Search Windows Event IDs by number, keyword, log, or audit category — with how‑to‑collect steps.
No matches in any reference table.
Seen in the Error Code field of Event ID 4776.
Seen in the Result Code field of Kerberos ticket events 4768, 4769, 4770, 4771, 4772, 4774, 4775, 4777, 4820, 4821, and 4824.
Seen in the Ticket Encryption Type field of Kerberos ticket events 4768, 4769, 4770, 4771, 4772, 4774, 4775, and 4777.
Seen in the Pre-Authentication Type field of Kerberos ticket events 4768, 4769, 4770, 4771, 4772, 4774, 4775, 4777, and 4824.
Bit flags making up the Ticket Options field of Kerberos ticket events 4768, 4769, 4770, 4771, 4772, 4774, 4775, 4777, 4820, and 4821 — OR the relevant bit masks together to decode a value (e.g. 0x40810010 = forwardable + renewable + canonicalize + renewable-ok).
Seen in the Logon Type field of logon-related Security events (4624, 4625, 4634, 4647, 4648, 4649, 4675, 4779, 4800–4803, 4964, 5378, 5632, 5633).
Seen in the Protocol field of IPsec and Windows Firewall events (4709–4712, 4944–4958, 5031, 5040–5048, 5140, 5150–5159, and the 5440–5477 range) — 67 events in total.
Seen in the Reason Code field of Network Policy Server events 6272–6280.
Seen in Event ID 40 (TerminalServices‑LocalSessionManager).
Raw Group Policy audit category mapping, before expansion into individual events.
1,417 technique–event associations across 390 ATT&CK techniques and 48 Security-log events. High-fan-out events (e.g. 4688 Process Creation maps to 286 techniques) are truncated in the main catalogue's detail view — this is the full table. Search by technique ID, technique name, or event ID.
1,795 official Windows NTSTATUS values (code, symbolic name, and description) — the full range returned in fields like Status / Sub Status on events such as 4625 (An account failed to log on). Search by code or name.
Message-table string references (the raw %%NNNN tokens Windows substitutes into rendered event text) seen in two places: the Sub Status field of Event ID 4625 (An account failed to log on), and the Logon Process / Authentication Package fields of logon-related Security events.
The Splunk Common Information Model data models/datasets that a Windows event log maps cleanly to, for normalizing this catalogue's events alongside other vendors' data in Splunk. The TA-Verified column shows whether that dataset is confirmed by the real Splunk Add-on for Microsoft Windows package (v11.0.2)'s own eventtypes.conf / tags.conf — "Yes"/"Partial" rows are cross-checked against the actual product; "No" rows are this catalogue's own analysis for sources the add-on doesn't cover at the event-code level (Sysmon, Terminal Services, the dedicated Windows Firewall channels, Certificate Services Client, and more). Populated on events only where the mapping is well-established and unambiguous — a blank "Splunk CIM" field means no confident single-dataset mapping exists.
Search, filter and browse every field parsed out of an event's sample log text — only events with a detailed field schema (beyond the common header envelope) appear here.
| Log | Event | Field | Type | Category |
|---|
Cross-tabulate the catalogue by any two facets — log, category, ACSC priority, MITRE technique, NIST 800-53 AU control, and more — then click a cell, row, or column to see exactly which events fall into it.
Every operation across six Microsoft cloud audit/log schemas — Microsoft Entra ID, Azure resource logs, the Azure Activity Log, Microsoft Intune, Microsoft Purview's unified audit log, and Azure DevOps — mapped to its category, resource provider, and resource type.
| Service | Category | Operation | Resource provider | Resource type |
|---|