Data Modeling Table¶
Data Source |
Sub Data Source |
Source |
Relationship |
Target |
EventID |
Event Description |
Event Channel |
|---|---|---|---|---|---|---|---|
Authentication logs |
NTLM Credentials Validation |
host |
authenticated |
user |
4776 |
The computer attempted to validate the credentials for an account |
Security |
Authentication logs |
kerberos TGT authentication failure |
user |
authenticated_with |
ticket granting ticket |
4771 |
Kerberos pre-authentication failed |
Security |
Authentication logs |
user account successful authentication |
user |
authenticated |
host |
4624 |
An account was successfully logged on |
Security |
Authentication logs |
user account authentication with explicit credential |
user |
authenticated |
host |
4648 |
A logon was attempted using explicit credentials |
Security |
DLL monitoring |
module load |
process |
loaded |
module |
7 |
The image loaded event logs when a module is loaded in a specific process . |
Microsoft-windows-sysmon/operational |
DNS records |
DNS Queries |
process |
execute |
dns_query |
22 |
This event generates when a process executes a DNS query, whether the result is successful or fails, cached or not. |
Microsoft-windows-sysmon/operational |
File monitoring |
drivers load |
driver |
loaded |
driver |
6 |
The driver loaded events provides information about a driver being loaded on the system |
Microsoft-windows-sysmon/operational |
File monitoring |
drive raw access |
process |
raw_access_read |
drive |
9 |
The RawAccessRead event detects when a process conducts reading operations from the drive using the .\ denotation |
Microsoft-windows-sysmon/operational |
File monitoring |
file creation |
process |
created |
file |
11 |
File create operations are logged when a file is created or overwritten. |
Microsoft-windows-sysmon/operational |
File monitoring |
file timestamp modification |
process |
modified |
file |
2 |
A process changed a file creation time |
Microsoft-windows-sysmon/operational |
File monitoring |
file modification |
process |
modified |
file |
11 |
File create operations are logged when a file is created or overwritten. |
Microsoft-windows-sysmon/operational |
File monitoring |
file modification |
process |
renamed |
file |
11 |
File create operations are logged when a file is created or overwritten. |
Microsoft-windows-sysmon/operational |
File monitoring |
file download |
process |
downloaded |
file |
11 |
File create operations are logged when a file is created or overwritten. |
Microsoft-windows-sysmon/operational |
File monitoring |
file access |
user |
accessed |
file |
5145 |
A network share object was checked to see whether client can be granted desired access |
Security |
File monitoring |
file access request |
user |
requested_a_handle |
file |
4656 |
A handle to an object was requested. |
Security |
File monitoring |
file deletion request |
user |
requested_a_handle |
file |
4656 |
A handle to an object was requested. |
Security |
File monitoring |
file access |
user |
accessed |
file |
4663 |
An attempt was made to access an object. |
Security |
File monitoring |
file deletion |
user |
deleted |
file |
4663 |
An attempt was made to access an object. |
Security |
File monitoring |
file permissions change |
user |
changed_permissions |
file |
4670 |
Permissions on an object were changed. |
Security |
File monitoring |
file deletion |
process |
deleted |
None |
4660 |
An object was deleted |
Security |
File monitoring |
win registry key handle closed |
process |
closed_a_handle |
handle |
4658 |
The handle to an object was closed |
Security |
Loaded DLLs |
module load |
process |
loaded |
module |
7 |
The image loaded event logs when a module is loaded in a specific process . |
Microsoft-windows-sysmon/operational |
Named Pipes |
win pipe creation |
process |
created |
pipe |
17 |
This event generates when a named pipe is created. |
Microsoft-windows-sysmon/operational |
Named Pipes |
win pipe connection |
process |
connected_to |
pipe |
18 |
This event logs when a named pipe connection is made between a client and a server. |
Microsoft-windows-sysmon/operational |
Process command-line parameters |
process creation |
process |
created |
process |
4688 |
A new process has been created |
Security |
Process command-line parameters |
process creation |
process |
created |
process |
1 |
Process creation |
Microsoft-windows-sysmon/operational |
Process monitoring |
process creation |
process |
created |
process |
4688 |
A new process has been created |
Security |
Process monitoring |
process creation |
process |
created |
process |
1 |
Process creation |
Microsoft-windows-sysmon/operational |
Process monitoring |
process termination |
user |
terminated |
process |
4689 |
A process has exited |
Security |
Process monitoring |
process termination |
process |
terminated |
None |
5 |
The process terminate event reports when a process terminates. |
Microsoft-windows-sysmon/operational |
Process monitoring |
process write to process |
process |
wrote_to |
process |
8 |
The CreateRemoteThread event detects when a process creates a thread in another process. |
Microsoft-windows-sysmon/operational |
Process monitoring |
process access |
process |
opened |
process |
10 |
The process accessed event reports when a process opens another process. |
Microsoft-windows-sysmon/operational |
Process use of network |
process network connection allow |
