topic Re: Lot of event codes are missing in All Apps and Add-ons

Lot of event codes are missing

julienlance — Mon, 20 Jan 2020 10:54:05 GMT

Hello,

It seems that there's a lot of missing eventcodes in the EventCodes.csv lookup file, even in the last version of the app.
For instance, Event code between 4000 to 5000.
Why this file is not updated by Splunk and is there way to have to have an exhaustive file for our customers production environment ?

thanks for your help,

Re: Lot of event codes are missing

damann — Mon, 20 Jan 2020 13:44:16 GMT

I just downloaded the newest Splunk App for Windows Infrastructure (Version 2.0.0) and counted 251 Eventcodes in the range [4000,5000]

I compared them with https://www.ultimatewindowssecurity.com which is a good starting point if you are looking for some infos regarding the Event Codes and found 255 Eventcodes in the range [4000,5000]

Which Eventcodes you are missing?

Re: Lot of event codes are missing

julienlance — Mon, 20 Jan 2020 14:09:59 GMT

Hello Damann,

Thanks for your time.

For instance, in the last 24 hours :
4001,4013,4015,4016,4521

Others missing codes in another ranges :
134,404,407,408,2004,5774,5775,5781,6523,6527,6534,7050,7600,7681

Thanks !