Skip Headers
Oracle® Audit Vault and Database Firewall Auditor's Guide
Release 12.1.2

E27777-09
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Master Index
Master Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

I Microsoft Windows Operating System Audit Events

This appendix maps audit event names used in the Microsoft Windows Operating System to their equivalent values in the command_class and target_type fields in the Oracle AVDF audit record. You can use the audit events mapped here to create custom audit reports using other Oracle Database reporting products or third-party tools. See also "Oracle Audit Vault and Database Firewall Database Schemas" for Oracle AVDF data warehouse details that may be useful in designing your own reports.

Table I-1 lists the Windows audit events and the equivalent Oracle AVDF events.

Table I-1 Windows Operating System Audit Events

Source Event command_class target_type

ACCOUNT_MAPPED_FOR_LOGON

LOGIN

ACCOUNT

ACCOUNT_COULD_NOT_MAP_FOR_LOGON

LOGIN

ACCOUNT

ATTEMPTED_TO_VALIDATE_ACCOUNT_CREDENTIAL

VALIDATE

ACCOUNT

FAILED_TO_VALIDATE_ACCOUNT_CREDENTIAL

VALIDATE

ACCOUNT

KERBEROS_AUTHENTICATE_TICKET_REQUEST

AUTHENTICATE

SYSTEM

KERBEROS_PRE_AUTHENTICATION_FAILED

AUTHENTICATE

SYSTEM

KERBEROS_AUTHENTICATION_TICKET_REQUEST_FAILED

AUTHENTICATE

SYSTEM

KERBEROS_SERVICE_TICKET_REQUESTED

REQUEST

SYSTEM

KERBEROS_SERVICE_TICKET_RENEWED

RENEW

SYSTEM

BASIC_APPLICATION_GROUP_CREATED

CREATE

GROUP

BASIC_APPLICATION_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_BASIC_APPLICATION_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_BASIC_APPLICATION_GROUP

UPDATE

GROUP

NON-MEMBER_ADDED_TO_BASIC_APPLICATION_GROUP

UPDATE

GROUP

NON-MEMBER_REMOVED_FROM_BASIC_APPLICATION_GROUP

UPDATE

GROUP

BASIC_APPLICATION_GROUP_DELETED

DELETE

GROUP

LDAP_QUERY_GROUP_CREATED

CREATE

GROUP

COMPUTER_ACCOUNT_CREATED

CREATE

ACCOUNT

COMPUTER_ACCOUNT_MODIFIED

UPDATE

ACCOUNT

COMPUTER_ACCOUNT_DELETED

DELETE

ACCOUNT

SECURITY-DISABLED_LOCAL_GROUP_CREATED

CREATE

GROUP

SECURITY-DISABLED_LOCAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-DISABLED_LOCAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-DISABLED_LOCAL_GROUP

UPDATE

GROUP

SECURITY-DISABLED_LOCAL_GROUP_DELETED

DELETE

GROUP

SECURITY-DISABLED_GLOBAL_GROUP_CREATED

CREATE

GROUP

SECURITY-DISABLED_GLOBAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-DISABLED_GLOBAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-DISABLED_GLOBAL_GROUP

UPDATE

GROUP

SECURITY-DISABLED_GLOBAL_GROUP_DELETED

DELETE

GROUP

SECURITY-DISABLED_UNIVERSAL_GROUP_CREATED

CREATE

GROUP

SECURITY-DISABLED_UNIVERSAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-DISABLED_UNIVERSAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-DISABLED_UNIVERSAL_GROUP

