Windows Events
Certificate Services received a certificate request
Event ID 4889
Security
Audit Certification Services
Main fields
IP address
IP
Windows
IP
ELK
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
User name
Requester
Windows
Requester
ELK
winlog.event_data.Requester
Important field
Attributes
Windows
Attributes
ELK
winlog.event_data.Attributes
Fields
| Windows Raw | Windows | ELK |
|---|---|---|
| RequestId | Request ID | winlog.event_data.RequestId |
| Requester | Requester | winlog.event_data.Requester |
| Attributes | Attributes | winlog.event_data.Attributes |
| Subject | Subject | winlog.event_data.Subject |
| SubjectAlternativeName | SubjectAlternativeName | winlog.event_data.SubjectAlternativeName |
| CertificateTemplate | Certificate Template | winlog.event_data.CertificateTemplate |
| RequestOSVersion | RequestOSVersion | - |
| RequestCSPProvider | RequestCSPProvider | - |
| RequestClientInfo | RequestClientInfo | - |
| AuthenticationService | Authentication Service | winlog.event_data.AuthenticationService |
| AuthenticationLevel | Authentication Level | winlog.event_data.AuthenticationLevel |
| DCOMorRPC | DCOMorRPC | winlog.event_data.DCOMorRPC |
| IP System field | IP System field | - |
| Computer System field | Computer System field | winlog.computer_name |
| ProcessPID System field | ProcessPID System field | winlog.process.pid |
| ThreadID System field | ThreadID System field | winlog.process.thread.id |
Sample Event
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4886</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>12805</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-02T14:45:56.4067638Z" />
<EventRecordID>26400</EventRecordID>
<Correlation ActivityID="{fdc2cf05-1dec-0001-ebcf-c2fdec1ddd01}" />
<Execution ProcessID="832" ThreadID="896" />
<Channel>Security</Channel>
<Computer>ADCS.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="RequestId">16</Data>
<Data Name="Requester">SOCPEDIA\GHOSTPYUVHAOB$</Data>
<Data Name="Attributes">CertificateTemplate:Machine SAN:dns=DC.socpedia.net cdc:192.168.0.237 rmd:DC.socpedia.net</Data>
<Data Name="Subject">CN=GHOSTPYUVHAOB.socpedia.net</Data>
<Data Name="SubjectAlternativeName">DNS Name=DC.socpedia.net</Data>
<Data Name="CertificateTemplate">Machine</Data>
<Data Name="RequestOSVersion" />
<Data Name="RequestCSPProvider" />
<Data Name="RequestClientInfo" />
<Data Name="AuthenticationService">NTLM</Data>
<Data Name="AuthenticationLevel">Privacy</Data>
<Data Name="DCOMorRPC">RPC</Data>
</EventData>
</Event>