Logons and Remote Desktop

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

3

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

logon.type

int

The logon type: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials, 10 remote interactive (Remote Desktop), 11 cached interactive.

logon.type_name

string

The logon type in words.
derived: named by Signal from logon.type

logon.id

string

The logon session's ID (hex): what ties a logon to what was done in it.

logon.process

string

The logon process that handled the logon (User32, NtLmSsp, Kerberos, Advapi, seclogo...).

logon.auth_package

string

The authentication package: NTLM, Kerberos, Negotiate...

logon.elevated

bool

Whether the logon's token is elevated (an administrator's full token).

source.workstation

string

The workstation name a logon-related event says the request came from - as reported by the client, so corroborating, not proof.

source.ip

string

The network address a logon-related event says the request came from.

source.ip_scope

string

What kind of address source.ip is: public (routable on the Internet), private (RFC 1918 / unique local), shared (carrier-grade NAT, 100.64.0.0/10), loopback, link-local, multicast, or none.
derived: computed by Signal from source.ip (the event's IpAddress) - Windows records only the address

process.name

string

Full path of the executable that was launched.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

2

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

logon.type

int

The logon type: 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 8 network cleartext, 9 new credentials, 10 remote interactive (Remote Desktop), 11 cached interactive.

logon.type_name

string

The logon type in words.
derived: named by Signal from logon.type

logon.process

string

The logon process that handled the logon (User32, NtLmSsp, Kerberos, Advapi, seclogo...).

logon.auth_package

string

The authentication package: NTLM, Kerberos, Negotiate...

logon.status

string

A failed logon's status code (hex, as the event records it: 0xc000006d...).

logon.sub_status

string

A failed logon's sub-status code: the precise reason (0xc0000064 no such user, 0xc000006a wrong password, 0xc0000072 account disabled, 0xc0000234 locked out...).

logon.failure_reason

string

A failed logon's reason in words, from its sub-status (or status).
derived: named by Signal from logon.sub_status (or logon.status)

source.workstation

string

The workstation name a logon-related event says the request came from - as reported by the client, so corroborating, not proof.

source.ip

string

The network address a logon-related event says the request came from.

source.ip_scope

string

What kind of address source.ip is: public (routable on the Internet), private (RFC 1918 / unique local), shared (carrier-grade NAT, 100.64.0.0/10), loopback, link-local, multicast, or none.
derived: computed by Signal from source.ip (the event's IpAddress) - Windows records only the address

process.name

string

Full path of the executable that was launched.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

0

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

log.subject

string

The account (DOMAIN\name) an event's Subject names - who performed the action the event records. A name ending in "$" is a computer account: the machine itself acting (a Group Policy refresh, a service), not a person. Absent when the event names no subject.

log.subject_logon_id

string

The logon session (hex) the event's Subject acted in - what ties an action to the logon that preceded it.

logon.target_server

string

The server explicit credentials were used for (4648): localhost for a local run-as, another host's name for a remote connection.

source.ip

string

The network address a logon-related event says the request came from.

source.ip_scope

string

What kind of address source.ip is: public (routable on the Internet), private (RFC 1918 / unique local), shared (carrier-grade NAT, 100.64.0.0/10), loopback, link-local, multicast, or none.
derived: computed by Signal from source.ip (the event's IpAddress) - Windows records only the address

process.name

string

Full path of the executable that was launched.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

0

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

logon.id

string

The logon session's ID (hex): what ties a logon to what was done in it.

logon.privileges

string

The special privileges a new logon received (4672), e.g. SeDebugPrivilege, SeTcbPrivilege.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

2

rdp.event

string

What a Remote Desktop record says happened, with its event: connection accepted (RdpCoreTS 131), wrong user name or password (RdpCoreTS 140), authenticated (RemoteConnectionManager 1149), signed in (LocalSessionManager 21), shell started (22), signed out (23), disconnected (24), reconnected (25), reconnected or disconnected (Security 4778, 4779); for the client: connecting (RDPClient 1024 - an attempt, not proof it succeeded), multi-transport to the server (1102 - the connection was set up).
derived: named by Signal from the event's provider and ID

account.name

string

The account (DOMAIN\name, or just name if local) associated with an event. Not marked Identity: an account name is not a stable key on its own (renames, the same name in two domains); account.sid is the key.

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)

account.scope

string

Where the account is defined: local, domain, microsoft (a Microsoft account), entra (Entra ID) or well-known.
derived: decided by Signal from the account's SID and domain against the host's own

session.id

int

An interactive session's number in Windows' session manager (1 is usually the console on a client).

session.how

string

How the session was signed in to: console (at the machine, or its virtual console) or remote desktop.
derived: decided by Signal from the session's window station (Console, or RDP-Tcp#n)

source.ip

string

The network address a logon-related event says the request came from.

source.ip_scope

string

What kind of address source.ip is: public (routable on the Internet), private (RFC 1918 / unique local), shared (carrier-grade NAT, 100.64.0.0/10), loopback, link-local, multicast, or none.
derived: computed by Signal from source.ip (the event's IpAddress) - Windows records only the address

source.workstation

string

The workstation name a logon-related event says the request came from - as reported by the client, so corroborating, not proof.

Kind

Event - something that happened at a time

Its time is

event logged

Built-in rules reading it

0

rdp.event

string

What a Remote Desktop record says happened, with its event: connection accepted (RdpCoreTS 131), wrong user name or password (RdpCoreTS 140), authenticated (RemoteConnectionManager 1149), signed in (LocalSessionManager 21), shell started (22), signed out (23), disconnected (24), reconnected (25), reconnected or disconnected (Security 4778, 4779); for the client: connecting (RDPClient 1024 - an attempt, not proof it succeeded), multi-transport to the server (1102 - the connection was set up).
derived: named by Signal from the event's provider and ID

rdp.server

string

The server this host's Remote Desktop client connected to: as the user typed it (1024 - a name or an address), or its address (1102).

account.sid

string

The account's SID - its identity across renames and hosts (a domain account has the same SID everywhere). Timeless, unlike process.pid, so it needs no companion time; the evidence types that carry it name their instances by it (evidence.Type.Identity).

account.kind

string

What the account is: person, default (a local account Windows creates), service, virtual, anonymous, group or computer.
derived: decided by Signal from the account's SID (its name only when there is no SID)