Security |
1 | 857 | Security |
1 | 859 | Security |
1 | 860 | Security |
1 | 861 | Security |
1 | 5025 | System Events |
1 | 5027 | System Events |
1 | 5028 | System Events |
1 | 5029 | System Events |
1 | 5030 | System Events |
1 | 5034 | System Events |
1 | 5035 | System Events |
1 | 5037 | System Events |
1 | 6281 | System Events |
1 | 4953 | Uncategorized |
1 | 5031 | Uncategorized |
1 | 5050 | Uncategorized |