Endpoint / Security event
SecurityEvent
Windows Security Event Log entries including logon, privilege use, process creation, and policy changes
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC4 Endpoint and operating system activity
Endpoint and operating system activity: process, script, logon, service, scheduled task, registry, file
ACSC
- 1. Endpoint detection and response (EDR) logs
- 5. Microsoft Windows endpoints logs
- 6. Virtualisation system logs
- 13. Linux endpoint auditing logs
- 14. Apple MacOS endpoint logs
CISA
- 2. Operating systems2a-2j All listed operating system event types
MITRE data sources
- User Account: Authentication
- Process: Process Creation
- Logon Session: Logon Session Creation
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
EventID143Computer120TimeGenerated108Account63CommandLine62EventData52SubjectUserName48ParentProcessName47Activity45NewProcessName42Process36ObjectName34
Split hints
Rows to keep in Analytics with a split rule.
Keep security-critical EventIDs in Analytics: logon (4624/4625/4648), process (4688), service install (7045), account changes (4720-4738), privilege (4672), Kerberoasting (4769), audit log cleared (1102)
tolong(EventID) in (1102, 4624, 4625, 4634, 4648, 4657, 4663, 4672, 4688, 4697, 4698, 4699, 4700, 4701, 4702, 4720, 4722, 4723, 4724, 4725, 4726, 4728, 4732, 4733, 4738, 4740, 4756, 4767, 4769, 4771, 4776, 5136, 5140, 5145, 7034, 7040, 7045)Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.