Windows Event ID Lookup

4624 records a successful logon and 4625 records a failed logon. Both live in the Security channel and both include the account name, logon type, and source. Use 4624 to baseline who is signing in where (watch logon type 10 for RDP), and 4625 to detect authentication attacks.

Watch 4625 (failed logon), 4771 (Kerberos pre-authentication failed), and 4776 (NTLM credential validation failed) for guessing attempts, and 4740 (account locked out) for the lockout itself. The Caller Computer Name in 4740 points at the source of the bad attempts, which is often a stale cached credential or a misconfigured service rather than an attacker.

Correlate System-channel events: 6005 marks the Event Log service starting (a boot), 6006 marks a clean stop, and 6008 explicitly says the previous shutdown was unexpected. A missing 6006 before a 6005, plus Kernel-Power event 41, indicates a dirty shutdown from power loss, a hard hang, or a crash.

Service crashes appear as System events 7034 (terminated unexpectedly) and 7031 (terminated with a recovery action). 7000/7009/7011 cover start failures and timeouts. A new service install is 7045 (System) or 4697 (Security) — both are common persistence and lateral-movement signals worth alerting on.

High-value security IDs include 4625 (failed logon), 4720 (user created), 4726 (user deleted), 4732/4756 (added to a privileged group), 4672 (privileged logon), 4698 (scheduled task created), 4719 (audit policy changed), and 1102 (Security log cleared). The last two are strong anti-forensics signals and are almost never legitimate in production.

No. The entire reference dataset is bundled into the page and all search, filtering, and config generation happen in your browser. Nothing you type is sent to a server.

Select one or more events and copy the generated windows_event config block. Paste it into the log_searches array of an Alert24 server agent (the PowerShell agent reads Windows Event Logs via Get-WinEvent). The agent reports a match count on each heartbeat, and you add an alert rule such as log_match_count > 10 to get notified. Log-search monitoring is an Alert24 paid feature; the free plan includes 3 server agents.

Yes. Clicking an ID opens its detail panel and updates the URL with a ?id= parameter (for example ?id=4625), so you can bookmark or share a link that opens straight to that event.