Raw log records

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

14

log.event_id

int

The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".

log.event_time

time

When a log record was written (its TimeCreated).

log.provider

string

The component that wrote a log record (its provider), e.g. "Service Control Manager". One event ID means different things from different providers in the same log - System event 104 is a log clear from Microsoft-Windows-Eventlog and a smart-card reader's status from a driver - so a rule over an ID names its provider too.

log.subject

string

The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.

log.subject_sid

string

The SID of the account an event's Subject names (who acted) - what identifies it whatever its name.

log.subject_logon_id

string

The logon session (hex) the event's Subject acted in - what ties an action to the logon that preceded it.

log.target

string

The account (DOMAIN\name) an event's Target names - the account acted on, or logged on, as opposed to log.subject, the one acting.

log.target_sid

string

The SID of the account or group an event's Target names - what identifies it whatever its (localized, or renamed) name: S-1-5-32-544 is Administrators in every language.

log.member

string

The member a group-membership event (4728, 4732, 4756...) added or removed: its name, or its SID when the event names none.

source.workstation

string

The workstation name a logon-related event says the request came from - as reported by the client, so corroborating, not proof.

source.ip

string

The network address a logon-related event says the request came from.

audit.subcategory

string

The audit policy subcategory an audit policy change (4719) changed, as "Category > Name".
derived: decoded by Signal from the event's SubcategoryGuid

audit.changes

string

How an audit policy change (4719) changed its subcategory, e.g. "Success removed, Failure removed".
derived: decoded by Signal from the event's AuditPolicyChanges codes

log.account_flags_set

string

The account control flags an account change (4738) turned on, e.g. "password not required", "Kerberos pre-authentication not required".
derived: decoded by Signal from the event's OldUacValue and NewUacValue

log.account_flags_cleared

string

The account control flags an account change (4738) turned off, e.g. "disabled" (the account was enabled).
derived: decoded by Signal from the event's OldUacValue and NewUacValue

log.sid_history

string

The SID(s) added to an account's SID history (4765), or that could not be (4766): the account then carries that SID's rights too.

clock.previous

string

The system time before a change of the system time (Security 4616), as the event records it (UTC).

clock.new

string

The system time a change set (Security 4616), as the event records it (UTC).

clock.shift

string

How far a change of the system time (Security 4616) moved the clock, e.g. "back 3 days 2 hours", "forward 4 seconds".
derived: computed by Signal from the event's PreviousTime and NewTime

clock.process

string

The program that changed the system time (Security 4616's ProcessName) - the Windows Time service runs in svchost.exe as LOCAL SERVICE.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

1

log.event_id

int

The Windows event ID of one log record - 1102 (log cleared), 4719 (audit policy changed), 521 (audit log could not be written), and so on. The per-event matching field a rule uses to say "did this specific event happen", as opposed to log.event_count's aggregate "how many events total".

log.event_time

time

When a log record was written (its TimeCreated).

log.provider

string

The component that wrote a log record (its provider), e.g. "Service Control Manager". One event ID means different things from different providers in the same log - System event 104 is a log clear from Microsoft-Windows-Eventlog and a smart-card reader's status from a driver - so a rule over an ID names its provider too.

log.subject

string

The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.

log.cleared_channel

string

The event log a clear emptied (System event 104), e.g. "Microsoft-Windows-Sysmon/Operational". The Security log's own clear is Security event 1102.

service.name

string

A service's name as the event records it: its display name in a service installation (7045), a start-type change (7040) and a state change (7036).

service.key

string

A service's registry key name (HKLM\SYSTEM\CurrentControlSet\Services\<key>) - stable whatever its display name; a start-type change (7040) records it.

service.start_type

string

When a service starts: auto start, demand start, disabled, boot start, system start - as installed (System 7045's words, possibly in the host's display language, or named by Signal in English from Security 4697's code), or as changed to (7040).

service.start_type_previous

string

A service's start type before a change (7040), possibly in the host's display language.

service.state

string

A configured service's state now (the live service table, in English), or the state a service entered (7036): running, stopped... possibly in the host's display language. Current Windows builds may write few or none (a Windows 11 host's whole System log held no Service Control Manager 7036), so the absence of one never means a service did not stop.

system.shutdown_time

time

When the host went down without a clean shutdown (6008) - power loss, a crash, a forced reset. The event itself is written at the next start.
derived: decoded by Signal from 6008's binary data (the shutdown time in UTC)