process |
connected_to |
ip |
3 |
The network connection event logs TCP/UDP connections on the machine. |
Microsoft-windows-sysmon/operational |
Process use of network |
process network connection allow |
process |
connected_to |
host |
3 |
The network connection event logs TCP/UDP connections on the machine. |
Microsoft-windows-sysmon/operational |
Process use of network |
process network connection allow |
user |
connected_to |
host |
3 |
The network connection event logs TCP/UDP connections on the machine. |
Microsoft-windows-sysmon/operational |
Process use of network |
process network connection allow |
user |
connected_to |
ip |
3 |
The network connection event logs TCP/UDP connections on the machine. |
Microsoft-windows-sysmon/operational |
Process use of network |
process network service connection block |
host |
blocked_service_connection_to |
process |
5031 |
The Windows Firewall Service blocked an application from accepting incoming connections on the network. |
Security |
Process use of network |
process network listener allow |
host |
permitted_listener_on |
process |
5154 |
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. |
Security |
Process use of network |
process network listener block |
host |
blocked_listener_on |
process |
5155 |
The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. |
Security |
Process use of network |
process network connection allow |
host |
permitted_inbound_connection_on |
process |
5156 |
The Windows Filtering Platform has permitted a connection. |
Security |
Process use of network |
process network connection allow |
process |
connected_from |
ip |
5156 |
The Windows Filtering Platform has permitted a connection. |
Security |
Process use of network |
process network connection allow |
host |
permitted_outbound_connection_on |
process |
5156 |
The Windows Filtering Platform has permitted a connection. |
Security |
Process use of network |
process network connection allow |
process |
connected_to |
ip |
5156 |
The Windows Filtering Platform has permitted a connection. |
Security |
Process use of network |
process network connection block |
host |
blocked_inbound_connection_on |
process |
5157 |
The Windows Filtering Platform has blocked a connection. |
Security |
Process use of network |
process network connection block |
host |
blocked_outbound_connection_on |
process |
5157 |
The Windows Filtering Platform has blocked a connection. |
Security |
Process use of network |
process network local port bind allow |
host |
permitted_local_port_bind_on |
process |
5158 |
The Windows Filtering Platform has permitted a bind to a local port. |
Security |
Process use of network |
process network local port bind allow |
process |
bound _to |
port |
5158 |
The Windows Filtering Platform has permitted a bind to a local port. |
Security |
Process use of network |
process network local port bind blocked |
host |
blocked_local_port_bind_on |
process |
5159 |
The Windows Filtering Platform has blocked a bind to a local port. |
Security |
Windows event logs |
kerberos TGT request |
user |
requested |
ticket granting ticket |
4768 |
A Kerberos authentication ticket (TGT) was requested |
Security |
Windows event logs |
kerberos service ticket request |
user |
requested |
service ticket |
4769 |
A Kerberos service ticket was requested |
Security |
Windows event logs |
kerberos service ticket renewal |
user |
renewed |
service ticket |
4770 |
A Kerberos service ticket was renewed |
Security |
Windows event logs |
kerberos service ticket failure |
user |
requested |
service ticket |
4773 |
A Kerberos service ticket request failed |
Security |
Windows event logs |
user rdp session |
user |
disconnected_from |
host |
4779 |
A session was disconnected from a Window Station |
Security |
Windows event logs |
user rdp session |
user |
connected_to |
host |
4778 |
A session was reconnected to a Window Station |
Security |
Windows event logs |
user lock operation |
user |
locked |
host |
4800 |
The workstation was locked |
Security |
Windows event logs |
user unlock operation |
user |
unlocked |
host |
4801 |
The workstation was unlocked |
Security |
Windows event logs |
computer account creation |
user |
created |
computer |
4741 |
A computer account was created |
Security |
Windows event logs |
computer account change |
user |
changed |
computer |
4742 |
A computer account was changed |
Security |
Windows event logs |
computer account deletion |
user |
deleted |
computer |
4743 |
A computer account was deleted |
Security |
Windows event logs |
distribution group creation |
user |
created |
group |
4749 |
A security-disabled global group was created |
Security |
Windows event logs |
distribution group change |
user |
changed |
group |
4750 |
A security-disabled global group was changed |
Security |
Windows event logs |
distribution group member addition |
user |
added |
user |
4751 |
A member was added to a security-disabled global group |
Security |
Windows event logs |
distribution group member removal |
user |
removed |
user |
4752 |
A member was removed from a security-disabled global group |
Security |
Windows event logs |
distribution group deletion |
user |
deleted |
group |
4753 |
A security-disabled global group was deleted |
Security |
Windows event logs |
security group creation |
user |
created |
group |
4731 |
A security-enabled local group was created |
Security |
