AdvancedSecurityEventIDs.json

[
  {
    "category": "Account Logon",
    "subCategory": "Audit Credential Validation",
    "eventID": "4774",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An account was mapped for logon.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Credential Validation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4774",
    "volume": {
      "DomainController": "High",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Credential Validation",
    "eventID": "4775",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An account could not be mapped for logon",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Credential Validation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4775",
    "volume": {
      "DomainController": "High",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Credential Validation",
    "eventID": "4776",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The computer attempted to validate the credentials for an account.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Credential Validation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776",
    "volume": {
      "DomainController": "High",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI",
      "MDI"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Credential Validation",
    "eventID": "4777",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The domain controller failed to validate the credentials for an account.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Credential Validation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4777",
    "volume": {
      "DomainController": "High",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Kerberos Authentication Service",
    "eventID": "4768",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Kerberos authentication ticket (TGT) was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Kerberos Authentication Service",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768",
    "volume": {
      "DomainController": "High",
      "Server": "NA",
      "Workstation": "NA"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "NA",
      "Workstation": "NA"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1558"
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Kerberos Authentication Service",
    "eventID": "4771",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Kerberos pre-authentication failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Kerberos Authentication Service",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771",
    "volume": {
      "DomainController": "High",
      "Server": "NA",
      "Workstation": "NA"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "NA",
      "Workstation": "NA"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "CORTEX",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Kerberos Authentication Service",
    "eventID": "4771",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Kerberos authentication ticket request failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Kerberos Authentication Service",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4772",
    "volume": {
      "DomainController": "High",
      "Server": "NA",
      "Workstation": "NA"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "NA",
      "Workstation": "NA"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "JSCU-NL",
      "YAMATO",
      "CORTEX",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Kerberos Service Ticket Operations",
    "eventID": "4769",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Kerberos service ticket was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Kerberos Service Ticket Operations",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769",
    "volume": {
      "DomainController": "High",
      "Server": "NA",
      "Workstation": "NA"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1558"
  },
  {
    "category": "Account Logon",
    "subCategory": "Audit Kerberos Service Ticket Operations",
    "eventID": "4770",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Kerberos service ticket was renewed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Logon\\Audit Kerberos Service Ticket Operations",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4770",
    "volume": {
      "DomainController": "High",
      "Server": "NA",
      "Workstation": "NA"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Computer Account Management",
    "eventID": "4741",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A computer account was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Computer Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "MDI",
      "ADSECURITY"
    ],
    "MitreTTP": "T1136"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Computer Account Management",
    "eventID": "4742",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A computer account was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Computer Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4742",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Computer Account Management",
    "eventID": "4743",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A computer account was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Computer Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "MDI"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4744",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled local group was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4749",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4745",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled local group was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4750",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4746",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was added to a security-disabled local group",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4751",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4747",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was removed from a security-disabled local group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4752",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4748",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled local group was deleted. ",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4753",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4749",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled global group was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4749",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4750",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled global group was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4750",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4751",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was added to a security-disabled global group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4751",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4752",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was removed from a security-disabled global group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4752",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4753",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled global group was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4753",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDI"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4759",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled universal group was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4749",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4760",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled universal group was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4750",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4761",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was added to a security-disabled universal group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4751",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4762",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was removed from a security-disabled universal group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4752",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Distribution Group Management",
    "eventID": "4763",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-disabled universal group was deleted. ",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Distribution Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4753",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "MDI"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Other Account Management Events",
    "eventID": "4782",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The password hash of an account was accessed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Other Account Management Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4782",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": "T1003"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Other Account Management Events",
    "eventID": "4793",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Password Policy Checking API was called.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Other Account Management Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4793",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4727",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled global group was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4728",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was added to a security-enabled global group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI",
      "MDI",
      "SENTINEL"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4729",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was removed from a security-enabled global group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4733",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "MDI",
      "SENTINEL"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4730",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled global group was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4734",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "MDI"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4731",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled local group was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4732",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was added to a security-enabled local group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "ANSSI",
      "MDI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4733",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was removed from a security-enabled local group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4733",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "MDI",
      "SENTINEL"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4734",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled local group was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4734",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "MDE",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4735",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled local group was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4735",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4737",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled global group was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4735",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4754",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled universal group was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4755",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled universal group was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4735",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4756",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was added to a security-enabled universal group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI",
      "MDI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4757",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A member was removed from a security-enabled universal group.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4733",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "MDI",
      "SENTINEL"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4758",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled universal group was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4734",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "MDI"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4764",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A group’s type was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4764",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit Security Group Management",
    "eventID": "4799",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security-enabled local group membership was enumerated.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit Security Group Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "CORTEX",
