Windows Event ID Library
Every reference here is built for detection work, not trivia: the real Microsoft field tables, a simulated log sample you can copy, the status codes decoded, and SIEM queries you can run as written. Each page links to hands-on practice in SOCSimulator Operations.
Logon/Logoff
An account was successfully logged on
Event ID 4624 is the Windows Security log entry generated on the destination machine every time a logon session is created successfully, regardless of logon method. It fires for interactive desktop logons, network share access, RDP sessions, scheduled task execution, and service starts alike, so the Logon Type field is what actually tells an analyst what happened.
Read the reference 4625An account failed to log on
Event ID 4625 is the Windows Security log entry generated on the Audit Logon and Audit Account Lockout subcategories whenever a logon attempt fails, whether from a wrong password, a locked account, or a disabled one. It fires on the machine where the attempt happened and carries a Status/SubStatus code pair that tells you why the logon was rejected.
Read the referenceFrequently Asked Questions
- What are Windows event IDs?
- Windows event IDs are numeric codes the operating system assigns to every entry it writes into the Event Log. Each ID identifies one specific occurrence: Event 4625 is a failed logon, 4688 a new process, 7045 a new service. SOC analysts read them as the ground-truth telemetry behind most Windows detections.
- Which Windows event IDs matter most for security monitoring?
- The Security log auditing events carry most of the signal: 4624/4625 (logons), 4688 (process creation), 4672 (privileged logons), 4720/4740 (account creation and lockout), 1102 (audit log cleared), plus PowerShell 4104 and Service Control Manager 7045. Every entry in this library explains one of them with its fields, codes, and tested detection queries.
- Where do I find Windows event IDs?
- Open Event Viewer (eventvwr.msc) and browse Windows Logs: Security, System, and Application, or the Applications and Services Logs tree for channels like Sysmon and PowerShell Operational. In a SOC you rarely read Event Viewer directly: endpoints forward these logs to a SIEM, where you query them by event ID at scale.
- How do I practice investigating Windows event logs?
- Reading references only gets you part of the way. SOCSimulator Operations puts realistic Windows telemetry in front of you inside simulated SIEM, XDR, and Firewall consoles, so you can pivot on event IDs, correlate logons with process activity, and close investigations the way a working analyst does. A free tier is available.