Windows Events
NTLM server blocked audit: Audit Incoming NTLM Traffic that would be blocked
Network security: Restrict NTLM: Audit Incoming NTLM Traffic
Event ID 8002
Microsoft-Windows-NTLM/Operational
Network security: Restrict NTLM: Audit Incoming NTLM Traffic
Main fields
IP address
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
User name
ClientUserName
Windows
Calling process user identity
ELK
winlog.event_data.ClientUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Important field
ProcessName
Windows
Calling process name
ELK
winlog.event_data.ProcessName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Fields
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| ProcessName | Calling process name | winlog.event_data.ProcessName | - | - | - |
| CallerPID | PID | winlog.event_data.CallerPID | - | - | - |
| ClientUserName | Calling process user identity | winlog.event_data.ClientUserName | - | - | - |
| ClientDomainName | Calling process domain identity | winlog.event_data.ClientDomainName | - | - | - |
| MechanismOID | Mechanism | winlog.event_data.MechanismOID | - | - | - |
| IP System field | IP System field | - | - | - | - |
| Computer System field | Computer System field | winlog.computer_name | - | - | - |
| ProcessID System field | ProcessID System field | winlog.process.pid | - | - | - |
| ThreadID System field | ThreadID System field | winlog.process.thread.id | - | - | - |
Sample Event
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-NTLM" Guid="{ac43300d-5fcc-4800-8e99-1bd3f85f0320}" />
<EventID>8002</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>2</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2026-08-03T10:30:55.3405399Z" />
<EventRecordID>1195</EventRecordID>
<Correlation ActivityID="{fdc2cf05-1dec-0001-ebcf-c2fdec1ddd01}" />
<Execution ProcessID="832" ThreadID="896" />
<Channel>Microsoft-Windows-NTLM/Operational</Channel>
<Computer>ADCS.socpedia.net</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="CallerPID">6396</Data>
<Data Name="ProcessName">C:\Windows\System32\certsrv.exe</Data>
<Data Name="ClientLUID">0x3e7</Data>
<Data Name="ClientUserName">ADCS$</Data>
<Data Name="ClientDomainName">SOCPEDIA</Data>
<Data Name="MechanismOID">(NULL)</Data>
</EventData>
</Event>