      "MDE",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1069.002"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4720",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user account was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "ANSSI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1136"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4722",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user account was enabled.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4723",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to change an account's password.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4723",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4724",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to reset an account's password.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4725",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user account was disabled.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4725",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI",
      "SENTINEL"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4726",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user account was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "ANSSI",
      "MDI",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4738",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user account was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4740",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user account was locked out.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI",
      "SENTINEL"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4765",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "SID History was added to an account.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4765",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1134.005"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4766",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt to add SID History to an account failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4766",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1134.005"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4767",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user account was unlocked.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4767",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4780",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The ACL was set on accounts which are members of administrators groups.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4780",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4781",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The name of an account was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4794",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to set the Directory Services Restore Mode administrator password.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4794",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1098"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "4798",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user's local group membership was enumerated.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "MDE",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1069.001"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "5376",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Credential Manager credentials were backed up.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5376",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "MDE",
      "YAMATO"
    ],
    "MitreTTP": "T1555.004"
  },
  {
    "category": "Account Management",
    "subCategory": "Audit User Account Management",
    "eventID": "5377",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Credential Manager credentials were restored from a backup.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Account Management\\Audit User Account Management",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5377",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit DPAPI Activity",
    "eventID": "4692",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Backup of data protection master key was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit DPAPI Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4692",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "ADSECURITY"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit DPAPI Activity",
    "eventID": "4693",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Recovery of data protection master key was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit DPAPI Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4693",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit DPAPI Activity",
    "eventID": "4694",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Protection of auditable protected data was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit DPAPI Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4694",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit DPAPI Activity",
    "eventID": "4695",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Unprotection of auditable protected data was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit DPAPI Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4695",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit PNP Activity",
    "eventID": "6416",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A new external device was recognized by the System.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit PNP Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "MDE",
      "YAMATO",
      "ANSSI",
      "SENTINEL"
    ],
    "MitreTTP": "T1091"
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit PNP Activity",
    "eventID": "6419",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A request was made to disable a device.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit PNP Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6419",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit PNP Activity",
    "eventID": "6420",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A device was disabled.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit PNP Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6420",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit PNP Activity",
    "eventID": "6421",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A request was made to enable a device.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit PNP Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6421",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit PNP Activity",
    "eventID": "6422",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A device was enabled.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit PNP Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6422",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit PNP Activity",
    "eventID": "6423",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The installation of this device is forbidden by system policy.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit PNP Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "MDE",
      "SENTINEL"
    ],
    "MitreTTP": "T1091"
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit PNP Activity",
    "eventID": "6424",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The installation of this device was allowed, after having previously been forbidden by policy.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit PNP Activity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6424",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit Process Creation",
    "eventID": "4688",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A new process has been created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit Process Creation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": "Medium to High"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "ANSSI",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit Process Creation",
    "eventID": "4696",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A primary token was assigned to process.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit Process Creation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4696",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": "Medium to High"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit Process Termination",
    "eventID": "4689",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A process has exited.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit Process Termination",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4689",
    "volume": {
      "DomainController": "Low to Medium",
      "Server": "Low to Medium",
      "Workstation": "Low to Medium"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit RPC Events",
    "eventID": "5712",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Remote Procedure Call (RPC) was attempted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit RPC Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5712",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Detailed Tracking",
    "subCategory": "Audit Token Right Adjusted",
    "eventID": "4703",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user right was adjusted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Detailed Tracking\\Audit Token Right Adjusted",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": "Medium to High"
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": "T1134"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4928",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An Active Directory replica source naming context was established.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4928",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": "T1207"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4929",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An Active Directory replica source naming context was removed.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4929",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": "T1207"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4930",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An Active Directory replica source naming context was modified.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4930",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": "T1207"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4931",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An Active Directory replica destination naming context was modified.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4931",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": "T1207"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4934",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Attributes of an Active Directory object were replicated.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4934",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4935",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Replication failure begins.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4935",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4936",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Replication failure ends.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4936",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Detailed Directory Service Replication",
    "eventID": "4937",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A lingering object was removed from a replica.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Detailed Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4937",
    "volume": {
      "DomainController": "Very High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Access",
    "eventID": "4661",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A handle to an object was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Access",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1003,T1201"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Access",
    "eventID": "4662",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An operation was performed on an object.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Access",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "MDI",
      "SENTINEL"
    ],
    "MitreTTP": "T1069.002"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Changes",
    "eventID": "5136",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A directory service object was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Changes",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "MDI",
      "SENTINEL"
    ],
    "MitreTTP": "T1222.001"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Changes",
    "eventID": "5137",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A directory service object was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Changes",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1207"
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Changes",
    "eventID": "5138",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A directory service object was undeleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Changes",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5138",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Changes",
    "eventID": "5139",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A directory service object was moved.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Changes",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5139",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Changes",
    "eventID": "5141",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A directory service object was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Changes",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Replication",
    "eventID": "4932",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Synchronization of a replica of an Active Directory naming context has begun.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4932",
    "volume": {
      "DomainController": "Medium",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Replication",
