DocumentationModules

Windows Events — beta

Windows events — overview

The Windows events page analyses Windows security logs collected by Fleet agents: logons, account and group changes, privilege use, Kerberos and critical events. FlowPro evaluates 18 attack detections directly on the data every 2 minutes and sends matches to the Event Center.

Required tier: Enterprise(beta module)

•Time range presets (1 h – 30 days) or a custom range up to 90 days; all filters are part of the URL
•Profile of a user or host: activity, hosts / users, source IPs, logon types, detections, context from Active Directory and assets
•Click any row to see all fields and pivot to Active Directory, the asset, the Log Explorer or network tools

Collecting Windows logs

Enroll the Elastic agent

Install the Fleet agent on domain controllers and important servers (Infrastructure → Agents) into a Windows policy.

Enable the channels

In Data Sources an administrator sees the Windows policies and which channels of the System integration (winlog input) are enabled. Enable Collection turns on Security, System and Application for the selected policy only — Linux policies are never touched.

Configure the audit policy

Windows logs only what the audit policy allows. Recommended Advanced Audit Policy for domain controllers (GPO "Default Domain Controllers Policy"):

Account Logon:      Credential Validation, Kerberos Authentication Service,
                    Kerberos Service Ticket Operations      Success, Failure
Account Management: User / Security Group Management       Success
Logon/Logoff:       Logon, Account Lockout, Special Logon   Success, Failure
DS Access:          Directory Service Access, Changes       Success
Policy Change:      Audit Policy Change                     Success
System:             Security System Extension               Success
PowerShell:         Turn on Script Block Logging (Administrative Templates)

Windows logs have their own retention category "Windows events" (Settings → Databases → Data retention), 365 days by default, capped by the licence.

Logons

Successful (4624) and failed (4625) logons with logon type, failure reason (SubStatus) and source IP. Filter by outcome, logon type, user, host or IP; click a logon type or an IP in the panels to filter.

Type	Meaning
2	Interactive (console)
3	Network (file share, most services)
5	Service start
10	Remote Desktop (RDP)
11	Cached credentials (laptop offline)

Account and group changes

Account changes (4720 create, 4722/4725 enable/disable, 4723/4724 password, 4726 delete, 4740 lockout, 4781 rename, 4794 DSRM) and group membership changes (4728/4732/4756 added, 4729/4733/4757 removed). Privileged groups are marked with a crown — recognised by well-known SID and from Active Directory.

Windows logs say WHO made a change; Active Directory → Changes shows WHAT changed between two syncs. Use both together.

Privilege use

Logons with special privileges (4672) and privileged operations (4673, 4674). Computer accounts (…$) and built-in services are hidden by default, so the list shows people with administrative rights.

Kerberos

TGT requests (4768), service tickets (4769) and pre-authentication failures (4771) with encryption type. RC4 (0x17) and DES should not appear in a modern domain — the Weak Encryption card filters them; the accounts requesting RC4 are listed separately.

Critical events

Events attackers use to cover tracks or persist: Security log cleared (1102), System log cleared (104), audit policy changed (4719), service installed (7045 in the System log, 4697) and DSRM password set (4794).

Detections

FlowPro evaluates the detections itself every 2 minutes (one worker). Aggregate detections look at a sliding window and repeat per IP / user only after the cooldown (default 60 min); single-event detections report every new occurrence. Each match is an Event Center event with MITRE ATT&CK technique — playbooks and notification channels can react to it, and the MITRE page shows Windows as a source.

Detection	Condition	MITRE
Brute force	≥ 10 failed logons from one IP in 10 min	T1110
Password spraying	one IP, ≥ 8 different accounts in 15 min	T1110.003
Logon after failures	≥ 5 failures then a success from the same IP	T1110
Lockout spike	≥ 5 lockouts (4740) in 10 min	T1110
Kerberoasting	one account, RC4/DES tickets for ≥ 5 services (not krbtgt, not computers)	T1558.003
AS-REP roasting	TGT issued with PreAuthType 0	T1558.004
DCSync	4662 with replication GUIDs from a non-DC account	T1003.006
Privileged group change	member added to Domain Admins, Administrators, … (SID / AD)	T1098
Account created / deleted	4720 / 4726	T1136.002 / T1531
Audit log cleared	1102 / 104	T1070.001
Audit policy changed	4719 by a person	T1562.002
New service	7045 / 4697	T1543.003
DSRM password	4794	T1098
Admin off-hours	interactive / RDP logon of a privileged account outside working hours or at the weekend	T1078.002
RDP from the internet	logon type 10 from a public IP	T1021.001
Suspicious PowerShell	4104 with download-and-execute, encoded command, AMSI bypass, Mimikatz	T1059.001
Scheduled task (off by default)	4698	T1053.005

Tuning

Administrators enable/disable detections, change thresholds and set exclusions (accounts, IPs, hosts — one per line, trailing * as prefix), extra admin accounts for the off-hours detection (privileged AD accounts are included automatically), working hours, cooldown, minimum severity and notifications. Run Now evaluates immediately (analyst and admin).

Older versions created the detections as Kibana rules on every restart, so thousands of copies could build up and overload Kibana. After the upgrade FlowPro deletes them once automatically.

Data sources

Collection health: the last Security event, Windows agents online in Fleet and whether they send data, channels with event counts, hosts with their last event, and the Windows Fleet policies with the state of each channel. If Windows agents are online but no Security event arrives within the limit (default 6 h), an Event Center event is raised.

Integration with other modules

Module	Link
Event Center, playbooks	source "Windows events"; the event button opens the user or host profile
Active Directory	privileged accounts and groups, AD card in profiles, link from AD users and computers
MITRE ATT&CK	source "Windows" — technique occurrences and coverage of enabled detections
Assets, Log Explorer, network tools	pivots from every event and profile

Troubleshooting

Problem	Solution
Banner "No Windows security events"	Enable the Security channel in Data Sources and check the agent status in Fleet.
Logons are there but no group changes / Kerberos	The audit policy does not log them — see Collecting Windows logs → audit policy (domain controllers).
Suspicious PowerShell never fires	Needs the Windows integration (PowerShell Operational channel) and Script Block Logging.
Too many detections from a scanner or a service account	Add the IP / account to the exclusions in Detections.
Users / hosts show 0 although there are events	An old FlowPro index template "flowpro-logs" overrode the Fleet mappings; the upgrade removes it and the next index of each stream gets correct fields.