# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
event_id	action	outcome
1074	system-shutdown	success
1100	logging-service-shutdown	success
1102	audit-log-cleared	success
1104	security-logging-full	failure
1105	auditlog-archieved	success
1108	logging-error	failure
4608	windows-starts	success
4610	authentication-package-loaded	success
4611	trusted-logon-process-registered	success
4614	notification-package-loaded	success
4616	system-time-changed	success
4622	security-package-loaded	success
4624	logon	success
4625	logon-failed	failure
4634	logoff	success
4647	logoff	success
4648	logon-explicit	success
4649	replay-attack-detected	unknown
4656	object-handle-requested	unknown
4657	registry-value-modified	success
4658	objcet-handle-closed	success
4659	objcet-handle-deleted	unknown
4660	object-deleted	success
4661	object-handle-requested	unknown
4662	object-operation-performed	unknown
4663	object-accessed	unknown
4664	hard-link-created	unknown
4670	object-permissions-changed	success
4672	special-user-logon	success
4673	privileged-service-called	success
4674	privileged-object-operation-performed	unknown
4675	sids-filtered	success
4656	objcet-handle-requested	unknown
4688	process-created	success
4689	process-terminated	success
4691	indirect-access-to-object	unknown
4696	process-created	success
4697	service-installed	success
4698	scheduled-task-created	success
4699	scheduled-task-deleted	success
4700	scheduled-task-enabled	success
4701	scheduled-task-disabled	success
4702	scheduled-task-updated	success
4715	object-audit-policy-changed	success
4719	system-audit-policy-changed	success
4720	added-user-account	success
4722	enabled-user-account	success
4723	requested-change-password	unknown
4724	requested-reset-password	unknown
4725	disabled-user-account	success
4726	deleted-user-account	success
4728	added-member-to-local-security-group	success
4732	added-member-to-global-security-group	success
4733	removed-member-to-local-security-group	success
4734	deleted-local-security-group	success
4735	changed-local-security-group	success
4737	changed-global-security-group	success
4738	changed-user-account	success
4739	domain-policy-changed	success
4740	locked-out-user-account	success
4741	added-computer-account	success
4742	changed-computer-account	success
4743	deleted-computer-account	success
4764	changed-group-type	success
4765	added-sid-history-to-account	success
4766	failed-to-add-sid-history-to-account	failure
4767	unlocked-user-account	success
4768	kerberos-authentication-ticket-requested	unknown
4769	kerberos-service-ticket-requested	unknown
4770	kerberos-service-ticket-renewed	success
4771	kerberos-pre-authentication-failed	failure
4772	kerberos-authentication-ticket-request-failed	failure
4776	validated-user-credentials	unknown
4778	session-reconnected	success
4779	session-disconnected	success
4780	set-acl-to-admin-user	success
4781	renamed-user-account	success
4794	requested-set-directory-services-restore-mode	unknown
4798	local-group-membership-enumerated	success
4799	local-security-group-membership-enumerated	success
4800	workstation-locked	failure
4801	workstation-unlocked	success
4802	screen-saver-invoked	success
4803	screen-saver-dismissed	failure
4817	object-audit-setting-changed	success
4826	boot-configuration-data-loaded	success
4902	user-audit-policy-created	success
4904	security-event-source-registered	unknown
4905	security-event-source-unregistered	unknown
4906	crash-on-audit-fail-value-changed	success
4907	object-audit-setting-changed	success
4908	modified-special-group	success
4912	user-audit-policy-changed	success
4944	windows-firewall-policy-actived	success
4945	windows-firewall-rule-listed	success
4946	windows-firewall-rule-added	success
4947	windows-firewall-rule-modified	success
4948	windows-firewall-rule-deleted	success
4949	windows-firewall-default-settings-restored	success
4950	windows-firewall-settings-changed	success
4951	windows-firewall-rule-ignored	failure
4952	windows-firewall-rule-ignored	failure
4953	windows-firewall-rule-ignored	failure
4954	windows-firewall-group-policy-changed	success
4956	windows-firewall-active-profile-changed	success
4957	windows-firewall-rule-ignored	failure
4958	windows-firewall-rule-ignored	failure
4964	special-group-logon	success
4985	transaction-state-changed	success
5024	windows-firewall-service-started	success
5025	windows-firewall-service-stopped	success
5033	windows-firewall-driver-started	success
5034	windows-firewall-driver-stopped	success
5039	registry-key-virtualized	success
5051	file-virtualized	success
5058	key-file-operation	success
5059	key-migration-operation	success
5060	verification-operation-failed	success
5061	cryptographic-operation	success
5136	directory-service-object-modified	success
5140	network-share-object-accessed	success
5142	network-share-object-added	success
5143	network-share-object-modified	success
5144	network-share-object-deleted	success
5148	dos-attack-detected	success
5149	dos-attack-subsided	success
5152	packet-blocked	failure
5154	port-listen-allowed	success
5155	port-listen-blocked	failure
5156	connection-allowed	success
5157	connection-blocked	failure
5158	binding-local-port-allowed	success
5159	binding-local-port-blocked	failure
5168	spn-check-failed	failure
5376	credentials-backedup	success
5377	credentials-restored	success
5378	credentials-delegation-failed	failure
5379	credentials-read	success
5632	wireless-network-requested	unknown
5633	wired-network-requested	unknown
5888	com-catalog-objcet-modified	success
5889	com-catalog-objcet-deleted	success
5890	com-catalog-objcet-added	success
6416	external-device-recognized	success
7045	service-installed	success