    "eventID": "4933",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Synchronization of a replica of an Active Directory naming context has ended.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Replication",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4933",
    "volume": {
      "DomainController": "Medium",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "DS Access",
    "subCategory": "Audit Directory Service Access",
    "eventID": "4661",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A handle to an object was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\DS Access\\Audit Directory Service Access",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1003,T1201"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Account Lockout",
    "eventID": "4625",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An account failed to log on.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Account Lockout",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "ANSSI",
      "CORTEX",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Group Membership",
    "eventID": "4627",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Group membership information.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Group Membership",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Extended Mode",
    "eventID": "4978",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Extended Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Extended Mode",
    "eventID": "4979",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Main Mode and Extended Mode security associations were established.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Extended Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Extended Mode",
    "eventID": "4980",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Main Mode and Extended Mode security associations were established.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Extended Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Extended Mode",
    "eventID": "4981",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Main Mode and Extended Mode security associations were established.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Extended Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Extended Mode",
    "eventID": "4982",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Main Mode and Extended Mode security associations were established.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Extended Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Extended Mode",
    "eventID": "4983",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Extended Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Extended Mode",
    "eventID": "4984",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": " An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Extended Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Logoff",
    "eventID": "4634",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An account was logged off.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Logoff",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Logoff",
    "eventID": "4647",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "User initiated logoff.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Logoff",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Logon",
    "eventID": "4624",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An account was successfully logged on.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Logon",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "ANSSI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1078"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Logon",
    "eventID": "4625",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An account failed to log on.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Logon",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "ANSSI",
      "CORTEX",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1110"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Logon",
    "eventID": "4648",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A logon was attempted using explicit credentials.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Logon",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "ANSSI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1134.002"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Logon",
    "eventID": "4675",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "SIDs were filtered.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Logon",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4675",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": "T1134.005"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "4649",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A replay attack was detected.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4649",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1558"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "4678",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A session was reconnected to a Window Station.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4678",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "4679",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A session was disconnected from a Window Station.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4679",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "4800",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The workstation was locked.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4800",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "CORTEX",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "4801",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The workstation was unlocked.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4801",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "CORTEX",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "4802",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The screen saver was invoked.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4802",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "CORTEX",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "4803",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The screen saver was dismissed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4803",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "CORTEX",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "5378",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The requested credentials delegation was disallowed by policy.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5378",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": "T1078"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "5632",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A request was made to authenticate to a wireless network.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5632",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "ANSSI",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Other Logon/Logoff Events",
    "eventID": "5633",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A request was made to authenticate to a wired network.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Other Logon/Logoff Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5633",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Special Logon",
    "eventID": "4672",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Special privileges assigned to new logon.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Special Logon",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1078"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Special Logon",
    "eventID": "4964",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Special groups have been assigned to a new logon.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Special Logon",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1078"
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit User/Device Claims",
    "eventID": "4626",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "User/Device claims information.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit User/Device Claims",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4626",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "4646",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Security ID: %1",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "4650",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "4651",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "4652",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Main Mode negotiation failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "4653",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Main Mode negotiation failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "4655",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Main Mode security association ended.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "4976",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "5049",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Security Association was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Main Mode",
    "eventID": "5453",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit IPsec Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Quick Mode",
    "eventID": "4977",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Quick Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Quick Mode",
    "eventID": "5451",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Quick Mode security association was established.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Quick Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit IPsec Quick Mode",
    "eventID": "5452",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An IPsec Quick Mode security association ended.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Quick Main Mode",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6272",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server granted access to a user.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6273",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server denied access to a user.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6274",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server discarded the request for a user.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6275",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server discarded the accounting request for a user.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6276",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server quarantined a user.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6277",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6278",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server granted full access to a user because the host met the defined health policy.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6279",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server locked the user account due to repeated failed authentication attempts.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Logon Logoff",
    "subCategory": "Audit Network Policy Server",
    "eventID": "6280",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Network Policy Server unlocked the user account.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Logon Logoff\\Audit Network Policy Server",
    "documentation": "",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Central Access Policy Staging",
    "eventID": "4618",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Central Access Policy Staging",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4618",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Detailed File Share",
    "eventID": "5145",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A network share object was checked to see whether client can be granted desired access.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Detailed File Share",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145",
    "volume": {
      "DomainController": "High",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO",
      "ANSSI",
      "SENTINEL"
    ],
    "MitreTTP": "T1021.002"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "4656",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A handle to an object was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "4658",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The handle to an object was closed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4658",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "4660",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An object was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "4663",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to access an object.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1003.001"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "4664",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to create a hard link.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4664",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "4670",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Permissions on an object were changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670",
    "volume": {
      "DomainController": "Varies, depending on how file system SACLs are configured.",
      "Server": "Varies, depending on how file system SACLs are configured.",
      "Workstation": "Varies, depending on how file system SACLs are configured."
