TOP Windows Event IDs for SOC Analysts
This list is industry standard and used in real-world
detection engineering.
1. Authentication & Account Logon Events
These events help detect brute force, credential theft,
lateral movement, privilege escalation .
Logon Events (Event Log: Security)
Event
ID
Meaning
Why Important
4624
Successful logon
Baseline user behavior,
detect unusual sources
4625
Failed logon
Brute-force attempts,
password-spraying
4634
Logoff
Helps correlate sessions
4647
User initiated
logoff
Normal logout behavior