UPDATE

GROUP

SECURITY-DISABLED_UNIVERSAL_GROUP_DELETED

DELETE

GROUP

PASSWORD_POLICY_CHECKING_API_CALLED

CALL

POLICY

SECURITY-ENABLED_GLOBAL_GROUP_CREATED

CREATE

GROUP

MEMBER_ADDED_TO_SECURITY-ENABLED_GLOBAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-ENABLED_GLOBAL_GROUP

UPDATE

GROUP

SECURITY-ENABLED_GLOBAL_GROUP_DELETED

DELETE

GROUP

SECURITY-ENABLED_LOCAL_GROUP_CREATED

CREATE

GROUP

MEMBER_ADDED_TO_SECURITY-ENABLED_LOCAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-ENABLED_LOCAL_GROUP

UPDATE

GROUP

SECURITY-ENABLED_LOCAL_GROUP_DELETED

DELETE

GROUP

SECURITY-ENABLED_LOCAL_GROUP_MODIFIED

UPDATE

GROUP

SECURITY-ENABLED_GLOBAL_GROUP_MODIFIED

UPDATE

GROUP

SECURITY-ENABLED_UNIVERSAL_GROUP_CREATED

CREATE

GROUP

SECURITY-ENABLED_UNIVERSAL_GROUP_MODIFIED

UPDATE

GROUP

MEMBER_ADDED_TO_SECURITY-ENABLED_UNIVERSAL_GROUP

UPDATE

GROUP

MEMBER_REMOVED_FROM_SECURITY-ENABLED_UNIVERSAL_GROUP

UPDATE

GROUP

SECURITY-ENABLED_UNIVERSAL_GROUP_DELETED

DELETE

GROUP

CHANGED_TYPE_OR_SCOPE_OF_GROUP

UPDATE

GROUP

CREATED_USER_ACCOUNT

CREATE

ACCOUNT

ENABLED_USER_ACCOUNT

ENABLE

ACCOUNT

ATTEMPTED_TO_MODIFY_ACCOUNT_PASSWORD

UPDATE

ACCOUNT

ATTEMPTED_TO_RESET_ACCOUNT_PASSWORD

RESET

ACCOUNT

DISABLED_USER_ACCOUNT

DISABLE

ACCOUNT

DELETED_USER_ACCOUNT

DELETE

ACCOUNT

MODIFIED_USER_ACCOUNT

UPDATE

ACCOUNT

LOCKED_OUT_USER_ACCOUNT

LOCK

ACCOUNT

SID_HISTORY_ADDED_TO_ACCOUNT

UPDATE

ACCOUNT

ATTEMPT_TO_ADD_SID_HISTORY_TO_ACCOUNT_FAILED

INSERT

ACCOUNT

UNLOCKED_USER_ACCOUNT

UNLOCK

ACCOUNT

ACL_SET_ON_ACCOUNT

SET

ACCOUNT

MODIFIED_ACCOUNT_NAME

UPDATE

ACCOUNT

MODIFIED_DIRECTORY_SERVICE_RESTORE_MODE_ADMIN_PASSWORD

UPDATE

SERVICE

BACKED_UP_CREDENTIAL_MANAGER_CREDENTIALS

BACKUP

MANAGER

RESTORED_CREDENTIAL_MANAGER_CREDENTIALS

RESTORE

MANAGER

CREATED_NEW_PROCESS

START

PROCESS

ASSIGNED_PRIMARY_TOKEN_TO_PROCESS

ASSIGN

PROCESS

EXITED_PROCESS

STOP

PROCESS

REMOTE_PROCEDURE_CALL_ATTEMPTED

REMOTE CALL

PROCEDURE

ACCOUNT_FAILED_TO_LOGON

LOGIN

ACCOUNT

LOGGED_OFF_ACCOUNT

LOGOUT

ACCOUNT

USER_INITIATED_LOGOFF

LOGOUT

ACCOUNT

ACCOUNT_LOGON_SUCCESSFUL

LOGIN

ACCOUNT

LOGON_ATTEMPTED_USING_EXPLICIT_CREDENTIAL

LOGIN

SYSTEM

NETWORK_POLICY_SERVER_GRANTED_USER_ACCESS

GRANT

USER

NETWORK_POLICY_SERVER_DENIED_USER_ACCESS

DENY

USER

NETWORK_POLICY_SERVER_DISCARDED_USER_REQUEST

DENY

USER

NETWORK_POLICY_SERVER_DISCARDED_USER_ACCOUNTING_REQUEST

DENY

USER

