Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Create account

Tool Path

Windows Event Logs

Investigate Windows from its own record. Learn the log channels and event structure, read authentication and identity events (4624/4625/4672/4740/4768/4769), follow account and system activity (4688/4720/4728/4732/7045/1102), and build an evidence-based timeline.

BeginnerWindows SecurityLog Analysis
Start this path

Curriculum

  1. 01

    Event Log Foundations

    Channels and providers, event structure, timestamps, and the user/host/context every event carries.

    Available
  2. 02

    Authentication & Identity

    Logon success/failure (4624/4625), privilege (4672), lockout (4740) and Kerberos (4768/4769/4771) — read in context, not as a list.

    Available
  3. 03

    System & Account Activity

    Process creation (4688), account creation (4720), group changes (4728/4732), service install (7045) and log clearing (1102).

    Available
  4. 04

    Investigation Workflow

    Turn events into a case: event → context → correlation → timeline → conclusion, then work a real multi-event investigation.

    Available

Related learning

SOC Analyst L1