Native Windows Event Log — Channels, Audit Policy, Critical IDs

Native Windows Event Logs are the baseline telemetry for Windows endpoint detection. Before adding Sysmon or EDR, you should understand what the OS already provides and how to extract maximum signal from it.

Audit Policy: The Gate to Security Events

Windows Security events only appear if the relevant audit policy is enabled. There are two configuration layers:

Basic Audit Policy (9 categories, binary on/off per category):

Computer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy

Advanced Audit Policy (58 sub-categories, configurable per sub-category, Success/Failure independently):

Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration

Always use Advanced Audit Policy. It lets you, for example:

• Enable “Audit Logon” for both Success and Failure (to catch both 4624 and 4625)
• Enable “Audit Process Creation” for Success only (4688 — you don’t need “Failed process creation”)
• Enable “Audit Object Access” for Failure only on sensitive paths (catch unauthorized access attempts without flooding on successful reads)

Minimum recommended audit policy for detection

Account Logon:
  ✓ Audit Credential Validation — Success, Failure
  ✓ Audit Kerberos Authentication Service — Success, Failure

Logon/Logoff:
  ✓ Audit Logon — Success, Failure
  ✓ Audit Special Logon — Success
  ✓ Audit Account Lockout — Failure

Detailed Tracking:
  ✓ Audit Process Creation — Success (+ enable command line)
  ✓ Audit Process Termination — Success

Object Access:
  ✓ Audit File System — Failure (on sensitive paths via SACL)
  ✓ Audit Removable Storage — Success, Failure

Account Management:
  ✓ Audit Security Group Management — Success
  ✓ Audit User Account Management — Success, Failure

Policy Change:
  ✓ Audit Audit Policy Change — Success

System:
  ✓ Audit Security System Extension — Success

The Logon Type Taxonomy

Event 4624 (Successful Logon) includes a LogonType field that tells you how the user authenticated. This is critical for lateral movement detection:

The Critical Event ID Reference

These are the events every detection engineer must know by ID, not just by description:

Authentication

Process Execution

Object Access

Account Management

Scheduled Tasks & Services

Log Integrity