Skip to content

Apdx-Event-Logs.md

Latest commit

 

History

History
370 lines (185 loc) · 9.73 KB

Apdx-Event-Logs.md

File metadata and controls

370 lines (185 loc) · 9.73 KB
Raw

Windows (7) Event Log {#h.dgqjcakmo7w9" id="h.dgqjcakmo7w9

Custom Views {#h.8vpbm97preop" id="h.8vpbm97preop

Server Roles

Administrative Events

Microsoft Exchange with Database Availability Group Events

Custom Views can import as Xml files

Windows Logs {#h.k1mlra2iuj8w" id="h.k1mlra2iuj8w

Application %SystemRoot%\System32\Winevt\Logs\Application.evtx

Security %SystemRoot%\System32\Winevt\Logs\Security.evtx

Setup %SystemRoot%\System32\Winevt\Logs\Setup.evtx

System %SystemRoot%\System32\Winevt\Logs\System.evtx

Forwarded Events %SystemRoot%\System32\Winevt\Logs\ForwardedEvents.evtx

Applications and Services Logs {#h.dngf5u4tmugc" id="h.dngf5u4tmugc

ACEEventLog %SystemRoot%\System32\Winevt\Logs\ACEEventLog.evtx

Hardware Events %SystemRoot%\System32\Winevt\Logs\HardwareEvents.evtx

Internet Explorer %SystemRoot%\System32\Winevt\Logs\Internet Explorer.evtx

Key Management Service %SystemRoot%\System32\Winevt\Logs\Key Management Service.evtx

Media Center %SystemRoot%\System32\Winevt\Logs\Media Center.evtx

Microsoft

Windows

API-Tracing/Operational \<Default>\Microsoft-Windows-API-Tracing%4Operational.evtx

AppID/Operational

Application Server-Applications/Admin \<Default>\Microsoft-Windows-Application Server-Applications%4Admin.evtx

Application Server-Applications/Operational \<Default>\Microsoft-Windows-Application Server-Applications%4Operational.evtx

Application-Experience/Problem-Steps-Recorder \<Default>\Microsoft-Windows-Application-Experience%4Problem-Steps-Recorder.evtx

Application-Experience/Program-Compatibility-Assistant \<Default>\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Application-Experience/Program-Compatibility-Troubleshooter \<Default>\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx

Application-Experience/Program-Inventory \<Default>\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx

Application-Experience/Program-Telemetry \<Default>\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

AppLocker/EXE and DLL

AppLocker/MSI and Script

Audio/Capture Monitor

Audio/Operational

Authentication User Interface/Operational

Backup/Operational

Biometrics/Operational

Bits-Client/Analytic \<Default>\Microsoft-Windows-Bits-Client%4Analytic.evtx

Bits-Client/Operational \<Default>\Microsoft-Windows-Bits-Client%4Operational.evtx

Bluetooth-MTPEnum/Operational

BranchCache/Operational

BranchCacheSMB/Operational

CAPI2/Operational

CertificateServiceClient-CredentialRoaming/Operational

CertPolEng/Operational

CodeIntegrity/Operational

CorruptedFileRecovery-Client/Operational

CorruptedFileRecovery-Server/Operational

DateTimeControlPanel/Operational

DeviceSync/Operational

Dhcp-Client

Microsoft-Windows DHCP Client Events/Admin \<Default>\Microsoft-Windows-Dhcp-Client%4Admin.evtx

Microsoft-Windows DHCP Client Events/Operational \<Default>\Microsoft-Windows-Dhcp-Client%4Operational.evtx

Dhcp-Nap-Enforcement-Client

Microsoft-Windows-DHCPNap/Admin \<Default>\Microsoft-Windows-DhcpNap%4Admin.evtx

Microsoft-Windows-DHCPNap/Operational \<Default>\Microsoft-Windows-DhcpNap%4Operational.evtx

DHCPv6-Client

Microsoft-Windows-DHCP Client Events/Operational \<Default>\Microsoft-Windows-Dhcpv6-Client%4Operational.evtx

Microsoft-Windows-DHCPv6 Client Events/Admin \<Default>\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx

Diagnosis-DPS/Operational

Diagnosis-PCW/Operational

Diagnosis-PLA/Operational

Diagnosis-Schedule/Operational

Diagnosis-Scripted/Admin \<Default>\Microsoft-Windows-Diagnosis-Scripted%4Admin.evtx

Diagnosis-Scripted/Operational \<Default>\Microsoft-Windows-Diagnosis-Scripted%4Operational.evtx

Diagnosis-ScriptedDiagnosticsProvider/Operational

Diagnostics-Networking/Operational

Diagnostics-Performance/Operational

DiskDiagnostic/Operational

DiskDiagnosticDataCollector/Operational

DiskDiagnosticResolver/Operational

DisplayColorCalibration/Operational

DNS Client Events/Operational

DriverFrameworks-Usermode/Operational

EapHost/Operational

EventCollector/Operational

Eventlog-ForwardingPlugin/Operational

Fault-Tolerant-Heap/Operational

FMS/Operational

Folder Redirection/Operational \<Default>\Microsoft-Windows-Folder Redirection%4Operational.evtx

GroupPolicy/Operational \<Default>\Microsoft-Windows-GroupPolicy%4Operational.evtx

