Getting Data In

Where can I find an explanation of the Windows Event codes?

efranklin
Engager

I'm new to Splunk and could use some help with Windows Event Codes. Where can I find an explanation of the Windows Event codes? I have several reports that show audit failure based on an event code, but I have no explanation of what the event is for. Thanks in Advance

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Google is your best friend in cases like this. Searching for "windows eventCode 5152" brings up many useful-looking resources. I found this site quite helpful https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Google is your best friend in cases like this. Searching for "windows eventCode 5152" brings up many useful-looking resources. I found this site quite helpful https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx

---
If this reply helps you, Karma would be appreciated.

efranklin
Engager

Big help. Thank you so much.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@efranklin - Did the answer provided by richgalloway help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". Thank you.

efranklin
Engager

I believe this is what I have been looking for. I have searched Goggle, but didn't stumble onto this. Thanks you so much, you have saved me hours of further searching!!

0 Karma

efranklin
Engager

Hi,
Thanks for responding. I am attaching a screen shot of the results I got for a search I have for Audit Failure. I created the report to search on the keyword Audit Failure. The results I get has a list of Event Codes where the word Audit Failure appears; however, I don't have an explanation of what each Event Code represents.

![alt text][1]

0 Karma

adonio
Ultra Champion

i use this website for windows event codes:
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5152
i find it pretty good
hope it helps

0 Karma

cmerriman
Super Champion

do you have an example of the failure text?
i found this about event codes, but i can't find much else. I want to make sure we're talking about the same thing.
http://docs.splunk.com/Documentation/Splunk/6.3.10/Data/MonitorfilesystemchangesonWindows

0 Karma

efranklin
Engager

Not sure if you received my response. I am attaching a screen shot of the results of my search I created for the keyword Audit Failure. My search has a series of codes i.e., 5152, 5157, 4656, 4625, 4653, etc. Each one of these Event codes appear as a link within the search, when I click on the link, I am not getting an explanation as to what the event code represents.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...