Windows оқиғалары
Certificate Services approved a certificate request and issued a certificate
Сертификат қызметтері сертификатқа сұранысты мақұлдап, сертификатты берді
AI
Event ID 4887
Security
Audit Certification Services
Негізгі өрістер
IP мекенжайы
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Компьютер атауы
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Пайдаланушы аты
Requester
Windows
Requester
ELK
winlog.event_data.Requester
Microsoft Sentinel
-
QRadar
-
Splunk
-
Маңызды өріс
Attributes
Windows
Attributes
ELK
winlog.event_data.Attributes
Microsoft Sentinel
-
QRadar
-
Splunk
-
Өрістер
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| RequestId | Request ID | winlog.event_data.RequestId | - | - | - |
| Requester | Requester | winlog.event_data.Requester | - | - | - |
| Attributes | Attributes | winlog.event_data.Attributes | - | - | - |
| Subject | Certificate Subject | winlog.event_data.Subject | - | - | - |
| SubjectAlternativeName | Certificate SAN | winlog.event_data.SubjectAlternativeName | - | - | - |
| CertificateTemplate | Certificate Template | winlog.event_data.CertificateTemplate | - | - | - |
| CertSerialNumber | Certificate Information: Certificate Serial Number | winlog.event_data.CertSerialNumber | - | - | - |
| AuthenticationService | Authentication Service | winlog.event_data.AuthenticationService | - | - | - |
| AuthenticationLevel | Authentication Level | winlog.event_data.AuthenticationLevel | - | - | - |
| DCOMorRPC | DCOMorRPC | winlog.event_data.DCOMorRPC | - | - | - |
| IP Жүйелік өріс | IP Жүйелік өріс | - | - | - | - |
| Computer Жүйелік өріс | Computer Жүйелік өріс | winlog.computer_name | - | - | - |
| ProcessID Жүйелік өріс | ProcessID Жүйелік өріс | winlog.process.pid | - | - | - |
| ThreadID Жүйелік өріс | ThreadID Жүйелік өріс | winlog.process.thread.id | - | - | - |
Оқиға мысалы
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4887</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>12805</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-09T16:38:41.0487707Z" />
<EventRecordID>55811</EventRecordID>
<Correlation ActivityID="{9c10d5c3-25ba-0001-43d6-109cba25dd01}" />
<Execution ProcessID="860" ThreadID="972" />
<Channel>Security</Channel>
<Computer>ADCS.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="RequestId">21</Data>
<Data Name="Requester">SOCPEDIA\GHOSTXEFXPJMO$</Data>
<Data Name="Attributes">CertificateTemplate:Machine SAN:dns=DC.socpedia.net cdc:192.168.0.237 rmd:DC.socpedia.net</Data>
<Data Name="Disposition">3</Data>
<Data Name="SubjectKeyIdentifier">89 88 1f 56 a0 2a 7b 45 64 c6 02 56 4a bc 70 d6 72 17 ac 48</Data>
<Data Name="Subject">CN=DC.socpedia.net</Data>
<Data Name="SubjectAlternativeName">DNS Name=DC.socpedia.net</Data>
<Data Name="CertificateTemplate">Machine</Data>
<Data Name="SerialNumber">3d00000015d22f89fbf462a036000000000015</Data>
<Data Name="AuthenticationService">NTLM</Data>
<Data Name="AuthenticationLevel">Privacy</Data>
<Data Name="DCOMorRPC">RPC</Data>
</EventData>
</Event>