Main fields
IP address
IP
Windows
IP
ELK
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
User name
TargetUserName
Windows
New Logon: Account Name
ELK
winlog.event_data.TargetUserName
Important field
GroupMembership
Windows
GroupMembership
ELK
winlog.event_data.GroupMembership
Fields
| Windows Raw | Windows | ELK |
|---|---|---|
| SubjectUserSid | Subject: Security ID | winlog.event_data.SubjectUserSid |
| SubjectUserName | Subject: Account Name | winlog.event_data.SubjectUserName |
| SubjectDomainName | Subject: Account Domain | winlog.event_data.SubjectDomainName |
| SubjectLogonId | Subject: Logon ID | winlog.event_data.SubjectLogonId |
| LogonType | Logon Type | winlog.event_data.LogonType |
| TargetUserSid | New Logon: Security ID | winlog.event_data.TargetUserSid |
| TargetUserName | New Logon: Account Name | winlog.event_data.TargetUserName |
| TargetDomainName | New Logon: Account Domain | winlog.event_data.TargetDomainName |
| TargetLogonId | New Logon: Logon ID | winlog.event_data.TargetLogonId |
| GroupMembership | GroupMembership | winlog.event_data.GroupMembership |
| IP System field | IP System field | - |
| Computer System field | Computer System field | winlog.computer_name |
| ProcessPID System field | ProcessPID System field | winlog.process.pid |
| ThreadID System field | ThreadID System field | winlog.process.thread.id |
Sample Event
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4627</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12554</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-03T13:05:36.6867938Z" />
<EventRecordID>178605</EventRecordID>
<Correlation />
<Execution ProcessID="848" ThreadID="5368" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-0-0</Data>
<Data Name="SubjectUserName">-</Data>
<Data Name="SubjectDomainName">-</Data>
<Data Name="SubjectLogonId">0x0</Data>
<Data Name="TargetUserSid">S-1-5-21-1838030176-2987033226-1986555923-1104</Data>
<Data Name="TargetUserName">cs_admin</Data>
<Data Name="TargetDomainName">SOCPEDIA.NET</Data>
<Data Name="TargetLogonId">0xdeaf5b3</Data>
<Data Name="LogonType">3</Data>
<Data Name="EventIdx">1</Data>
<Data Name="EventCountTotal">1</Data>
<Data Name="GroupMembership">%{S-1-5-21-1838030176-2987033226-1986555923-513} %{S-1-1-0} %{S-1-5-32-545} %{S-1-5-32-554} %{S-1-5-32-544} %{S-1-5-2} %{S-1-5-11} %{S-1-5-15} %{S-1-5-21-1838030176-2987033226-1986555923-512} %{S-1-5-21-1838030176-2987033226-1986555923-519} %{S-1-18-1} %{S-1-5-21-1838030176-2987033226-1986555923-572} %{S-1-16-12288}</Data>
</EventData>
</Event>