События Windows
An account was successfully logged on
Вход в учетную запись был успешно выполнен
Event ID 4624
Security
Audit Logon
Основные поля
IP-адрес
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя компьютера
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя пользователя
TargetUserName
Windows
New Logon: Account Name
ELK
winlog.event_data.TargetUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Важное поле
IpAddress
Windows
Network Information: Source Network Address
ELK
winlog.event_data.IpAddress
Microsoft Sentinel
-
QRadar
-
Splunk
-
Поля
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| SubjectUserSid | Subject: Security ID | winlog.event_data.SubjectUserSid | - | - | - |
| SubjectUserName | Subject: Account Name | winlog.event_data.SubjectUserName | - | - | - |
| SubjectDomainName | Subject: Account Domain | winlog.event_data.SubjectDomainName | - | - | - |
| SubjectLogonId | Subject: Logon ID | winlog.event_data.SubjectLogonId | - | - | - |
| LogonType | Logon Information: Logon Type | winlog.event_data.LogonType | - | - | - |
| RestrictedAdminMode | Logon Information: Restricted Admin Mode | winlog.event_data.RestrictedAdminMode | - | - | - |
| RemoteCredentialGuard | Logon Information: Remote Credential Guard | winlog.event_data.RemoteCredentialGuard | - | - | - |
| ImpersonationLevel | ImpersonationLevel | winlog.event_data.ImpersonationLevel | - | - | - |
| TargetUserSid | New Logon: Security ID | winlog.event_data.TargetUserSid | - | - | - |
| TargetUserName | New Logon: Account Name | winlog.event_data.TargetUserName | - | - | - |
| TargetDomainName | New Logon: Account Domain | winlog.event_data.TargetDomainName | - | - | - |
| TargetLogonId | New Logon: Logon ID | winlog.event_data.TargetLogonId | - | - | - |
| LogonGuid | Account Information: Logon GUID | winlog.event_data.LogonGuid | - | - | - |
| ProcessId | Process Information: Process ID | winlog.event_data.ProcessId | - | - | - |
| ProcessName | Process Information: Process Name | winlog.event_data.ProcessName | - | - | - |
| WorkstationName | Network Information: Workstation Name | winlog.event_data.WorkstationName | - | - | - |
| IpAddress | Network Information: Source Network Address | winlog.event_data.IpAddress | - | - | - |
| IpPort | Network Information: Client Port | winlog.event_data.IpPort | - | - | - |
| LogonProcessName | Detailed Authentication Information: Logon Process | winlog.event_data.LogonProcessName | - | - | - |
| AuthenticationPackageName | Detailed Authentication Information: Authentication Package | winlog.event_data.AuthenticationPackageName | - | - | - |
| IP Системное поле | IP Системное поле | - | - | - | - |
| Computer Системное поле | Computer Системное поле | winlog.computer_name | - | - | - |
| ProcessID Системное поле | ProcessID Системное поле | winlog.process.pid | - | - | - |
| ThreadID Системное поле | ThreadID Системное поле | winlog.process.thread.id | - | - | - |
Пример события
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4624</EventID>
<Version>3</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-02T02:47:28.6914306Z" />
<EventRecordID>144348</EventRecordID>
<Correlation />
<Execution ProcessID="848" ThreadID="9276" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-0-0</Data>
<Data Name="SubjectUserName">-</Data>
<Data Name="SubjectDomainName">-</Data>
<Data Name="SubjectLogonId">0x0</Data>
<Data Name="TargetUserSid">S-1-5-21-1838030176-2987033226-1986555923-1104</Data>
<Data Name="TargetUserName">cs_admin</Data>
<Data Name="TargetDomainName">SOCPEDIA.NET</Data>
<Data Name="TargetLogonId">0xb923edd</Data>
<Data Name="LogonType">3</Data>
<Data Name="LogonProcessName">Kerberos</Data>
<Data Name="AuthenticationPackageName">Kerberos</Data>
<Data Name="WorkstationName">-</Data>
<Data Name="LogonGuid">{64255f3b-f52d-68bd-8c47-c706a89927dc}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x0</Data>
<Data Name="ProcessName">-</Data>
<Data Name="IpAddress">192.168.0.211</Data>
<Data Name="IpPort">53178</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="RemoteCredentialGuard">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
</Event>