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1222.001"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "4985",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The state of a transaction has changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4985",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File System",
    "eventID": "5051",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A file was virtualized",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File System",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5051",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5031",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Service blocked an application from accepting incoming connections on the network.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5031",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5150",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform blocked a packet.",
    "availableSettings": [
      ""
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5150",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5151",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A more restrictive Windows Filtering Platform filter has blocked a packet.",
    "availableSettings": [
      ""
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5151",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5154",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5155",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5156",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform has permitted a connection.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5157",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform has blocked a connection.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5158",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform has permitted a bind to a local port.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Connection",
    "eventID": "5159",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform has blocked a bind to a local port.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Connection",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Packet Drop",
    "eventID": "5152",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform blocked a packet.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Packet Drop",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Filtering Platform Packet Drop",
    "eventID": "5153",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A more restrictive Windows Filtering Platform filter has blocked a packet.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Filtering Platform Packet Drop",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5153",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Handle Manipulation",
    "eventID": "4658",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The handle to an object was closed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Handle Manipulation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4658",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Handle Manipulation",
    "eventID": "4690",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to duplicate a handle to an object.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Handle Manipulation",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4690",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Kernel Object",
    "eventID": "4656",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A handle to an object was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Kernel Object",
    "eventID": "4658",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The handle to an object was closed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4658",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Kernel Object",
    "eventID": "4660",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An object was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Kernel Object",
    "eventID": "4663",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to access an object.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Kernel Object",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1003.001"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "4671",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An application attempted to access a blocked ordinal through the TBS.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4671",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "4691",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Indirect access to an object was requested.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4691",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "4698",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A scheduled task was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1053.005"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "4699",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A scheduled task was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1053.005"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "4700",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A scheduled task was enabled.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4700",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1053.005"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "4701",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A scheduled task was disabled.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4701",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": "T1053.005"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "4702",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A scheduled task was updated.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4702",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "MDE",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1053.005"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "5148",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5148",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": "T1498"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "5149",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The DoS attack has subsided and normal processing is being resumed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5149",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": "T1498"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "5888",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An object in the COM+ Catalog was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5888",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "5889",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An object was deleted from the COM+ Catalog.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5889",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Other Object Access Events",
    "eventID": "5890",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An object was added to the COM+ Catalog.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Other Object Access Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5890",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Registry",
    "eventID": "4656",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A handle to an object was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Registry",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Registry",
    "eventID": "4657",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A registry value was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Registry",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "ANSSI",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Registry",
    "eventID": "4658",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The handle to an object was closed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Registry",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4658",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Registry",
    "eventID": "4660",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An object was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Registry",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Registry",
    "eventID": "4670",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Permissions on an object were changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Registry",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1222.001"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Registry",
    "eventID": "5039",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A registry key was virtualized.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Registry",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5039",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Registry",
    "eventID": "4663",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to access an object.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Registry",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1003.001"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Application Generated",
    "eventID": "4665",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to create an application client context.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Application Generated",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Application Generated",
    "eventID": "4666",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An application attempted an operation.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Application Generated",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Application Generated",
    "eventID": "4667",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An application client context was deleted.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Application Generated",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Application Generated",
