microsoft/windows-logs Dashboards

Active Directory Domain Services Audit

Widget	Description	Type
Directory Service Created	Hide Query Show Query logscale `windows.EventID=5137 \| count()`	`Single Value`
Directory Service Moved	Hide Query Show Query logscale `windows.EventID=5139 \| count()`	`Single Value`
Directory Service Modified	Hide Query Show Query logscale `windows.EventID=5136 \| count()`	`Single Value`
Directory Service Recovered	Hide Query Show Query logscale `windows.EventID=5138 \| count()`	`Single Value`
Directory Service Deleted	Hide Query Show Query logscale `windows.EventID=5141 \| count()`	`Single Value`

Active Directory Domain Services Audit - Details

Widget	Description	Type
Directory Service Created	Hide Query Show Query logscale `windows.EventID=5137 \| count()`	`Single Value`
AD DS - Modification Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5136 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Table`
AD DS - DS Deleted Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5141 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`
Directory Service Moved	Hide Query Show Query logscale `windows.EventID=5139 \| count()`	`Single Value`
AD DS - DS Recovered Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5138 // renames \|rename("host.hostname",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`
AD DS - DS Created Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5137 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`
Directory Service Modified	Hide Query Show Query logscale `windows.EventID=5136 \| count()`	`Single Value`
Directory Service Recovered	Hide Query Show Query logscale `windows.EventID=5138 \| count()`	`Single Value`
Directory Service Deleted	Hide Query Show Query logscale `windows.EventID=5141 \| count()`	`Single Value`
AD DS - DS Moved Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5139 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`

Event Information

Widget Description Type

Events over time

Widget	Description	Type
Events over time	Hide Query Show Query logscale `timechart(windows.EventID, limit=10)`	`Time Chart`
Top 10 Event Types (Code)	Hide Query Show Query logscale `top(["windows.EventID"]) \| rename("_count",as="Count") \| rename("windows.EventID",as="Event ID") \| select(["Event ID","Count"])`	`Table`

Hide Query

Show Query

logscale

timechart(windows.EventID, limit=10)

Time Chart

Top 10 Event Types (Code)

Hide Query

Show Query

logscale

top(["windows.EventID"])
| rename("_count",as="Count")
| rename("windows.EventID",as="Event ID")
| select(["Event ID","Count"])

Table

Event Log Clearing

Widget Description Type

Event Log Service Shutdown

Widget	Description	Type
Event Log Service Shutdown	Hide Query Show Query logscale `windows.EventID=1100 \| count()`	`Single Value`
Event Log Cleared	Hide Query Show Query logscale `windows.EventID=1102 \| count()`	`Single Value`

Hide Query

Show Query

logscale

windows.EventID=1100 | count()

Single Value

Event Log Cleared

Hide Query

Show Query

logscale

windows.EventID=1102 | count()

Single Value

Remote Desktop Login Activity

Widget Description Type

Remote Desktop Login Events

Widget	Description	Type
Remote Desktop Login Events	Hide Query Show Query logscale `windows.EventID=4624 windows.EventData.LogonType=10 \|table(["@collect.host","windows.EventData.TargetUserName","windows.EventData.IpAddress",windows.EventData.TargetDomainName,@timestamp]) \|rename("@collect.host",as="Hostname") \|rename("windows.EventData.TargetUserName", as="User Name")\| rename("windows.EventData.IpAddress", as="Source IP Address")\| rename("windows.EventData.TargetDomainName", as="Target Domain")\|rename("@timestamp", as="Login Time")`	`Table`
Remote Desktop Login Count	Hide Query Show Query logscale `windows.EventID=4624 windows.EventData.LogonType=10 \| count()`	`Single Value`
Source Location	Hide Query Show Query logscale `windows.EventID=4624 windows.EventData.LogonType=10 \|worldmap(ip="windows.EventData.IpAddress")`	`World Map`

Hide Query

Show Query

logscale

windows.EventID=4624 windows.EventData.LogonType=10
|table(["@collect.host","windows.EventData.TargetUserName","windows.EventData.IpAddress",windows.EventData.TargetDomainName,@timestamp])
|rename("@collect.host",as="Hostname") |rename("windows.EventData.TargetUserName", as="User Name")| rename("windows.EventData.IpAddress", as="Source IP Address")| rename("windows.EventData.TargetDomainName", as="Target Domain")|rename("@timestamp", as="Login Time")

Table

Remote Desktop Login Count

Hide Query

Show Query

logscale

windows.EventID=4624 windows.EventData.LogonType=10 | count()

Single Value

Source Location

Hide Query

Show Query

logscale

windows.EventID=4624 windows.EventData.LogonType=10 |worldmap(ip="windows.EventData.IpAddress")

World Map

User Activity

Widget	Description	Type
Failed Logons	Hide Query Show Query logscale `windows.EventID=4625 \| count()`	`Single Value`
Network User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=3 \| count()`	`Single Value`
Logon with Special Privileges	Hide Query Show Query logscale `windows.EventID=4672 \| count()`	`Single Value`
Logoff Event	Hide Query Show Query logscale `windows.EventID=4634 \| count()`	`Single Value`
User Account Disabled	Hide Query Show Query logscale `windows.EventID=4725 \| count()`	`Single Value`
Interactive User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=2 \|count()`	`Single Value`
New Credentials User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=9 \| count()`	`Single Value`
Account Login with Explicit Credentials	Hide Query Show Query logscale `windows.EventID=4648 \| count()`	`Single Value`
Batch User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=4 \| count()`	`Single Value`
Account Name Changed	Hide Query Show Query logscale `windows.EventID=4781 \| count()`	`Single Value`
End breakout		`Note`
Successful Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 \| count()`	`Single Value`
User Account Unlocked	Hide Query Show Query logscale `windows.EventID=4767 \| count()`	`Single Value`
Cached Interactive User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=11 \| count()`	`Single Value`
Remote Interactive User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=10 \| count()`	`Single Value`
New User Account Created	Hide Query Show Query logscale `windows.EventID=4720 \| count()`	`Single Value`
Account Lockouts	Hide Query Show Query logscale `windows.EventID=4740 \| count()`	`Single Value`
User Account Enabled	Hide Query Show Query logscale `windows.EventID=4722 \| count()`	`Single Value`
Successful logon by type	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 \| rename("windows.EventData.LogonType",as="Logon Type") \| groupBy("Logon Type", function=count()) \| sort("Logon Type", order=asc)`	`Table`
Service User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=5 \| count()`	`Single Value`
Unlock User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=7 \| count()`	`Single Value`
Password Resets	Hide Query Show Query logscale `windows.EventID=4724 \| count()`	`Single Value`
Network Clear Text User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=8 \| count()`	`Single Value`
User Account Deleted	Hide Query Show Query logscale `windows.EventID=4726 \| count()`	`Single Value`
Below is the successful user logon breakout		`Note`

Winlogbeat OSS - Active Directory Domain Services Audit

Widget	Description	Type
Directory Service Created	Hide Query Show Query logscale `windows.EventID=5137 \| count()`	`Single Value`
Directory Service Moved	Hide Query Show Query logscale `windows.EventID=5139 \| count()`	`Single Value`
Directory Service Modified	Hide Query Show Query logscale `windows.EventID=5136 \| count()`	`Single Value`
Directory Service Recovered	Hide Query Show Query logscale `windows.EventID=5138 \| count()`	`Single Value`
Directory Service Deleted	Hide Query Show Query logscale `windows.EventID=5141 \| count()`	`Single Value`

Winlogbeat OSS - Active Directory Domain Services Audit - Details

Widget	Description	Type
Directory Service Created	Hide Query Show Query logscale `windows.EventID=5137 \| count()`	`Single Value`
AD DS - Modification Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5136 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Table`
AD DS - DS Deleted Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5141 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`
Directory Service Moved	Hide Query Show Query logscale `windows.EventID=5139 \| count()`	`Single Value`
AD DS - DS Recovered Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5138 // renames \|rename("host.hostname",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`
AD DS - DS Created Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5137 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`
Directory Service Modified	Hide Query Show Query logscale `windows.EventID=5136 \| count()`	`Single Value`
Directory Service Recovered	Hide Query Show Query logscale `windows.EventID=5138 \| count()`	`Single Value`
Directory Service Deleted	Hide Query Show Query logscale `windows.EventID=5141 \| count()`	`Single Value`
AD DS - DS Moved Details	Hide Query Show Query logscale // Base query to find directory services that meet the requirement windows.EventID=5139 // renames \|rename("@collect.host",as="Hostname")\|rename("event.action",as="Event Action")\|rename("winlog.event_data.DSName",as="Domain Name")\|rename("winlog.event_data.SubjectUserName", as="User Name")\| rename("winlog.event_data.SubjectUserSid", as="User SID")\| rename("host.ip", as="IP Address") // output in table format \|table([@timestamp,"Hostname", "Event Action","Domain Name","User Name","User SID","IP Address","event.outcome"])	`Event List`

Winlogbeat OSS - Device Info

Widget	Description	Type
Number of systems	Hide Query Show Query logscale `// New query for Winlogbeat and Humio Log Collector groupBy(field=[agent.id, @collect.id], function=count()) \|count() // Old query for just Winlogbeat // groupBy("agent.id")\|count()`	`Single Value`
Hosts transmitting events	Hide Query Show Query logscale `timechart(span=1h,function=count(field=host.id,distinct=true))`	`Time Chart`
Winlogbeat Versions	Hide Query Show Query logscale `agent.type="winlogbeat"\|groupBy(field="agent.version", function=count(field="host.id", distinct=true, as="Count"))`	`Table`
Operating System Count	Hide Query Show Query logscale `groupBy(field="host.os.name", function=count(field="host.id", distinct=true, as="Count"))`	`Table`
Winlogbeat Versions Pie Chart	Hide Query Show Query logscale `agent.type="winlogbeat"\|groupBy(field="agent.version", function=count(field="host.id", distinct=true, as="Count"))`	`Pie Chart`
Dashboard operational note	All widgets in this dashboard work if Winlogbeat OSS is using the processor to add host metadata to the events. Please see the sample configuration file in the Humio Windows Log Package Readme	`Note`

Winlogbeat OSS - Event Information

Widget Description Type

Events over time

Widget	Description	Type
Events over time	Hide Query Show Query logscale `timechart(windows.EventID, limit=10)`	`Time Chart`
Top 10 Event Types (Code)	Hide Query Show Query logscale `top(["windows.EventID"]) \| rename("_count",as="Count") \| rename("windows.EventID",as="Event ID") \| select(["Event ID","Count"])`	`Table`

Hide Query

Show Query

logscale

timechart(windows.EventID, limit=10)

Time Chart

Top 10 Event Types (Code)

Hide Query

Show Query

logscale

top(["windows.EventID"])
| rename("_count",as="Count")
| rename("windows.EventID",as="Event ID")
| select(["Event ID","Count"])

Table

Winlogbeat OSS - Event Log Clearing

Widget Description Type

Event Log Service Shutdown

Widget	Description	Type
Event Log Service Shutdown	Hide Query Show Query logscale `windows.EventID=1100 \| count()`	`Single Value`
Event Log Cleared	Hide Query Show Query logscale `windows.EventID=1102 \| count()`	`Single Value`

Hide Query

Show Query

logscale

windows.EventID=1100 | count()

Single Value

Event Log Cleared

Hide Query

Show Query

logscale

windows.EventID=1102 | count()

Single Value

Winlogbeat OSS - Remote Desktop Login Activity

Widget Description Type

Remote Desktop Login Events

Widget	Description	Type
Remote Desktop Login Events	Hide Query Show Query logscale `windows.EventID=4624 windows.EventData.LogonType=10 \|table(["@collect.host","windows.EventData.TargetUserName","windows.EventData.IpAddress",windows.EventData.TargetDomainName,@timestamp]) \|rename("@collect.host",as="Hostname") \|rename("windows.EventData.TargetUserName", as="User Name")\| rename("windows.EventData.IpAddress", as="Source IP Address")\| rename("windows.EventData.TargetDomainName", as="Target Domain")\|rename("@timestamp", as="Login Time")`	`Table`
Remote Desktop Login Count	Hide Query Show Query logscale `windows.EventID=4624 windows.EventData.LogonType=10 \| count()`	`Single Value`
Source Location	Hide Query Show Query logscale `windows.EventID=4624 windows.EventData.LogonType=10 \|worldmap(ip="windows.EventData.IpAddress")`	`World Map`

Hide Query

Show Query

logscale

windows.EventID=4624 windows.EventData.LogonType=10
|table(["@collect.host","windows.EventData.TargetUserName","windows.EventData.IpAddress",windows.EventData.TargetDomainName,@timestamp])
|rename("@collect.host",as="Hostname") |rename("windows.EventData.TargetUserName", as="User Name")| rename("windows.EventData.IpAddress", as="Source IP Address")| rename("windows.EventData.TargetDomainName", as="Target Domain")|rename("@timestamp", as="Login Time")

Table

Remote Desktop Login Count

Hide Query

Show Query

logscale

windows.EventID=4624 windows.EventData.LogonType=10 | count()

Single Value

Source Location

Hide Query

Show Query

logscale

windows.EventID=4624 windows.EventData.LogonType=10 |worldmap(ip="windows.EventData.IpAddress")

World Map

Winlogbeat OSS - User Activity

Widget	Description	Type
Failed Logons	Hide Query Show Query logscale `windows.EventID=4625 \| count()`	`Single Value`
Network User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=3 \| count()`	`Single Value`
Password Reset	Hide Query Show Query logscale `winlog.event_id = 4724 \| count()`	`Single Value`
Logon with Special Privileges	Hide Query Show Query logscale `windows.EventID=4672 \| count()`	`Single Value`
Logoff Event	Hide Query Show Query logscale `windows.EventID=4634 \| count()`	`Single Value`
User Account Disabled	Hide Query Show Query logscale `windows.EventID=4725 \| count()`	`Single Value`
Interactive User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=2 \|count()`	`Single Value`
New Credentials User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=9 \| count()`	`Single Value`
Account Login with Explicit Credentials	Hide Query Show Query logscale `windows.EventID=4648 \| count()`	`Single Value`
Batch User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=4 \| count()`	`Single Value`
Account Name Changed	Hide Query Show Query logscale `windows.EventID=4781 \| count()`	`Single Value`
End breakout		`Note`
Successful Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 \| count()`	`Single Value`
User Account Unlocked	Hide Query Show Query logscale `windows.EventID=4767 \| count()`	`Single Value`
Cached Interactive User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=11 \| count()`	`Single Value`
Remote Interactive User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=10 \| count()`	`Single Value`
New User Account Created	Hide Query Show Query logscale `windows.EventID=4720 \| count()`	`Single Value`
Account Lockouts	Hide Query Show Query logscale `windows.EventID=4740 \| count()`	`Single Value`
User Account Enabled	Hide Query Show Query logscale `windows.EventID=4722 \| count()`	`Single Value`
Successful logon by type	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 \| rename("windows.EventData.LogonType",as="Logon Type") \| groupBy("Logon Type", function=count()) \| sort("Logon Type", order=asc)`	`Table`
Service User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=5 \| count()`	`Single Value`
Unlock User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=7 \| count()`	`Single Value`
Network Clear Text User Logons	Hide Query Show Query logscale `// https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events windows.EventID=4624 windows.EventData.LogonType=8 \| count()`	`Single Value`
User Account Deleted	Hide Query Show Query logscale `windows.EventID=4726 \| count()`	`Single Value`
Below is the successful user logon breakout		`Note`

Integrations

Integrations

Packages

Other Integrations

Log Formats

microsoft/windows-logs Dashboards

Active Directory Domain Services Audit

Active Directory Domain Services Audit - Details

Event Information

Event Log Clearing

Remote Desktop Login Activity

User Activity

Winlogbeat OSS - Active Directory Domain Services Audit

Winlogbeat OSS - Active Directory Domain Services Audit - Details

Winlogbeat OSS - Device Info

Winlogbeat OSS - Event Information

Winlogbeat OSS - Event Log Clearing

Winlogbeat OSS - Remote Desktop Login Activity

Winlogbeat OSS - User Activity

Enter search term