NETWORK_POLICY_SERVER_QUARANTINED_USER

QUARANTINE

USER

NETWORK_POLICY_SERVER_GRANTED_USER_ACCESS_WITH_PROBATION

GRANT

USER

NETWORK_POLICY_SERVER_GRANTED_FULL_ACCESS

GRANT

USER

NETWORK_POLICY_SERVER_LOCKED_USER_ACCOUNT

LOCK

ACCOUNT

NETWORK_POLICY_SERVER_UNLOCKED_USER_ACCOUNT

UNLOCK

ACCOUNT

REPLAY_ATTACK_DETECTED

GET

SYSTEM

SESSION_RECONNECTED_TO_WORKSTATION

CONNECT

WORKSTATION

SESSION_DISCONNECTED_FROM_WORKSTATION

DISCONNECT

WORKSTATION

LOCKED_WORKSTATION

LOCK

WORKSTATION

UNLOCKED_WORKSTATION

UNLOCK

WORKSTATION

INVOKED_SCREEN_SAVER

CALL

SCREEN SAVER

DISMISSED_SCREEN_SAVER

ABORT

SCREEN SAVER

REQUESTED_CREDENTIAL_DELEGATION_DISALLOWED_BY_POLICY

DENY

ACCOUNT

REQUEST_MADE_TO_AUTHENTICATE_WIRELESS_NETWORK

AUTHENTICATE

NETWORK

REQUEST_MADE_TO_AUTHENTICATE_WIRED_NETWORK

AUTHENTICATE

NETWORK

SPECIAL_GROUP_ASSIGNED_TO_LOGON

ASSIGN

ACCOUNT

CERTIFICATE_SERVICES_RECEIVED_RESUBMITTED_CERTIFICATE_REQUEST

RECEIVE

CERTIFICATE

CERTIFICATE_SERVICES_REVOKED_CERTIFICATE

REVOKE

CERTIFICATE

CERTIFICATE_SERVICES_RECEIVED_CERTIFICATE_REVOKATION_LIST_PUBLISH_REQUEST

RECEIVE

CRL

CERTIFICATE_SERVICES_PUBLISHED_CRL

PUBLISH

CRL

CERTIFICATE_REQUEST_EXTENSION_MODIFIED

UPDATE

CERTIFICATE

CERTIFICATE_REQUEST_ATTRIBUTES_MODIFIED

UPDATE

CERTIFICATE

CERTIFICATE_SERVICE_RECEIVED_SHUT_DOWN_REQUEST

RECEIVE

SERVICE

CERTIFICATE_SERVICE_BACKUP_STARTED

BACKUP

SERVICE

CERTIFICATE_SERVICE_BACKUP_COMPLETED

BACKUP

SERVICE

CERTIFICATE_SERVICE_RESTORE_STARTED

RESTORE

SERVICE

CERTIFICATE_SERVICE_RESTORE_COMPLETED

RESTORE

SERVICE

CERTIFICATE_SERVICE_STARTED

START

SERVICE

CERTIFICATE_SERVICE_STOPPED

STOP

SERVICE

CERTIFICATE_SERVICE_SECURITY_PERMISSIONS_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_RETRIEVED_ARCHIVED_KEY

RETRIEVE

SERVICE

CERTIFICATE_SERVICE_IMPORTED_CERTIFICATE_IN_ITS_DATABASE

IMPORT

SERVICE

AUDIT_FILTER_FOR_CERTIFICATE_SERVICE_CHANGED

UPDATE

SERVICE

CERTIFICATE_SERVICE_RECEIVED_CERTIFICATE_REQUEST

RECEIVE

SERVICE

CERTIFICATE_SERVICE_APPROVED_CERTIFICATE_REQUEST_AND_ISSUED_CERTIFICATE

GRANT

SERVICE

CERTIFICATE_SERVICE_DENIED_CERTIFICATE_REQUEST

DENY

SERVICE

CERTIFICATE_SERVICE_SET_CERTIFICATE_REQUEST_STATUS_TO_PENDING

SET

SERVICE

CERTIFICATE_MANAGER_SETTINGS_FOR_CERTIFICATE_SERVICE_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_CONFIGURATION_ENTRY_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_PROPERTY_MODIFIED