    "eventID": "4668",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An application was initialized.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Application Generated",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4868",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The certificate manager denied a pending certificate request.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4869",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services received a resubmitted certificate request.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4870",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services revoked a certificate.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4871",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services received a request to publish the certificate revocation list (CRL).",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4872",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services published the certificate revocation list (CRL).",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4873",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A certificate request extension changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4874",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "One or more certificate request attributes changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4875",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services received a request to shut down.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4876",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services backup started.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4877",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services backup completed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4878",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services restore started.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4879",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services restore completed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4880",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services started.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4881",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services stopped.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4882",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The security permissions for Certificate Services changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4883",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services retrieved an archived key.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4884",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services imported a certificate into its database.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4885",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The audit filter for Certificate Services changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4886",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services received a certificate request.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4887",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services approved a certificate request and issued a certificate.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4888",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services denied a certificate request.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4889",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services set the status of a certificate request to pending.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4890",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The certificate manager settings for Certificate Services changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4891",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A configuration entry changed in Certificate Services.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4892",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A property of Certificate Services changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4893",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services archived a key.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4894",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services imported and archived a key.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4895",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services published the CA certificate to Active Directory Domain Services.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4896",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "One or more rows have been deleted from the certificate database.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "CORTEX"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4897",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Role separation enabled.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Certification Services",
    "eventID": "4898",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Certificate Services loaded a template.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Certification Services",
    "documentation": "",
    "volume": {
      "DomainController": "Low to medium",
      "Server": "Low to medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "CORTEX",
      "SENTINEL"
    ],
    "MitreTTP": "T1649"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Removable Storage",
    "eventID": "4663",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to access an object.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Removable Storage",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "JSCU-NL",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1003.001"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Removable Storage",
    "eventID": "4656",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A handle to an object was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Removable Storage",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit Removable Storage",
    "eventID": "4658",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The handle to an object was closed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit Removable Storage",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4658",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Object Access",
    "subCategory": "Audit SAM",
    "eventID": "4661",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A handle to an object was requested.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit SAM",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661",
    "volume": {
      "DomainController": "High",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1003,T1201"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File Share",
    "eventID": "5140",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A network share object was accessed.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File Share",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140",
    "volume": {
      "DomainController": "High",
      "Server": "Low to High",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "JSCU-NL",
      "YAMATO",
      "ANSSI",
      "CORTEX",
      "SENTINEL"
    ],
    "MitreTTP": "T1021.002"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File Share",
    "eventID": "5142",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A network share object was added.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File Share",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142",
    "volume": {
      "DomainController": "High",
      "Server": "Low to High",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "YAMATO",
      "ANSSI"
    ],
    "MitreTTP": "T1021.002"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File Share",
    "eventID": "5143",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A network share object was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File Share",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5143",
    "volume": {
      "DomainController": "High",
      "Server": "Low to High",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": "T1222.001"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File Share",
    "eventID": "5144",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A network share object was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File Share",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5144",
    "volume": {
      "DomainController": "High",
      "Server": "Low to High",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO",
      "ANSSI"
    ],
    "MitreTTP": "T1021.002"
  },
  {
    "category": "Object Access",
    "subCategory": "Audit File Share",
    "eventID": "5168",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "SPN check for SMB/SMB2 failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Object Access\\Audit File Share",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5168",
    "volume": {
      "DomainController": "High",
      "Server": "Low to High",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": "T1187T1187T1187T1187"
  },
  {
    "category": "Other Events",
    "subCategory": "Other Events",
    "eventID": "1100",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The event logging service has shut down.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Other Events\\Other Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SENTINEL"
    ],
    "MitreTTP": "T1562.002"
  },
  {
    "category": "Other Events",
    "subCategory": "Other Events",
    "eventID": "1102",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The audit log was cleared.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Other Events\\Other Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "ANSSI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1070.001"
  },
  {
    "category": "Other Events",
    "subCategory": "Other Events",
    "eventID": "1104",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The security log is now full.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Other Events\\Other Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1104",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": "T1562.002"
  },
  {
    "category": "Other Events",
    "subCategory": "Other Events",
    "eventID": "1105",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Event log automatic backup",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Other Events\\Other Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1105",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "Other Events",
    "subCategory": "Other Events",
    "eventID": "1108",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The event logging service encountered an error while processing an incoming event published from %1.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Other Events\\Other Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1108",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4715",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The audit policy (SACL) on an object was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4715",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4719",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "System audit policy was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1562.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4817",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Auditing settings on object were changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4817",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4902",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Per-user audit policy table was created.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4902",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4904",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to register a security event source.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4904",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4905",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An attempt was made to unregister a security event source.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4905",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4906",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The CrashOnAuditFail value has changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4906",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM"
    ],
    "MitreTTP": "T1562.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4907",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Auditing settings on object were changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4907",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4908",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Special Groups Logon table modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4908",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1562.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Audit Policy Change",
