Windows security event ID lookup
Enter an event ID or status code, or paste a whole record from Event Viewer or your SIEM, and the tool explains what happened, how serious Microsoft says it can be and what kind of logon it was.
How to use it
- Copy the event ID from Event Viewer (Security log), your SIEM or an export – or the whole record, XML included.
- Paste it into the box and click Look up. You can enter several IDs at once, or a keyword such as "task" or "group". For Sysmon events, type "sysmon" followed by the IDs, such as "sysmon 1, 3, 22".
- The tool shows what the event means, its potential criticality and its group. From a full record it also picks out Status / Sub Status codes and the logon type.
- Leave the box empty and click Show the full dictionary to browse every event by group (logons, accounts, groups, processes, policy and so on).
How it works
The Windows Security log records every event under a number (the event ID). When you're investigating an incident or tuning SIEM rules, the same questions keep coming up: what does 4648 mean, how is 4624 different from 4672, what is logon type 10, and why does a failed logon show 0xC000006A? This tool answers all of them in one place.
What it covers:
- Events – Microsoft's description, a group and the potential criticality from Microsoft's monitoring recommendations (high, medium to high, medium, low).
- Legacy IDs – numbers from Windows XP and Server 2003 (such as 528 or 529–537) mapped to current events.
- Logon types – the values of the Logon Type field in events 4624 and 4625, from 2 (at the keyboard) and 3 (from the network) to 10 (Remote Desktop).
- Status / Sub Status codes – the most common reasons for a failed logon in 4625 that Microsoft recommends monitoring.
- Sysmon – all 30 Sysmon events (process creation, network connections, access to lsass.exe, DNS queries, WMI and more) with the filter tag to use in your configuration and a note on which ones are off by default. Type "sysmon" and the IDs, or paste a record from the Sysmon/Operational log.
You can paste a whole record too, such as the XML from the Details tab in Event Viewer. The tool only picks out numbers it knows, so port numbers and process IDs won't confuse it.
FAQ
Is the record I paste sent anywhere?
No. The dictionary is part of the script and the lookup runs in your browser. Nothing is sent or stored. Log records still contain account names and addresses, so only paste them into tools you trust.
What does potential criticality mean?
It comes from Microsoft's recommendations (Appendix L: Events to Monitor). High means a single occurrence should be investigated. Medium and low events should only be investigated if they occur unexpectedly or well above your normal baseline. Microsoft also warns that even high-criticality events can have harmless causes and recommends testing alert rules in your own environment first.
Why are some events missing from my Security log?
Many events are only logged when the matching audit policy is enabled. According to Microsoft, default logging varies by Windows version and edition, and many audit settings are Not Configured by default. You can configure them in Group Policy under Computer Configuration → Security Settings → Advanced Audit Policy Configuration.
Where are events 4624 and 4625 logged?
According to Microsoft, 4624 (successful logon) is written on the computer that was accessed, where the session was created. 4625 (failed logon) is written on the computer where the logon attempt was made – domain controllers, member servers and workstations alike. To trace lateral movement you need the logs from the target machines.
What are legacy IDs such as 528 or 540?
Windows XP and Windows Server 2003 used different event numbers. Microsoft lists the legacy ID for each current event – today's 4624 replaced 528 and 540, for example. The tool recognises legacy IDs and shows the current event.
How does the tool know an ID is a Sysmon event?
Sysmon writes to its own log, Microsoft-Windows-Sysmon/Operational, and its IDs 1–29 and 255 would otherwise clash with ordinary numbers in the text. So the tool only looks them up when your input contains the word Sysmon – in an XML record the provider name Microsoft-Windows-Sysmon takes care of that. From a record it then reads only the EventID value, not the version, level or task numbers.
Why don't I see network connections or loaded DLLs in my Sysmon log?
According to Microsoft, network connections (ID 3) and image loads (ID 7) are disabled by default and have to be enabled in the configuration. Image loads and process access (ID 10) generate a large volume of events without filters, so Microsoft recommends enabling them only with filters that remove expected activity.
Does the dictionary cover every Windows event?
No. It covers selected security events from Microsoft's recommendations – the ones a SOC deals with most. For the complete list of security events, run wevtutil gp Microsoft-Windows-Security-Auditing /ge /gm:true on a Windows machine. It also includes every Sysmon event Microsoft documents (1–29 and 255).
Sources
Updated