UPDATE

SERVICE

CERTIFICATE_SERVICE_ARCHIVED_KEY

ARCHIVE

SERVICE

CERTIFICATE_SERVICE_IMPORTED_AND_ARCHIVED_KEY

ARCHIVE

SERVICE

CERTIFICATE_SERVICE_PUBLISHED_CA_CERTIFICATE_TO_ACTIVE_DIRECTORY_DOMAIN_SERVICES

PUBLISH

SERVICE

ROWS_DELETED_FROM_CERTIFICATE_DATABASE

DELETE

DATABASE

ENABLED_ROLE_SEPERATION_ON_CERTIFICATION_AUTHORITY

ENABLE

ROLE

CERTIFICATE_SERVICE_LOADED_TEMPLATE

LOAD

TEMPLATE

NETWORK_SHARE_OBJECT_ACCESSED

ACCESS

OBJECT

ATTEMPT_MADE_TO_CREATE_HARD_LINK

CREATE

FILE

TRANSACTION_STATE_CHANGED

UPDATE

SYSTEM

FILE_WAS_VIRTUALIZED

ASSIGN

FILE

SE_AUDITID_ETW_FIREWALL_APP_BLOCKED_FROM_LISTENING

BLOCK

APPLICATION

WINDOWS_FILTERING_PLATFORM_PERMITTED_APPLICATION_TO_LISTEN_ON_PORT

GRANT

APPLICATION

WINDOWS_FILTERING_PLATFORM_BLOCKED_APPLICATION_FROM_LISTENING_ON_PORT

BLOCK

APPLICATION

WINDOWS_FILTERING_PLATFORM_BLOCKED_CONNECTION

BLOCK

CONNECTION

WINDOWS_FILTERING_PLATFORM_PERMITTED_BIND_TO_LOCAL_PORT

GRANT

PORT

WINDOWS_FILTERING_PLATFORM_BLOCKED_BIND_TO_LOCAL_PORT

BLOCK

PORT

WINDOWS_FILTERING_PLATFORM_BLOCKED_PACKET

BLOCK

PACKET

RESTRICTIVE_WINDOWS_FILTERING_PLATFORM_BLOCKED_PACKET

BLOCK

PACKET

HANDLE_TO_OBJECT_REQUESTED

REQUEST

OBJECT

HANDLE_TO_OBJECT_CLOSED

CLOSE

OBJECT

ATTEMPT_MADE_TO_DUPLICATE_HANDLE_TO_OBJECT

ACCESS

OBJECT

APPLICATION_ATTEMPTED_TO_ACCESS_BLOCKED_ORDINAL

ACCESS

ORDINAL

INDIRECT_ACCESS_TO_OBJECT_REQUESTED

ACCESS

OBJECT

CREATED_SCHEDULED_TASK

CREATE

TASK

DELETED_SCHEDULED_TASK

DELETE

TASK

ENABLED_SCHEDULED_TASK

ENABLE

TASK

DISABLED_SCHEDULED_TASK

DISABLE

TASK

UPDATED_SCHEDULED_TASK

UPDATE

TASK

OBJECT_IN_COM+_CATALOG_MODIFIED

UPDATE

OBJECT

OBJECT_DELETED_FROM_COM+_CATALOG

DELETE

OBJECT

OBJECT_ADDED_TO_COM+_CATALOG

INSERT

OBJECT

MODIFIED_REGISTRY_VALUE

UPDATE

REGISTRY

VIRTUALIZED_REGISTRY_KEY

ASSIGN

REGISTRY

HANDLE_TO_OBJECT_REQUESTED_WITH_DELETE_INTENT

REQUEST

OBJECT

OBJECT_DELETED

DELETE

OBJECT

HANDLE_TO_OBJECT_REQUESTED

REQUEST

OBJECT

OBJECT_ACCESS_ATTEMPTED

ACCESS

OBJECT

AUDIT_POLICY_ON_OBJECT_CHANGED

AUDIT

POLICY

SYSTEM_AUDIT_POLICY_CHANGED

AUDIT

POLICY

ATTEMPT_MADE_TO_REGISTER_SECURITY_EVENT_SOURCE

REGISTER

LOG

ATTEMPT_MADE_TO_UNREGISTER_SECURITY_EVENT_SOURCE