    "eventID": "4912",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Per User Audit Policy was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Audit Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4912",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4706",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A new trust was created to a domain.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": "T1484.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4707",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A trust to a domain was removed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4707",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": "T1484.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4713",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Kerberos policy was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4713",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1484"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4716",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Trusted domain information was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4716",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1484.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4717",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "System security access was granted to an account.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4717",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1134"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4718",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "System security access was removed from an account.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4718",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1134"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4739",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Domain Policy was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4739",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1484"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4864",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A namespace collision was detected.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4864",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4865",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A trusted forest information entry was added.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4865",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": "T1484.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4866",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A trusted forest information entry was removed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4866",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": "T1484.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4867",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A trusted forest information entry was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4867",
    "volume": {
      "DomainController": "Low",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "ADSECURITY"
    ],
    "MitreTTP": "T1484.002"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authorization Policy Change",
    "eventID": "4703",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user right was adjusted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authorization Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": "T1134"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authorization Policy Change",
    "eventID": "4704",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user right was assigned.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authorization Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4704",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1134"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authorization Policy Change",
    "eventID": "4705",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A user right was removed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authorization Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4705",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1134"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authorization Policy Change",
    "eventID": "4911",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Resource attributes of the object were changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authorization Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4911",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authorization Policy Change",
    "eventID": "4913",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Central Access Policy on the object was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authorization Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4913",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4944",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The following policy was active when the Windows Firewall started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4944",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4945",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A rule was listed when the Windows Firewall started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4945",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4946",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to Windows Firewall exception list. A rule was added.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4946",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4947",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to Windows Firewall exception list. A rule was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4947",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4948",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to Windows Firewall exception list. A rule was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4948",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4949",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows Firewall settings were restored to the default values.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4949",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4950",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Windows Firewall setting has changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4950",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4951",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A rule has been ignored because its major version number wasn't recognized by Windows Firewall.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4951",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4952",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4952",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4953",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows Firewall ignored a rule because it couldn't be parsed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4953",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4954",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows Firewall Group Policy settings have changed. The new settings have been applied.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4954",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4956",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows Firewall has changed the active profile.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4956",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4957",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows Firewall did not apply the following rule.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4957",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit MPSSVC Rule-Level Policy Change",
    "eventID": "4958",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit MPSSVC Rule-Level Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4958",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": "Medium"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "4714",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Encrypted data recovery policy was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4714",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "4819",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Central Access Policies on the machine have been changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4819",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "4826",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Boot Configuration Data loaded.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4826",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "4909",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The local policy settings for the TBS were changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4909",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "4910",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The group policy settings for the TBS were changed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4910",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5063",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic provider operation was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5063",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5064",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic context operation was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5064",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5065",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic context modification was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5065",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5066",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic function operation was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5066",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5067",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic function modification was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5067",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5068",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic function provider operation was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5068",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5069",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic function property operation was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5069",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5070",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic function property modification was attempted.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5070",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "5447",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Windows Filtering Platform filter has been changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5447",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "6144",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Security policy in the group policy objects has been applied successfully.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6144",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Other Policy Change",
    "eventID": "6145",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "One or more errors occurred while processing security policy in the group policy objects.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Other Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6145",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authentication Policy Change",
