События Windows
Network connection
Сетевое соединение
AI
Event ID 3
Microsoft-Windows-Sysmon/Operational
Sysmon/Network connection
Основные поля
IP-адрес
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя компьютера
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя пользователя
Не выбрано
Важное поле
SourceIp
Windows
SourceIp
ELK
winlog.event_data.SourceIp
Microsoft Sentinel
-
QRadar
-
Splunk
-
Поля
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| DestinationHostname | DestinationHostname | winlog.event_data.DestinationHostname | - | - | - |
| DestinationIp | DestinationIp | winlog.event_data.DestinationIp | - | - | - |
| DestinationIsIpv6 | DestinationIsIpv6 | winlog.event_data.DestinationIsIpv6 | - | - | - |
| DestinationPort | DestinationPort | winlog.event_data.DestinationPort | - | - | - |
| DestinationPortName | DestinationPortName | winlog.event_data.DestinationPortName | - | - | - |
| Image | Image | winlog.event_data.Image | - | - | - |
| Initiated | Initiated | winlog.event_data.Initiated | - | - | - |
| ProcessGuid | ProcessGuid | winlog.event_data.ProcessGuid | - | - | - |
| ProcessId | ProcessId | winlog.event_data.ProcessId | - | - | - |
| Protocol | Protocol | winlog.event_data.Protocol | - | - | - |
| RuleName | RuleName | winlog.event_data.RuleName | - | - | - |
| SourceHostname | SourceHostname | winlog.event_data.SourceHostname | - | - | - |
| SourceIp | SourceIp | winlog.event_data.SourceIp | - | - | - |
| SourceIsIpv6 | SourceIsIpv6 | winlog.event_data.SourceIsIpv6 | - | - | - |
| SourcePort | SourcePort | winlog.event_data.SourcePort | - | - | - |
| SourcePortName | SourcePortName | winlog.event_data.SourcePortName | - | - | - |
| User | User | winlog.event_data.User | - | - | - |
| UtcTime | UtcTime | winlog.event_data.UtcTime | - | - | - |
| IP Системное поле | IP Системное поле | - | - | - | - |
| Computer Системное поле | Computer Системное поле | winlog.computer_name | - | - | - |
| ProcessID Системное поле | ProcessID Системное поле | winlog.process.pid | - | - | - |
| ThreadID Системное поле | ThreadID Системное поле | winlog.process.thread.id | - | - | - |
Пример события
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" />
<EventID>3</EventID>
<Version>5</Version>
<Level>4</Level>
<Task>3</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2026-08-02T14:46:12.4403984Z" />
<EventRecordID>97782</EventRecordID>
<Correlation />
<Execution ProcessID="3024" ThreadID="5432" />
<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
<Computer>DC.socpedia.net</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="RuleName">v1-0_eventID3</Data>
<Data Name="UtcTime">2026-08-02 14:46:11.417</Data>
<Data Name="ProcessGuid">{d062d9b1-8c7c-6a67-eb03-000000000000}</Data>
<Data Name="ProcessId">4</Data>
<Data Name="Image">System</Data>
<Data Name="User">NT AUTHORITY\SYSTEM</Data>
<Data Name="Protocol">tcp</Data>
<Data Name="Initiated">false</Data>
<Data Name="SourceIsIpv6">false</Data>
<Data Name="SourceIp">192.168.0.237</Data>
<Data Name="SourceHostname">-</Data>
<Data Name="SourcePort">45746</Data>
<Data Name="SourcePortName">-</Data>
<Data Name="DestinationIsIpv6">false</Data>
<Data Name="DestinationIp">192.168.0.210</Data>
<Data Name="DestinationHostname">DC.socpedia.net</Data>
<Data Name="DestinationPort">445</Data>
<Data Name="DestinationPortName">microsoft-ds</Data>
</EventData>
</Event>