UNREGISTER

LOG

CRASHONAUDITFAIL_VALUE_MODIFIED

UPDATE

CRASHONAUDITFAIL

MODIFIED_AUDITING_SETTINGS_ON_OBJECT

AUDIT

OBJECT

MODIFIED_SPECIAL_GROUPS_LOGON_TABLE

UPDATE

GROUP

MODIFIED_PER_USER_AUDIT_POLICY

AUDIT

POLICY

KERBEROS_POLICY_MODIFIED

UPDATE

POLICY

TRUSTED_DOMAIN_INFORMATION_MODIFIED

UPDATE

DOMAIN

GRANTED_SYSTEM_SECURITY_ACCESS_TO_ACCOUNT

GRANT

ACCOUNT

REMOVED_SYSTEM_SECURITY_ACCESS_FROM_ACCOUNT

DROP

ACCOUNT

MODIFIED_DOMAIN_POLICY

UPDATE

DOMAIN

NAMESPACE_COLLISION_DETECTED

GET

NAMESPACE

TRUSTED_FOREST_INFORMATION_ENTRY_ADDED

INSERT

INFORMATION

TRUSTED_FOREST_INFORMATION_ENTRY_REMOVED

DROP

INFORMATION

TRUSTED_FOREST_INFORMATION_ENTRY_MODIFIED

UPDATE

INFORMATION

USER_RIGHT_ASSIGNED

ASSIGN

USER

USER_RIGHT_REMOVED

DROP

USER

NEW_TRUST_CREATED_TO_DOMAIN

CREATE

DOMAIN

TRUST_TO_DOMAIN_REMOVED

DROP

DOMAIN

ENCRYPTED_DATA_RECOVERY_POLICY_MODIFIED

UPDATE

POLICY

SE_AUDITID_ETW_IPSEC_POLICY_START

START

SERVICE

SE_AUDITID_ETW_IPSEC_POLICY_DISABLED

DISABLE

SERVICE

APPLIED_PASTORE_ENGINE

APPLY

ENGINE

SE_AUDITID_ETW_IPSEC_POLICY_FAILURE

FAIL

SERVICE

SE_AUDITID_ETW_IPSEC_AUTHENTICATION_SET_ADD

INSERT

SETTING

SE_AUDITID_ETW_IPSEC_AUTHENTICATION_SET_CHANGE

UPDATE

SETTING

SE_AUDITID_ETW_IPSEC_AUTHENTICATION_SET_DELETE

DELETE

SETTING

SE_AUDITID_ETW_IPSEC_CONNECTION_SECURITY_ADD

INSERT

SETTING

SE_AUDITID_ETW_IPSEC_CONNECTION_SECURITY_CHANGE

UPDATE

SETTING

SE_AUDITID_ETW_IPSEC_CONNECTION_SECURITY_DELETE

DELETE

SETTING

SE_AUDITID_ETW_IPSEC_CRYPTO_SET_ADD

ADD

SETTINGS

SE_AUDITID_ETW_IPSEC_CRYPTO_SET_CHANGE

MODIFY

SETTINGS

SE_AUDITID_ETW_IPSEC_CRYPTO_SET_DELETE

DELETE

SETTINGS

WINDOWS_FILTERING_PLATFORM_CALLOUTS_MODIFIED

UPDATE

CALLOUT

WINDOWS_FILTERING_PLATFORM_PROVIDER_MODIFIED

UPDATE

PROVIDER

WINDOWS_FILTERING_PLATFORM_PROVIDER_CONTEXT_MODIFIED

UPDATE

CONTEXT

WINDOWS_FILTERING_PLATFORM_SUBLAYER_MODIFIED

UPDATE

SUBLAYER

SE_AUDITID_ETW_FIREWALL_STARTUP_STATE

START

FIREWALL

SE_AUDITID_ETW_FIREWALL_STARTUP_STATE_RULE

READ

RULE

SE_AUDITID_ETW_FIREWALL_RULE_ADD

INSERT

RULE

SE_AUDITID_ETW_FIREWALL_RULE_CHANGE

UPDATE

RULE

SE_AUDITID_ETW_FIREWALL_RULE_DELETE

DELETE

RULE

SE_AUDITID_ETW_FIREWALL_RESTORE_DEFAULTS

