Raw log records 1.0

Raw log records

Last updated 10 Nov 2026

On this page

security_event
Fields of security_event
system_event
Fields of system_event

Any record of the Security or System log, by provider and event ID.

security_event

Security log record. this record is in the host's Security log: an audited action, or a condition of the audit system, at the record's time

Kind	Event - something that happened at a time
Its time is	event logged
Built-in rules reading it	14

Fields of security_event

Field	Type	Meaning
`log.event_id`	int	The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".
`log.event_time`	time	When a log record was written (its TimeCreated).
`log.provider`	string	The component that wrote a log record (its provider), e.g. "Service Control Manager". One event ID means different things from different providers in the same log - System event 104 is a log clear from Microsoft-Windows-Eventlog and a smart-card reader's status from a driver - so a rule over an ID names its provider too.
`log.subject`	string	The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.
`log.subject_sid`	string	The SID of the account an event's Subject names (who acted) - what identifies it whatever its name.
`log.subject_logon_id`	string	The logon session (hex) the event's Subject acted in - what ties an action to the logon that preceded it.
`log.target`	string	The account (DOMAIN\name) an event's Target names - the account acted on, or logged on, as opposed to log.subject, the one acting.
`log.target_sid`	string	The SID of the account or group an event's Target names - what identifies it whatever its (localized, or renamed) name: S-1-5-32-544 is Administrators in every language.
`log.member`	string	The member a group-membership event (4728, 4732, 4756...) added or removed: its name, or its SID when the event names none.
`source.workstation`	string	The workstation name a logon-related event says the request came from - as reported by the client, so corroborating, not proof.
`source.ip`	string	The network address a logon-related event says the request came from.
`audit.subcategory`	string	The audit policy subcategory an audit policy change (4719) changed, as "Category > Name". derived: decoded by Signal from the event's SubcategoryGuid
`audit.changes`	string	How an audit policy change (4719) changed its subcategory, e.g. "Success removed, Failure removed". derived: decoded by Signal from the event's AuditPolicyChanges codes
`log.account_flags_set`	string	The account control flags an account change (4738) turned on, e.g. "password not required", "Kerberos pre-authentication not required". derived: decoded by Signal from the event's OldUacValue and NewUacValue
`log.account_flags_cleared`	string	The account control flags an account change (4738) turned off, e.g. "disabled" (the account was enabled). derived: decoded by Signal from the event's OldUacValue and NewUacValue
`log.sid_history`	string	The SID(s) added to an account's SID history (4765), or that could not be (4766): the account then carries that SID's rights too.
`clock.previous`	string	The system time before a change of the system time (Security 4616), as the event records it (UTC).
`clock.new`	string	The system time a change set (Security 4616), as the event records it (UTC).
`clock.shift`	string	How far a change of the system time (Security 4616) moved the clock, e.g. "back 3 days 2 hours", "forward 4 seconds". derived: computed by Signal from the event's PreviousTime and NewTime
`clock.process`	string	The program that changed the system time (Security 4616's ProcessName) - the Windows Time service runs in svchost.exe as LOCAL SERVICE.

system_event

System log record. this record is in the host's System log, written by the provider it names, at the record's time

Kind	Event - something that happened at a time
Its time is	event logged
Built-in rules reading it	1

Fields of system_event

Field	Type	Meaning
`log.event_id`	int	The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".
`log.event_time`	time	When a log record was written (its TimeCreated).
`log.provider`	string	The component that wrote a log record (its provider), e.g. "Service Control Manager". One event ID means different things from different providers in the same log - System event 104 is a log clear from Microsoft-Windows-Eventlog and a smart-card reader's status from a driver - so a rule over an ID names its provider too.
`log.subject`	string	The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.
`log.cleared_channel`	string	The event log a clear emptied (System event 104), e.g. "Microsoft-Windows-Sysmon/Operational". The Security log's own clear is Security event 1102.
`service.name`	string	A service's name as the event records it: its display name in a service installation (7045), a start-type change (7040) and a state change (7036).
`service.key`	string	A service's registry key name (HKLM\SYSTEM\CurrentControlSet\Services\<key>) - stable whatever its display name; a start-type change (7040) records it.
`service.start_type`	string	When a service starts: auto start, demand start, disabled, boot start, system start - as installed (System 7045's words, possibly in the host's display language, or named by Signal in English from Security 4697's code), or as changed to (7040).
`service.start_type_previous`	string	A service's start type before a change (7040), possibly in the host's display language.
`service.state`	string	A configured service's state now (the live service table, in English), or the state a service entered (7036): running, stopped... possibly in the host's display language. Current Windows builds may write few or none (a Windows 11 host's whole System log held no Service Control Manager 7036), so the absence of one never means a service did not stop.
`system.shutdown_time`	time	When the host went down without a clean shutdown (6008) - power loss, a crash, a forced reset. The event itself is written at the next start. derived: decoded by Signal from 6008's binary data (the shutdown time in UTC)