    "eventID": "4670",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Permissions on an object were changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authentication Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1222.001"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Authorization Policy Change",
    "eventID": "4670",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Permissions on an object were changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Authorization Policy Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670",
    "volume": {
      "DomainController": "Medium to High",
      "Server": "Medium to High",
      "Workstation": "Medium to High"
    },
    "microsoftBaseline": {
      "DomainController": "IF",
      "Server": "IF",
      "Workstation": "IF"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": "T1222.001"
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "4709",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services was started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "4710",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services was disabled.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "4711",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "May contain any one of the following:",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "4712",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services encountered a potentially serious failure.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5040",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. An Authentication Set was added.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5041",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. An Authentication Set was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5042",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. An Authentication Set was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5043",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. A Connection Security Rule was added.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5044",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. A Connection Security Rule was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5045",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. A Connection Security Rule was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5046",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. A Crypto Set was added.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5047",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. A Crypto Set was modified.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5048",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A change has been made to IPsec settings. A Crypto Set was deleted.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5440",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The following callout was present when the Windows Filtering Platform Base Filtering Engine started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5441",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The following filter was present when the Windows Filtering Platform Base Filtering Engine started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5442",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The following provider was present when the Windows Filtering Platform Base Filtering Engine started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5443",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5444",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5446",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Windows Filtering Platform callout has been changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5448",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Windows Filtering Platform provider has been changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5449",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Windows Filtering Platform provider context has been changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5450",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A Windows Filtering Platform sub-layer has been changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5456",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine applied Active Directory storage IPsec policy on the computer.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5457",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine failed to apply Active Directory storage IPsec policy on the computer.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5458",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5459",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5460",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine applied local registry storage IPsec policy on the computer.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5461",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine failed to apply local registry storage IPsec policy on the computer.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5462",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5463",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine polled for changes to the active IPsec policy and detected no changes.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5464",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5465",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5466",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5467",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5468",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5471",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine loaded local storage IPsec policy on the computer.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5472",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine failed to load local storage IPsec policy on the computer.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5473",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine loaded directory storage IPsec policy on the computer.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5474",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine failed to load directory storage IPsec policy on the computer.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Policy Change",
    "subCategory": "Audit Filtering Platform Policy Change",
    "eventID": "5477",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "PAStore Engine failed to add quick mode filter.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Policy Change\\Audit Filtering Platform Policy Change",
    "documentation": "",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Privilege Use",
    "subCategory": "Audit Non-Sensitive Privilege Use",
    "eventID": "4673",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A privileged service was called.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Privilege Use\\Audit Non-Sensitive Privilege Use",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673",
    "volume": {
      "DomainController": "Very High",
      "Server": "Very High",
      "Workstation": "Very High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Privilege Use",
    "subCategory": "Audit Non-Sensitive Privilege Use",
    "eventID": "4674",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An operation was attempted on a privileged object.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Privilege Use\\Audit Non-Sensitive Privilege Use",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4674",
    "volume": {
      "DomainController": "Very High",
      "Server": "Very High",
      "Workstation": "Very High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Privilege Use",
    "subCategory": "Audit Non-Sensitive Privilege Use",
    "eventID": "4985",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The state of a transaction has changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Privilege Use\\Audit Non-Sensitive Privilege Use",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4985",
    "volume": {
      "DomainController": "Very High",
      "Server": "Very High",
      "Workstation": "Very High"
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Privilege Use",
    "subCategory": "Audit Other Privilege Use",
    "eventID": "4985",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The state of a transaction has changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Privilege Use\\Audit Other Privilege Use",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4985",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "No",
      "Server": "No",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Privilege Use",
    "subCategory": "Audit Sensitive Privilege Use",
    "eventID": "4673",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A privileged service was called.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Privilege Use\\Audit Sensitive Privilege Use",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Privilege Use",
    "subCategory": "Audit Sensitive Privilege Use",
    "eventID": "4674",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An operation was attempted on a privileged object.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Privilege Use\\Audit Sensitive Privilege Use",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4674",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": ""
  },
  {
    "category": "Privilege Use",
    "subCategory": "Audit Sensitive Privilege Use",
    "eventID": "4985",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The state of a transaction has changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Privilege Use\\Audit Sensitive Privilege Use",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4985",
    "volume": {
      "DomainController": "High",
      "Server": "High",