RESTORE

FIREWALL

SE_AUDITID_ETW_FIREWALL_SETTING_CHANGE

UPDATE

FIREWALL

SE_AUDITID_ETW_FIREWALL_GROUP_POLICY_CHANGED

UPDATE

FIREWALL

SE_AUDITID_ETW_FIREWALL_PROFILE_CHANGE

UPDATE

PROFILE

WINDOWS_FILTERING_PLATFORM_CHANGED_FILTER

UPDATE

FILTER

ERROR_OCCURED_WHILE_PROCESSING_SECURITY_POLICY_IN_GROUP_POLICY_OBJECTS

GET

POLICY

OBJECT_PERMISSION_MODIFIED

UPDATE

OBJECT

SPECIAL_PRIVILEGES_ASSIGNED_TO_NEW_LOGON

ASSIGN

ACCOUNT

PRIVILEGED_SERVICE_CALLED

CALL

SERVICE

OPERATION_ATTEMPTED_ON_PRIVILEGED_OBJECT

EXECUTE

OBJECT

IPSEC_DROPPED_INBOUND_PACKET_THAT_FAILED_INTEGRITY_CHECK

DROP

PACKET

IPSEC_DROPPED_INBOUND_PACKET_THAT_FAILED_REPLAY_BACK

DROP

PACKET

IPSEC_DROPPED_INBOUND_PACKET_THAT_FAILED_REPLAY_BACK

DROP

PACKET

IPSEC_DROPPED_INSECURE_CLEAR_TEXT_PACKET

DROP

PACKET

IPSEC_RECEIVED_PACKET_FROM_REMOTE_COMPUTER_WITH_INCORRECT_SPI

RECEIVE

PACKET

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_SUCCESSFUL_START

START

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_SUCCESSFUL_SHUTDOWN

STOP

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_INTERFACE_LIST_INCOMPLETE

FAIL

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_RPC_INIT_FAILURE

FAIL

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_ERROR_SHUTDOWN

STOPE

SERVICE

SE_AUDITID_ETW_POLICYAGENT_IPSECSVC_FAILED_PNP_FILTER_PROCESSING

FAIL

SERVICE

SE_AUDITID_ETW_MPSFIREWALL_SERVICE_STARTUP

START

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_STOPPED

STOP

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_GET_POLICY_FAILURE

RETRIEVE

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_PARSE_POLICY_FAILURE

FAIL

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_INIT_DRIVER_FAILURE

FAIL

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_SERVICE_STARTUP_FAILURE

FAIL

FIREWALL

SE_AUDITID_ETW_FIREWALL_UPCALL_NOTIFICATION_ERROR

NOTIFY

FIREWALL

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_STARTED

START

DRIVER

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_STOPPED

STOP

DRIVER

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_STARTUP_FAILURE

FAIL

DRIVER

SE_AUDITID_ETW_MPSFIREWALL_DRIVER_CRITICAL_ERROR

ABORT

DRIVER

KEY_FILE_OPERATION

