Windows оқиғалары
Special privileges assigned to new logon
Жаңа кіруге тағайындалған арнайы артықшылықтар
AI
Event ID 4672
Security
Audit Special Logon
Негізгі өрістер
IP мекенжайы
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Компьютер атауы
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Пайдаланушы аты
SubjectUserName
Windows
Subject: Account Name
ELK
winlog.event_data.SubjectUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Маңызды өріс
PrivilegeList
Windows
Privileges
ELK
winlog.event_data.PrivilegeList
Microsoft Sentinel
-
QRadar
-
Splunk
-
Өрістер
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| SubjectUserSid | Subject: Security ID | winlog.event_data.SubjectUserSid | - | - | - |
| SubjectUserName | Subject: Account Name | winlog.event_data.SubjectUserName | - | - | - |
| SubjectDomainName | Subject: Account Domain | winlog.event_data.SubjectDomainName | - | - | - |
| SubjectLogonId | Subject: Logon ID | winlog.event_data.SubjectLogonId | - | - | - |
| PrivilegeList | Privileges | winlog.event_data.PrivilegeList | - | - | - |
| Computer Жүйелік өріс | Computer Жүйелік өріс | winlog.computer_name | - | - | - |
| ProcessID Жүйелік өріс | ProcessID Жүйелік өріс | winlog.process.pid | - | - | - |
| IP Жүйелік өріс | IP Жүйелік өріс | - | - | - | - |
| ThreadID Жүйелік өріс | ThreadID Жүйелік өріс | winlog.process.thread.id | - | - | - |
Оқиға мысалы
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4672</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12548</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-02T14:55:36.9645305Z" />
<EventRecordID>156856</EventRecordID>
<Correlation />
<Execution ProcessID="848" ThreadID="7696" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-5-21-1838030176-2987033226-1986555923-1104</Data>
<Data Name="SubjectUserName">cs_admin</Data>
<Data Name="SubjectDomainName">SOCPEDIA</Data>
<Data Name="SubjectLogonId">0xc77469e</Data>
<Data Name="PrivilegeList">SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege SeEnableDelegationPrivilege</Data>
</EventData>
</Event>