Windows Event Logs

Summary

Windows records detailed logs of system, security and application events — knowing which event IDs matter (failed logins, process creation) is essential for both investigation and threat hunting.

• 1Explore Windows Event Viewer on a practice VM and identify security-relevant event logs.
• 2Learn a few high-value event IDs (like 4625 for failed logon) and what they indicate.
• 3Practice filtering logs for a specific event type or time range.