      "Workstation": "High"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5024",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Service has started successfully.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5024",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5025",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Service has been stopped.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5025",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5027",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5027",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5028",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5028",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5029",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5029",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5030",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Service failed to start.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5030",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5032",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5032",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5033",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Driver has started successfully.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5033",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5034",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Driver was stopped.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5034",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5035",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Driver failed to start.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5035",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5037",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The Windows Firewall Driver detected critical runtime error. Terminating.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5037",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5058",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Key file operation.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5058",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "MDE"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "5059",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Key migration operation.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5059",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6400",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "BranchCache: Received an incorrectly formatted response while discovering availability of content.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6400",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6401",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "BranchCache: Received invalid data from a peer. Data discarded.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6401",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6402",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "BranchCache: The message to the hosted cache offering it data is incorrectly formatted.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6402",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6403",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "BranchCache: The hosted cache sent an incorrectly formatted response to the client.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6403",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6404",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6404",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6405",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "BranchCache: %2 instance(s) of event id %1 occurred.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6405",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6406",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "%1 registered to Windows Firewall to control filtering for the following: %2.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6406",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6407",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "1%.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6407",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6408",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6408",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Other System Events",
    "eventID": "6409",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "BranchCache: A service connection point object could not be parsed.",
    "availableSettings": [],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Other System Events",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6409",
    "volume": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Security State Change",
    "eventID": "4608",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Windows is starting up.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security State Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4608",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "YAMATO",
      "SENTINEL"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Security State Change",
    "eventID": "4616",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "The system time was changed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security State Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "CORTEX",
      "YAMATO",
      "ANSSI"
    ],
    "MitreTTP": "T1070.006"
  },
  {
    "category": "System",
    "subCategory": "Audit Security State Change",
    "eventID": "4621",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Administrator recovered system from CrashOnAuditFail.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security State Change",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4621",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": "T1562.002"
  },
  {
    "category": "System",
    "subCategory": "Audit Security System Extension",
    "eventID": "4610",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "An authentication package has been loaded by the Local Security Authority.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security System Extension",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4610",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1547.008"
  },
  {
    "category": "System",
    "subCategory": "Audit Security System Extension",
    "eventID": "4611",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A trusted logon process has been registered with the Local Security Authority.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security System Extension",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "YAMATO",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1547.008"
  },
  {
    "category": "System",
    "subCategory": "Audit Security System Extension",
    "eventID": "4614",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A notification package has been loaded by the Security Account Manager.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security System Extension",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4614",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit Security System Extension",
    "eventID": "4622",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A security package has been loaded by the Local Security Authority.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security System Extension",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4622",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1547.008"
  },
  {
    "category": "System",
    "subCategory": "Audit Security System Extension",
    "eventID": "4697",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A service was installed in the system.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit Security System Extension",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "JSCU-NL",
      "MDE",
      "YAMATO",
      "ANSSI",
      "SENTINEL",
      "ADSECURITY"
    ],
    "MitreTTP": "T1543.003"
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "4612",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4612",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "4615",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Invalid use of LPC port.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4615",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "4618",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A monitored security event pattern has occurred.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4618",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "4816",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "RPC detected an integrity violation while decrypting an incoming message.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4816",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL",
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "5038",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5038",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM",
      "JSCU-NL"
    ],
    "MitreTTP": "T1036.001"
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "5056",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic self-test was performed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5056",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "5057",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A cryptographic primitive operation failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5057",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "5060",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Verification operation failed.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5060",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "5061",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Cryptographic operation.",
    "availableSettings": [
      "Success",
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5061",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success and Failure",
      "Server": "Success and Failure",
      "Workstation": "Success and Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "5062",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "A kernel-mode cryptographic self-test was performed.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5062",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Success",
      "Server": "Success",
      "Workstation": "Success"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "6281",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Code Integrity determined that the page hashes of an image file aren't valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6281",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL"
    ],
    "MitreTTP": "T1036.001"
  },
  {
    "category": "System",
    "subCategory": "Audit System Integrity",
    "eventID": "6410",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "Code integrity determined that a file does not meet the security requirements to load into a process.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit System Integrity",
    "documentation": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6410",
    "volume": {
      "DomainController": "Low",
      "Server": "Low",
      "Workstation": "Low"
    },
    "microsoftBaseline": {
      "DomainController": "Failure",
      "Server": "Failure",
      "Workstation": "Failure"
    },
    "securityMonitoringRecommandation": "Yes",
    "tags": [
      "JSCU-NL"
    ],
    "MitreTTP": "T1036.001"
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "4960",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "4962",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "4963",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "4965",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "5478",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services has started successfully.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "5479",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.",
    "availableSettings": [
      "Success"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": "No"
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "5480",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "5483",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services failed to initialize RPC server. IPsec Services could not be started.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "5484",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ],
    "MitreTTP": ""
  },
  {
    "category": "System",
    "subCategory": "Audit IPsec Driver",
    "eventID": "5485",
    "level": "Information",
    "channel": "Security",
    "provider": "Microsoft-Windows-Security-Auditing",
    "description": "IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem.",
    "availableSettings": [
      "Failure"
    ],
    "gpoSettings": "Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\System\\Audit IPsec Driver",
    "documentation": "",
    "volume": {
      "DomainController": "Medium",
      "Server": "Medium",
      "Workstation": ""
    },
    "microsoftBaseline": {
      "DomainController": "",
      "Server": "",
      "Workstation": ""
    },
    "securityMonitoringRecommandation": "No",
    "tags": [
      "SRV-ETM"
    ]
  }
]