Help/Operational

HomeGroup Control Pan/Operational

HomeGroup Provider Service/Operational

HomeGroup-ListenerService

Microsoft-Windows-HomeGroup Listener Service/Operational

HttpService/HTTP Service Channel

International/Operational

International-RegionalOptionsControlPanel/Operational

Iphlpsvc/Operational

Kernel-EventTracing/Admin \<Default>\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx

Kernel-Power/Thermal-Operational

Kernel-StoreMgr/Operational

Kernel-WDI/Operational

Kernel-WHEA/Operational

Errors

Operational

Known Folders/Operational

LanguagePackSetup/Operational

MCT/Operational

MemoryDiagnostics-Results/Debug

MSPaint/Admin

MUI/Admin \<Default>\Microsoft-Windows-MUI%4Admin.evtx

MUI/Operational \<Default>\Microsoft-Windows-MUI%4Operational.evtx

NCSI/Operational

NDIS/Operational

Network Access Protection/Operational

Network Access Protection/WHC

NetworkProfile/Operational

NlaSvc/Operational

NTLM/Operational

OfflineFiles/Operational

ParentalControls/Operational \<Default>\Microsoft-Windows-ParentalControls%4Operational.evtx

PeopleNearMe/Operational

PowerShell/Operational

PrimaryNetworkIcon

Microsoft-Windows-NetworkLocationWizard/Operational

PrintService/Admin \<Default>\Microsoft-Windows-PrintService%4Admin.evtx

PrintService/Operational \<Default>\Microsoft-Windows-PrintService%4Operational.evtx

ReadyBoost/Operational

ReadyBoostDriver/Operational

Recovery/Operational

Reliability-Analysis-Engine/Operational

RemoteApp and Desktop Connections/Admin \<Default>\Microsoft-Windows-RemoteApp and Desktop Connections%4Admin.evtx

RemoteAssistance/Admin \<Default>\Microsoft-Windows-RemoteAssistance%4Admin.evtx

RemoteAssistance/Operational \<Default>\Microsoft-Windows-RemoteAssistance%4Operational.evtx

RemoteDesktopServices-RemoteDesktopSessionManager/Admin \<Default>\microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager%4Admin.evtx

Resource-Exhaustion-Detector/Operational

Resource-Exhaustion-Resolver/Operational

Resource-Leak-Diagnostic/Operational

RestartManager/Operational

Security-Audit-Configuration-Client/Operational

Security-IdentityListener/Operation log

Service Reporting API/Debug

StickyNotes/Admin

TaskScheduler/Operational \<Default>\Microsoft-Windows-TaskScheduler%4Operational.evtx

TerminalServices-ClientActiveXCore

Microsoft-Windows-TerminalServices-RDPClient/Operational

TerminalServices-ClientUSBDevices/Admin \<Default>\Microsoft-Windows-TerminalServices-ClientUSBDevices%4Admin.evtx

TerminalServices-ClientUSBDevices/Operational \<Default>\Microsoft-Windows-TerminalServices-ClientUSBDevices%4Operational.evtx

TerminalServices-LocalSessionManager/Admin \<Default>\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx

TerminalServices-LocalSessionManager/Operational \<Default>\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

TerminalServices-PnPDevices/Admin \<Default>\Microsoft-Windows-TerminalServices-PnPDevices%4Admin.evtx

TerminalServices-PnPDevices/Operational \<Default>\Microsoft-Windows-TerminalServices-PnPDevices%4Operational.evtx

TerminalServices-RemoteConnectionManager/Admin \<Default>\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx

TerminalServices-RemoteConnectionManager/Operational \<Default>\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx

TZUtil/Operational

UAC/Operational

IAC-FileVirtualization/Operational

User Profile Service/Operational \<Default>\Microsoft-Windows-User Profile Service%4Operational.evtx

VDRVROOT/Operational

VHDMP/Operational

WebIO

NDF/Diagnostic

WER-Diagnostics/Operational

WFP

Microsoft-Windows-IKE/Operational

Operational

WindowsDefender

Operational \<Default>\Microsoft-Windows-Windows Defender%4Operational.evtx

WHC \<Default>\Microsoft-Windows-Windows Defender%4WHC.evtx

Windows Firewall With Advanced Security/ConnectionSecurity \<Default>\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx

Windows Firewall With Advanced Security/ConnectionSecurityVerbose \<Default>\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurityVerbose.evtx

Windows Firewall With Advanced Security/Firewall \<Default>\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Windows Firewall With Advanced Security/FirewallVerbose \<Default>\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallVerbose.evtx

Windows Remote Management/Operational

WindowsBackup/ActionCenter \<Default>\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx

WindowsColorSystem/Operational

WindowsSystemAssessmentTool/Operational

WindowsUpdateClient/Operational

WinHttp

NDF/Diagnostic \<Default>\Microsoft-Windows-WinHTTP-NDF%4Diagnostic.evtx

Winlogon/Operational

Winsock Catalog Change/Operational

Winsock Network Event/Operational

Wired-AutoConfig/Operational

WLAN-AutoConfig/Operational

Wordpad/Admin \<Default>\Microsoft-Windows-Wordpad%4Admin.evtx

WPD-ClassInstaller/Operational

WPD-CompositeClassDriver/Operational

WPD-MTPClassDriver/Operational

Microsoft Exchange PSTCapture %SystemRoot%\System32\Winevt\Logs\Microsoft Exchange PSTCapture.evtx

Microsoft Office Alerts %SystemRoot%\System32\Winevt\Logs\OAlerts.evtx

Windows PowerShell %SystemRoot%\System32\Winevt\Logs\Windows PowerShell.evtx