Skip to content

Event and activity reference

Use the compound context—not the number alone. Search by identifier, event or activity name, product, provider, channel, field, or investigative behavior. The default catalog is a curated native subset rather than a mirror of a third-party encyclopedia.

The header’s Search site field searches documentation pages. Use Event catalog lookup below to search the structured event records and filters.

Interpret an identifier safely

An event number is not globally unique. Establish all of the following before assigning meaning:

product or family
provider or source
channel or log
displayed ID
version
collection path

For example, Sysmon event 10 is meaningful only with the Sysmon provider and Operational channel. A product-normalized Exchange, SharePoint, or SQL Server event can reuse a number that exists in Windows Security.

Absence is not proof of absence

Confirm provider enablement, audit policy, configuration, forwarding, filtering, retention, licensing, ingestion, and sensor health. A missing event can mean the activity was not logged or was not collected.

Use the result as a pivot

A record identifies an evidence point, not a complete detection. Correlate by the strongest available entity:

  • logon ID, activity ID, Process GUID, correlation ID, session ID, or request ID;
  • account, device, process lineage, application, resource, source and destination;
  • preceding failures, later success, privilege assignment, persistence and network activity;
  • adjacent provider health, configuration and policy-change events.

The linked domain references retain the detailed field guidance, logon-type mappings, query examples, and collection caveats.

Scope and provenance

The catalog currently emphasizes independently reviewed Windows Security, Sysmon, Microsoft Defender Antivirus, PowerShell, and Service Control Manager records. Microsoft documentation is the primary source. Ultimate Windows Security was used as a secondary discovery index; its descriptions, field prose, and examples are not reproduced.

LOGbinder-normalized SharePoint, SQL Server, and Exchange records are deliberately excluded from the default native catalog. If they are added later, they will use explicit product/provider namespaces and will not be presented as universal Microsoft event IDs.

Related references: