Windows Event Log¶
The Event Log source reads selected records from 19 Windows event channels.
FreeDR does not read whole channels. Each channel subscription asks only for
the provider and event ID pairs in FreeDR's catalog. The catalog has 128
native events, which map to 124 FreeDR event_type names.
| Windows mechanism | EvtQuery strict pull subscriptions with EvtNext, one per channel. The query is an XPath of (Provider[@Name='…'] and EventID=…) terms. Large channels use a <QueryList>. |
| Position tracking | One Event Log bookmark per channel, stored in the evidence database checkpoint table and committed with the rows |
| Hunt | events view (shared columns) and the event_log relation (all named Windows fields as columns) |
| Rule SQL source name | windows_event_log |
| Hot table | windows_event_log_v2 |
| Code | crates/freedr-collect-eventlog (catalog, decoder), crates/freedr-agent/src/eventlog_component.rs (runtime) |
Subscribed channels and events¶
Events are grouped by channel. Each event_type value is shown exactly as
stored.
Security¶
Provider Microsoft-Windows-Security-Auditing, except where noted. Many of
these events appear only after you enable the audit policy. Settings ›
Sources can enable it (see Prerequisites).
| ID | event_type | Meaning |
|---|---|---|
1102 (provider Microsoft-Windows-Eventlog) |
event_log.security.audit_log_cleared |
Security log cleared |
| 4608 | event_log.security.subsystem_started |
Security subsystem (LSA) started |
| 4609 | event_log.security.subsystem_stopped |
Security subsystem stopped |
| 4616 | event_log.security.system_time_changed |
System time changed |
| 4624 | event_log.security.logon_success |
Successful logon |
| 4625 | event_log.security.logon_failure |
Failed logon |
| 4634 | event_log.security.session_ended |
Logon session ended |
| 4647 | event_log.security.user_logoff |
User-initiated logoff |
| 4648 | event_log.security.explicit_credentials |
Logon with explicit credentials |
| 4672 | event_log.security.special_privileges |
Logon with special (administrative) privileges |
| 4698 | event_log.task.audit_created |
Scheduled task created |
| 4699 | event_log.task.audit_deleted |
Scheduled task deleted |
| 4700 | event_log.task.audit_enabled |
Scheduled task enabled |
| 4701 | event_log.task.audit_disabled |
Scheduled task disabled |
| 4702 | event_log.task.audit_updated |
Scheduled task updated |
| 4719 | event_log.security.audit_policy_changed |
System audit policy changed |
| 4720 | event_log.security.account_created |
User account created |
| 4722 | event_log.security.account_enabled |
User account enabled |
| 4723 | event_log.security.password_change_attempt |
Password change attempt |
| 4724 | event_log.security.password_reset_attempt |
Password reset attempt |
| 4725 | event_log.security.account_disabled |
User account disabled |
| 4726 | event_log.security.account_deleted |
User account deleted |
| 4728 | event_log.security.global_group_member_added |
Member added to a global security group |
| 4732 | event_log.security.local_group_member_added |
Member added to a local security group |
| 4738 | event_log.security.account_changed |
User account changed |
| 4740 | event_log.security.account_locked |
User account locked out |
| 4756 | event_log.security.universal_group_member_added |
Member added to a universal security group |
| 4767 | event_log.security.account_unlocked |
User account unlocked |
| 4781 | event_log.security.account_renamed |
Account name changed |
| 4946 | event_log.firewall.rule_added |
Firewall rule added (audit) |
| 4947 | event_log.firewall.rule_changed |
Firewall rule changed (audit) |
| 4948 | event_log.firewall.rule_deleted |
Firewall rule deleted (audit) |
Security 4688 (process creation) is not collected. FreeDR records process starts and command lines from kernel process ETW.
System¶
| ID | Provider | event_type |
|---|---|---|
| 104 | Microsoft-Windows-Eventlog |
event_log.system.log_cleared |
| 12 | Microsoft-Windows-Kernel-General |
event_log.system.os_started |
| 13 | Microsoft-Windows-Kernel-General |
event_log.system.os_stopped |
| 41 | Microsoft-Windows-Kernel-Power |
event_log.system.unclean_reboot |
| 1074 | User32 |
event_log.system.planned_shutdown |
| 6005 | EventLog |
event_log.system.event_service_started |
| 6006 | EventLog |
event_log.system.event_service_stopped |
| 6008 | EventLog |
event_log.system.unexpected_shutdown |
| 7045 | Service Control Manager |
event_log.service.installed |
| 7040 | Service Control Manager |
event_log.service.start_mode_changed |
| 7036 | Service Control Manager |
event_log.service.state_changed |
Microsoft-Windows-Windows Defender/Operational¶
Provider Microsoft-Windows-Windows Defender.
| ID | event_type |
|---|---|
| 1116 | event_log.defender.detected |
| 1117 | event_log.defender.action_taken |
| 1118 | event_log.defender.action_failed |
| 1119 | event_log.defender.action_critical_failure |
| 1121 | event_log.defender.asr_blocked |
| 1122 | event_log.defender.asr_audited |
| 1123 | event_log.defender.controlled_folder_access_blocked |
| 1124 | event_log.defender.controlled_folder_access_audited |
| 5001 | event_log.defender.protection_changed_5001 |
| 5004 | event_log.defender.rtp_feature_configured |
| 5007 | event_log.defender.configuration_changed |
| 5010 | event_log.defender.protection_changed_5010 |
| 5012 | event_log.defender.protection_changed_5012 |
| 5013 | event_log.defender.tamper_protection_blocked |
Microsoft-Windows-AppLocker/EXE and DLL¶
| ID | event_type | Note |
|---|---|---|
| 8003 | event_log.applocker.exe_dll_audited |
Audit mode: the file would have been blocked |
| 8004 | event_log.applocker.exe_dll_blocked |
Enforced block |
AppLocker is available only on Pro, Enterprise and Education editions.
Microsoft-Windows-CodeIntegrity/Operational¶
| ID | event_type |
|---|---|
| 3033 | event_log.code_integrity.signing_level_unmet |
| 3077 | event_log.code_integrity.policy_blocked |
| 3089 | event_log.code_integrity.signature_information |
Microsoft-Windows-TaskScheduler/Operational¶
| ID | event_type |
|---|---|
| 106 | event_log.task.registered |
| 140 | event_log.task.updated |
| 141 | event_log.task.deleted |
| 200 | event_log.task.action_started |
| 201 | event_log.task.action_completed |
PowerShell¶
| Channel | Provider | ID | event_type |
|---|---|---|---|
Microsoft-Windows-PowerShell/Operational |
Microsoft-Windows-PowerShell |
4104 | event_log.powershell.script_block |
Windows PowerShell |
PowerShell |
400 | event_log.powershell.engine_started |
Windows PowerShell |
PowerShell |
403 | event_log.powershell.engine_stopped |
Windows PowerShell |
PowerShell |
600 | event_log.powershell.provider_state |
The PowerShell/Operational query selects only 4104 (script block text).
Remote access: RDP, WinRM, WMI¶
| Channel | ID | event_type |
|---|---|---|
Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational |
1149 | event_log.rdp.authentication |
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational |
21 | event_log.rdp.session_logon |
| same | 22 | event_log.rdp.shell_started |
| same | 23 | event_log.rdp.session_logoff |
| same | 24 | event_log.rdp.session_disconnected |
| same | 25 | event_log.rdp.session_reconnected |
Microsoft-Windows-TerminalServices-RDPClient/Operational (provider Microsoft-Windows-TerminalServices-ClientActiveXCore) |
1024 | event_log.rdp.client_destination_1024 |
| same | 1102 | event_log.rdp.client_destination_1102 |
Microsoft-Windows-WinRM/Operational |
6 | event_log.winrm.connection |
| same | 91 | event_log.winrm.resource |
Microsoft-Windows-WMI-Activity/Operational |
5861 | event_log.wmi.subscription_activity |
Windows Firewall¶
Channel Microsoft-Windows-Windows Firewall With Advanced Security/Firewall.
The Security channel events 4946–4948 map to the same three types.
| ID | event_type |
|---|---|
| 2004 | event_log.firewall.rule_added |
| 2097 | event_log.firewall.rule_added |
| 2005 | event_log.firewall.rule_changed |
| 2006 | event_log.firewall.rule_deleted |
Software install, crashes, BITS, devices, virtual disks¶
| Channel | Provider | ID | event_type |
|---|---|---|---|
Application |
MsiInstaller |
1033 | event_log.msi.installation_status |
Application |
MsiInstaller |
1034 | event_log.msi.removal_status |
Application |
MsiInstaller |
11707 | event_log.msi.installation_succeeded |
Application |
MsiInstaller |
11724 | event_log.msi.removal_succeeded |
Application |
Application Error |
1000 | event_log.application.crash |
Application |
Windows Error Reporting |
1001 | event_log.application.error_report |
Microsoft-Windows-Bits-Client/Operational |
Microsoft-Windows-Bits-Client |
3 | event_log.bits.job_created |
| same | same | 59 | event_log.bits.transfer_started |
| same | same | 60 | event_log.bits.transfer_completed |
Microsoft-Windows-Kernel-PnP/Configuration |
Microsoft-Windows-Kernel-PnP |
400 | event_log.kernel_pnp.device_configured |
| same | same | 410 | event_log.kernel_pnp.device_started |
Microsoft-Windows-VHDMP-Operational |
Microsoft-Windows-VHDMP |
12 | event_log.vhdmp.virtual_disk_opened |
Sysmon¶
Channel Microsoft-Windows-Sysmon/Operational, event IDs 1–29 and 255.
For the full mapping, see Sysmon.
Prerequisites (Settings › Sources)¶
Some channels and audit categories are off by default in Windows. In that case FreeDR subscribes but receives nothing. Settings › Sources shows each setting, whether the expected events have arrived recently, and lets you switch the setting on:
| Setting | Windows setting changed | Enables |
|---|---|---|
| Sysmon | Installs Sysmon if missing | Sysmon channel |
| PowerShell script block logging | HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging = 1 |
4104 |
| Audit Security Group Management | Audit subcategory | 4728, 4732, 4756 |
| Audit Other Object Access Events | Audit subcategory | 4698–4702 |
| Audit MPSSVC Rule-Level Policy Change | Audit subcategory | 4946–4948 |
| Audit Logon (success and failure) | Audit subcategory | 4624, 4625, 4648 |
| Audit Special Logon | Audit subcategory | 4672 |
| Audit Audit Policy Change | Audit subcategory | 4719 |
| Audit Process Creation and include command line | Audit subcategory and policy DWORD | Security 4688. This is shown, but FreeDR does not collect 4688. |
| Event channels: Firewall, TaskScheduler, CodeIntegrity, AppLocker (not on Home), Kernel-PnP, VHDMP, Defender | Channel Enabled |
Those channels |
| Defender real-time protection, Tamper Protection | Status display | n/a |
When Windows telemetry is weakened from the console, FreeDR raises the self-alert
rule freedr.self.telemetry-source-weakened.
Fields¶
| Where | What you get |
|---|---|
events relation |
The common columns (event_id, event_type, occurred_at, written_at, actor_*) plus task_name, task_content, task_action, task_result_code, event_payload. For 4104 only, it also has pid, user_sid and script_block_text. |
event_log relation |
Every events column plus every named field of every catalog layout as its own nullable column (about 230). Examples: threat_name, detection_guid, process_path (Defender); service_name, image_path, account (7045); target_user, logon_type, source_ip (4624); cleared_log (104). A column is NULL for event types without that field. SELECT * exceeds the 64-column result limit, so name the columns you need. |
event_payload |
A list of v1:<kind>:<len>:<name><value> entries for pack members, sections and any unrecognised fields. Sysmon fields live only here. They use lower-cased names such as image, targetimage, destinationip and queryname. Sysmon has no named columns. |
actor_* columns |
When the layout names an acting process ID (for example 4624 process_id, Sysmon process_id / source_process_id, Sysmon 1 parent_process_id, 4104 system_process_id), FreeDR attaches that process's image, command line, start time and user from its process history. |
Notes:
- No rendered message text or raw XML is stored. Some fields that are proven
not to be evidence are dropped, for example
dummy,unused*, WER store paths, and firewallschemaversion. - 4104 script blocks are stored one row per fragment and are not reassembled.
- Limits per event: text 256 KiB in total, blobs 64 KiB, lists 1,024 items.
A larger event fails to decode and is counted in
decode_failures. event_idis a UUIDv5 of channel, record ID and time, so a record that is delivered again deduplicates.- Physically, rows are stored as numbered slots (
u64_01..12,text_01..12,blob_01..04,text_list_01). A per-layout slot map names those slots. Useevent_lograther than the raw slots.
Not collected: Security 4688, PowerShell 4103 module logging, the PowerShell 7 channel, AMSI, and any event history from before FreeDR was installed.
Reliability and noise controls¶
| Behaviour | Detail |
|---|---|
| First start | A channel with no stored position starts after its newest matching record. Earlier history is not imported. If the channel had no matching record, it later reads from the oldest record. |
| Restart | Each channel resumes after its committed bookmark, so events written while FreeDR was stopped are read. |
| Log cleared or wrapped | If the bookmarked record is gone at startup, Security and System replay from their oldest record, because the clear event (1102/104) is the first record afterwards. Other channels continue with new events. Either case counts one coverage_gaps and one bookmark_resets. |
| Read overrun | A channel overrun while open continues with new events and counts a coverage gap. |
| Channel failures | Only the failing channel is closed. It reopens with backoff from 250 ms doubling to 30 s. Startup fails only if Security or every channel fails to open. |
| Channel not installed | This counts as unavailable_channels and is retried every 10 minutes. It does not mark health degraded. For example, Sysmon may be absent. |
| Batch commits | Each read takes at most 256 events or 2 MiB of XML per channel. Rows commit in batches of ≤ 256, each checkpointed at its last record in the same transaction. If the store refuses a batch permanently, rows commit one by one and only refused rows are skipped (rejected, coverage_gaps). |
| Unknown actor | A row whose acting process is not known yet is held for one commit cycle (about 1 s; at most 1,024 rows / 8 MiB) and looked up again. The bookmark does not advance past held rows. |
| Malformed records | These are skipped and counted in decode_failures. The bookmark still advances. |
| Self-exclusion | On the Sysmon channel only, events whose acting process is FreeDR are dropped (own_events_excluded). Events where FreeDR is only the target are kept. |
| Query-level filtering | Only catalog provider and event ID pairs are read from each channel. |
Health counters¶
batches, received, decoded, committed, inserted, duplicates,
checkpoint_restores, subscription_failures, decode_failures,
own_events_excluded, commit_failures, rejected, checkpoint_conflicts,
coverage_gaps, bookmark_resets, replays, actor_deferred,
actor_resolved_on_retry, actor_unresolved_committed,
actor_deferral_overflow. Gauges: configured_channels (19),
closed_channels, unavailable_channels, and
powershell_script_block_logging (1/0, read once at start). The collector is degraded while a channel is closed and waiting to
reopen, or while a commit is being retried. Lifetime failure counters alone do
not keep it degraded. See Storage & health.