Lot of event codes are missing

[julienlance]

Hello,

It seems that there's a lot of missing eventcodes in the EventCodes.csv lookup file, even in the last version of the app.
For instance, Event code between 4000 to 5000.
Why this file is not updated by Splunk and is there way to have to have an exhaustive file for our customers production environment ?

thanks for your help,

[damann]

I just downloaded the newest Splunk App for Windows Infrastructure (Version 2.0.0) and counted 251 Eventcodes in the range [4000,5000]

I compared them with https://www.ultimatewindowssecurity.com which is a good starting point if you are looking for some infos regarding the Event Codes and found 255 Eventcodes in the range [4000,5000]

Which Eventcodes you are missing?

[julienlance]

Hello Damann,

Thanks for your time.

For instance, in the last 24 hours :
4001,4013,4015,4016,4521

Others missing codes in another ranges :
134,404,407,408,2004,5774,5775,5781,6523,6527,6534,7050,7600,7681

Thanks !