READ

KEY

KEY_MIGRATION_OPERATION

MIGRATE

KEY

WINDOWS_STARTING_UP

STARTUP

OS

WINDOWS_SHUTTING_DOWN

SHUTDOWN

OS

SYSTEM_TIME_CHANGED

UPDATE

SYSTEM TIME

ADMINISTRATOR_RECOVERED_SYSTEM_FROM_CRASHONAUDITFAIL

RECOVER

SYSTEM

LOCAL_SECURITY_AUTHORITY_LOADED_AUTHENTICATION_PACKAGE

LOAD

AUTHORITY

TRUSTED_LOGON_PROCESS_REGISTERED_WITH_LOCAL_SECURITY_AUTHORITY

REGISTER

PROCESS

SECURITY_ACCOUNT_MANAGER_LOADED_NOTIFICATION_PACKAGE

LOAD

MANAGER

LOCAL_SECURITY_AUTHORITY_LOADED_SECURITY_PACKAGE

LOAD

AUTHORITY

SERVICE_INSTALLED_IN_SYSTEM

INSTALL

SERVICE

EXHAUSTED_INTERNAL_RESOURCES_ALLOCATED_FOR_QUEUING_OF_AUDIT_MESSAGES

EXCEED

MESSAGES

INVALID_USE_LOCAL_PROCEDURE_CALL_PORT_BY_AN_APPLICATION

INVALID

PORT

MONITORED_SECURITY_EVENT_PATTERN_OCCURRED

RECEIVE

PATTERN

RPC_DETECTED_INTEGRITY_VIOLATION_WHILE_DECRYPTING_INCOMING_MESSAGE

GET

MESSAGE

DETERMINED_INVALID_IMAGE_HASH_OF_FILE

CALCULATE

FILE

CRYPTROGRAPHIC_PRIMITIVE_OPERATION_FAILED

FAIL

OPERATION

VERIFICATION_OPERATION_FAILED

FAIL

OPERATION

CRYPTROGRAPHIC_OPERATION

EXECUTE

OPERATION

LDAP_QUERY_GROUP_MODIFIED

UPDATE

GROUP

LDAP_QUERY_GROUP_DELETED

DELETE

GROUP

CERTIFICATE_SERVICE_TEMPLATE_MODIFIED

UPDATE

TEMPLATE

CERTIFICATE_SERVICE_TEMPLATE_SECURITY_MODIFIED

UPDATE

TEMPLATE

OCSP_RESPONDER_SERVICE_STARTED

START

SERVICE

OCSP_RESPONDER_SERVICE_STOPPED

STOP

SERVICE

CONFIGURATION_ENTRY_CHANGED_IN_OCSP_RESPONDER_SERVICE

UPDATE

SERVICE

CONFIGURATION_ENTRY_CHANGED_IN_OCSP_RESPONDER_SERVICE

UPDATE

SERVICE

SECURITY_SETTING_MODIFIED_ON_OCSP_RESPONDER_SERVICE

UPDATE

SERVICE

REQUEST_SUBMITTED_TO_OCSP_RESPONDER_SERVICE

SUBMIT

SERVICE

OCSP_RESPODER_SERVICE_AUTOMATICALLY_MODIFIED_SIGNING_CERTIFICATE

UPDATE

CERTIFICATE

OCSP_REVOCATION_PROVIDER_UPDATED_REVOCATION_INFORMATION

UPDATE

INFORMATION

AUDIT_LOG_CLEARED

DELETE

AUDIT LOG

EVENT_LOGGING_SERVICE_HAS_SHUTDOWN

STOP

SERVICE

SECURITY_LOG_IS_FULL

EXCEED

AUDIT LOG

NETWORK_SHARE_OBJECT_ADDED

INSERT

OBJECT

NETWORK_SHARE_OBJECT_MODIFIED

UPDATE

OBJECT

NETWORK_SHARE_OBJECT_DELETED

DELETE

OBJECT

MODIFIED_AUDITING_SETTINGS_ON_OBJECT

AUDIT

OBJECT

NETWORK_SHARE_OBJECT_CHECKED_TO_SEE_CLIENT_GRANTED_DESIRED_ACCESS

VALIDATE

OBJECT