Windows Event ID Lookup
Offline reference for Security, System, Sysmon, PowerShell, Defender, App Control and AppLocker event IDs — with logon-type decoding and MITRE ATT&CK cross-links. Nothing you search leaves your browser.
4624), a keyword, or clear the channel filter.
Logon type decode
On a 4624 or 4625 event, the LogonType field usually decides whether the logon is routine or worth escalating.
What this tool does
This is an offline, searchable reference for Windows Security, System, Sysmon, PowerShell, Defender (antivirus, attack surface reduction, controlled folder access, network protection), App Control for Business (CodeIntegrity) and AppLocker event IDs: what each event means, the fields it carries, why it matters for detection, and the MITRE ATT&CK techniques it commonly maps to. The dataset is a static JSON file loaded once from this site, so lookups work without a live connection and nothing you type is sent anywhere.
How to use it
- Search by event ID (
4624), a keyword (account created,service installed) or a channel name, or press/to focus the search box. Use the Try an example buttons to see the result shape. - Filter to a single log channel (Security, System, Sysmon, PowerShell, Defender, CodeIntegrity, AppLocker) with the pills above the results.
- Each result shows the ID, channel, what the event means, why it matters for detection, the fields it carries, and any mapped ATT&CK techniques — click a technique to open it in the ATT&CK technique search. “none mapped” means exactly that: no technique is asserted.
- Deep-link a lookup to share or bookmark it: the URL updates as you search (
?q=4688), and you can open the page directly at?id=1102for a single event. - Export the current (filtered) result set as JSON, CSV or Markdown — the export matches exactly what the list shows. Use copy as markdown on a single card to paste one event into an incident timeline or ticket. CSV cells that start with
= + - @are neutralised so a spreadsheet cannot execute them. - Check the logon type table at the bottom whenever you are reading a 4624 or 4625 event.
Accuracy & sources
Event meanings and channels follow Microsoft’s Security Auditing reference and its per-event pages, the Defender Antivirus event IDs, attack surface reduction, App Control event ID and AppLocker event references, and the Sysmon documentation; ATT&CK technique IDs come from MITRE ATT&CK Enterprise (checked against v20). Many Security events (4657, 4662, 4663, 5136) only appear when the object has a matching SACL; the card says so. The list is curated for triage, not exhaustive, and an event-to-technique mapping is a starting point, not a verdict. If you spot an entry that looks wrong, treat the Microsoft/MITRE page as authoritative.
Frequently asked questions
Which Windows Event IDs matter most for security monitoring?
A short list to alert on if nothing else: 4624 (successful logon) and 4625 (failed logon) for brute-force and lateral movement patterns; 4688 (process creation, needs command-line auditing enabled) for what actually ran; 4720 (a user account was created) and 4732/4728 (member added to a local/global group, especially admin groups) for privilege changes; and 1102 (the audit log was cleared) which is a strong indicator of anti-forensic activity, since legitimate admins rarely need to clear it.
What is the difference between the Security log and Sysmon?
The built-in Security log (events like 4624/4625/4688) comes from Windows’ own audit policy and is available on every host, but its process-creation events lack detail unless command-line auditing is turned on. Sysmon is a separate Microsoft Sysinternals driver you install that logs richer, purpose-built events (process creation with hashes, network connections, image loads) under its own channel, at the cost of needing deployment and a tuned config.
What does logon type mean on event 4624/4625, and why does it matter?
The logon type field says how the logon happened: type 2 is interactive (someone at the console), type 3 is network (e.g. accessing a share), type 10 is RemoteInteractive (RDP), type 5 is a service start, and so on. A type 3 logon to a domain controller with a privileged account, or a type 10 logon at 3 a.m. from an unfamiliar host, is far more suspicious than the same account authenticating type 2 during business hours. The logon-type table below this search covers all of them.
How do I map an event ID to a MITRE ATT&CK technique?
Where ATT&CK maps cleanly, each event card here lists the related technique IDs; click one to open it directly in the ATT&CK technique search. For example, 4688 with a suspicious parent-child process pair often lines up with T1059 (Command and Scripting Interpreter). These mappings are a curated starting point for triage, not an exhaustive or authoritative ATT&CK data source.
Is Event ID 1102 always malicious?
No, but it always deserves a look. Clearing the Security log is rarely a legitimate maintenance step, and it is a textbook anti-forensic move after a compromise, since it destroys the trail leading up to the clear. Correlate any 1102 event with who triggered it and what happened immediately before.