Windows event logs |
security group member addition |
user |
added |
user |
4732 |
A member was added to a security-enabled local group. |
Security |
Windows event logs |
security group member removal |
user |
removed |
user |
4733 |
A member was removed from a security-enabled local group. |
Security |
Windows event logs |
security group deletion |
user |
deleted |
group |
4734 |
A security-enabled local group was deleted. |
Security |
Windows event logs |
security group change |
user |
changed |
group |
4735 |
A security-enabled local group was changed. |
Security |
Windows event logs |
security group type change |
user |
changed_type |
group |
4764 |
A group’s type was changed |
Security |
Windows event logs |
security group enumeration |
user |
enumerated |
group members |
4799 |
A security-enabled local group membership was enumerated |
Security |
Windows event logs |
user account creation |
user |
created |
user |
4720 |
A user account was created. |
Security |
Windows event logs |
user account enable |
user |
enabled |
user |
4722 |
A user account was enabled. |
Security |
Windows event logs |
user account password change |
user |
changed_password |
user |
4723 |
An attempt was made to change an account’s password. |
Security |
Windows event logs |
user account password reset |
user |
reset_password |
user |
4724 |
An attempt was made to reset an account’s password. |
Security |
Windows event logs |
user account disable |
user |
disabled |
user |
4725 |
A user account was disabled. |
Security |
Windows event logs |
user account deletion |
user |
deleted |
user |
4726 |
A user account was deleted. |
Security |
Windows event logs |
user account change |
user |
changed |
user |
4738 |
A user account was changed. |
Security |
Windows event logs |
user account lock |
user |
locked |
user |
4740 |
A user account was locked out. |
Security |
Windows event logs |
user account unlock |
user |
unlocked |
user |
4767 |
A user account was unlocked. |
Security |
Windows event logs |
user account name change |
user |
changed_name |
user |
4781 |
The name of an account was changed |
Security |
Windows event logs |
user account group enumeration |
user |
enumerated |
user |
4798 |
A user’s local group membership was enumerated. |
Security |
Windows event logs |
user account group enumeration |
user |
enumerated |
group |
4799 |
A security-enabled local group membership was enumerated |
Security |
Windows event logs |
directory service object access |
user |
accessed |
ad object |
4662 |
An operation was performed on an object |
Security |
Windows event logs |
directory service object handle request |
user |
requested_a_handle |
ad object |
4661 |
A handle to an object was requested |
Security |
Windows event logs |
directory service object modification |
user |
modified |
ad object |
5136 |
A directory service object was modified |
Security |
Windows event logs |
directory service object creation |
user |
created |
ad object |
5137 |
A directory service object was created |
Security |
Windows event logs |
directory service object restoration |
user |
restored |
ad object |
5138 |
A directory service object was undeleted |
Security |
Windows event logs |
directory service object move |
user |
moved |
ad object |
5139 |
A directory service object was moved |
Security |
Windows event logs |
directory service object deletion |
user |
deleted |
ad object |
5141 |
A directory service object was deleted |
Security |
Windows event logs |
user account lockout |
user |
failed |
host |
4625 |
An account failed to log on |
Security |
Windows event logs |
network share access |
user |
accessed |
network share |
5140 |
A network share object was accessed. |
Security |
Windows event logs |
network share addition |
user |
added |
network share |
5142 |
A network share object was added. |
Security |
Windows event logs |
network share modification |
user |
modified |
network share |
5143 |
A network share object was modified. |
Security |
Windows event logs |
network share deletion |
user |
deleted |
network share |
5144 |
A network share object was deleted. |
Security |
Windows event logs |
win registry access request |
process |
requested_a_handle |
win registry key |
4656 |
A handle to an object was requested. |
Security |
Windows event logs |
win registry access request |
user |
requested_a_handle |
win registry key |
4656 |
A handle to an object was requested. |
Security |
Windows event logs |
win registry deletion request |
process |
requested_a_handle |
win registry key |
4656 |
A handle to an object was requested. |
Security |
Windows event logs |
win registry deletion request |
user |
requested_a_handle |
win registry key |
4656 |
A handle to an object was requested. |
Security |
Windows event logs |
symbolic link creation |
user |
created |
symbolic link |
4664 |
An attempt was made to create a hard link. |
Security |
Windows event logs |
scheduled task creation |
user |
created |
scheduled task |
4698 |
A scheduled task was created. |
Security |
Windows event logs |
scheduled task deletion |
user |
deleted |
scheduled task |
4699 |
A scheduled task was deleted. |
Security |
Windows event logs |
scheduled task enable |
user |
enabled |
scheduled task |
4700 |
A scheduled task was enabled. |
Security |
Windows event logs |
scheduled tast disable |
user |
disabled |
scheduled task |
4701 |
A scheduled task was disabled. |
Security |
Windows event logs |
scheduled task update |
user |
updated |
scheduled task |
4702 |
A scheduled task was updated. |
Security |
Windows event logs |
win registry key deletion |
process |
deleted |
None |
4660 |
An object was deleted |
Security |
Windows event logs |
win registry key access |
process |
accessed |
win registry key |
4663 |
An attempt was made to access an object. |
Security |
Windows event logs |
win registry key access |
user |
accessed |
win registry key |
4663 |
An attempt was made to access an object. |
Security |
Windows event logs |
win registry key deletion |
process |
deleted |
win registry key |
4663 |
An attempt was made to access an object. |
Security |
Windows event logs |
win registry key deletion |
user |
deleted |
win registry key |
4663 |
An attempt was made to access an object. |
Security |
Windows event logs |
win registry key handle closed |
process |
closed_a_handle |
handle |
4658 |
The handle to an object was closed |
Security |
Windows event logs |
win registry key permissions change |
process |
changed_permissions |
win registry key |
4670 |
Permissions on an object were changed. |
Security |
Windows event logs |
win registry key permissions change |
user |
changed_permissions |
win registry key |
4670 |
Permissions on an object were changed. |
Security |
Windows event logs |
win registry key value modification |
user |
modified |
win registry key value |
4657 |
A registry value was modified. |
Security |
Windows event logs |
win registry key value modification |
process |
modified |
win registry key value |
4657 |
A registry value was modified. |
Security |
Windows event logs |
sam service object handle request |
user |
requested_a_handle |
sam object |
4661 |
A handle to an object was requested |
Security |
Windows event logs |
user account access addition |
user |
granted_access |
user |
4717 |
System security access was granted to an account. |
Security |
Windows event logs |
user account access removal |
user |
removed_access |
user |
4718 |
System security access was removed from an account. |
Security |
Windows event logs |
non-sensitive privileged operation |
process |
attempted |
object |
4674 |
An operation was attempted on a privileged object. |
Security |
Windows event logs |
sensitive privileged service operation |
process |
called |
privileged service |
4673 |
A privileged service was called. |
Security |
Windows event logs |
sensitive privileged operation |
process |
attempted |
privileged object |
4674 |
An operation was attempted on a privileged object. |
Security |
Windows event logs |
win firewall service stop |
process |
stopped |
Firewall Service |
5025 |
The Windows Firewall Service has been stopped. |
Security |
Windows event logs |
win firewall service stop |
user |
stopped |
Firewall Service |
5025 |
The Windows Firewall Service has been stopped. |
Security |
Windows event logs |
win firewall driver stop |
process |
stopped |
Firewall Driver |
5034 |
The Windows Firewall Driver was stopped. |
Security |
Windows event logs |
win firewall driver stop |
user |
stopped |
Firewall Driver |
5034 |
The Windows Firewall Driver was stopped. |
Security |
Windows event logs |
win service installation |
user |
installed |
service |
4697 |
A service was installed in the system. |
Security |
Windows event logs |
NTLM Credentials Validation |
host |
authenticated |
user |
4776 |
The computer attempted to validate the credentials for an account |
Security |
Windows event logs |
kerberos TGT authentication failure |
user |
authenticated_with |
ticket granting ticket |
4771 |
Kerberos pre-authentication failed |
Security |
Windows event logs |
user account successful authentication |
user |
authenticated |
host |
4624 |
An account was successfully logged on |
Security |
Windows event logs |
user account authentication with explicit credential |
user |
authenticated |
host |
4648 |
A logon was attempted using explicit credentials |
Security |
Windows Registry |
win registry key value modification |
user |
modified |
win registry key value |
4657 |
A registry value was modified. |
Security |
Windows Registry |
win registry key value modification |
process |
modified |
win registry key value |
4657 |
A registry value was modified. |
Security |
Windows Registry |
win registry key creation |
process |
created |
win registry key |
12 |
Registry key and value create and delete operations map to this event type. (Object create and delete) |
Microsoft-windows-sysmon/operational |
Windows Registry |
win registry key deletion |
process |
deleted |
win registry key |
12 |
Registry key and value create and delete operations map to this event type. (Object create and delete) |
Microsoft-windows-sysmon/operational |
Windows Registry |
win registry key modification |
process |
renamed |
win registry key |
14 |
Registry key and value rename operations map to this event type. (Key and Value Rename) |
Microsoft-windows-sysmon/operational |
Windows Registry |
win registry key value modification |
process |
renamed |
win registry key value |
14 |
Registry key and value rename operations map to this event type. (Key and Value Rename) |
Microsoft-windows-sysmon/operational |
Windows Registry |
win registry key value modification |
process |
modified |
win registry key value |
13 |
This Registry event type identifies Registry value modifications. (Value Set) |
Microsoft-windows-sysmon/operational |