Which Windows events are used by Splunk UBA?

The raw parser in Splunk UBA doesn't look for specific Windows events, Rather, all Windows events are analyzed to find common field names such as account name or workstation. These field names are extracted from Windows events and stored in data cubes to be consumed by anomaly rules and models. Having the right Windows events in Splunk UBA can lead to meaningful detections so that the desired security use cases are unlocked.

See the following categories of Windows events used by Splunk UBA:

• Highly recommended Windows events used by Splunk UBA
• Recommended Windows events used by Splunk UBA
• Nice to have Windows events used by Splunk UBA

Highly recommended Windows events used by Splunk UBA

Ingest the events listed in this table so that Splunk UBA can generate the proper anomalies and threats. See Which data sources to I need? to identify the anomalies and threats generated by Windows events. The absence of any of the listed events will prevent anomalies and threats from being generated.

Windows Event ID	Description
4624	An account was successfully logged on.
4776	The computer attempted to validate the credentials for an account.
4768	A Kerberos authentication ticket (TGT) was requested.
4769	A Kerberos service ticket was requested.
4625	An account failed to logon.
4634	An account was logged off.

Recommended Windows events used by Splunk UBA

It is recommended to log the following Windows event types so that Splunk UBA can generate anomalies and threats.

Windows Event ID	Description
1102	The audit log was cleared.

Nice to have Windows events used by Splunk UBA

The following Windows event types enhance the fidelity of your detections by providing additional evidence and clarity.

Windows Event ID	Description
Windows PowerShell events
4103	PowerShell Module Logging. See Configure PowerShell logging to see PowerShell anomalies in Splunk UBA.
4104	PowerShell Script Block Logging. See Configure PowerShell logging to see PowerShell anomalies in Splunk UBA.
4688	A new process has been created.
7045	A service was installed in the system.
Windows object and registry handling events
4657	A registry value was modified.
4691	Indirect access to an object was requested.
4692	Backup of data protection master key was attempted.
4693	Recovery of data protection master key was attempted.
4695	Unprotection of auditable protected data was attempted.
4907	Auditing settings on object were changed.
4911	Resource attributes of the object were changed.
5145	A network share object was checked to see whether client can be granted desired access.
Windows domain, trust, and authentication events
4706	A new trust was created to a domain.
4713	Kerberos policy was changed.
4715	The audit policy (SACL) on an object was changed.
4772	A Kerberos authentication ticket request failed.
4820	A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.
Windows policy events
6273	Network Policy Server denied access to a user.
6276	Network Policy Server quarantined a user.
6277	Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy.
Windows account handling events
4627	Group membership information.
4704	A user right was assigned.
4718	System security access was removed from an account.
4719	System audit policy was changed.
4727	A security-enabled global group was created.
4728	A member was added to a security-enabled global group.
4729	A member was removed from a security-enabled global group.
4730	A security-enabled global group was deleted.
4731	A security-enabled local group was created.
4732	A member was added to a security-enabled local group.
4733	A member was removed from a security-enabled local group.
4734	A security-enabled local group was deleted.
4735	A security-enabled local group was changed.
4737	A security-enabled global group was changed.
4744	A security-disabled local group was created.
4745	A security-disabled local group was changed.
4746	A member was added to a security-disabled local group.
4747	A member was removed from a security-disabled local group.
4750	A security-disabled global group was changed.
4754	A security-enabled universal group was created.
4755	A security-enabled universal group was changed.
4756	A member was added to a security-enabled universal group.
4757	A member was removed from a security-enabled universal group.
4758	A security-enabled universal group was deleted.
4759	A security-disabled universal group was created.
4760	A security-disabled universal group was changed.
4761	A member was added to a security-disabled universal group.
4763	A security-disabled universal group was deleted.
4767	A user account was unlocked.
4781	The name of an account was changed.
4782	The password hash an account was accessed.
4797	An attempt was made to query the existence of a blank password for an account.
4798	A user's local group membership was enumerated.
4799	A security-enabled local group membership was enumerated.
Windows device handling events
4800	The workstation was locked.
4801	The workstation was unlocked.
6416	A new external device was recognized by the system.
Windows security incidents events
4618	A monitored security event pattern has occurred.
4649	A replay attack was detected.
Windows firewall policy changes events
4946	A change has been made to Windows Firewall exception list. A rule was added.
4947	A change has been made to Windows Firewall exception list. A rule was modified.
4948	A change has been made to Windows Firewall exception list. A rule was deleted.
4950	A Windows Firewall setting has changed.