AD FS Auditing

25 events across 1 channel

Event	Title	Channel	Sample
299	Event ID 299	Security	Y
307	Event ID 307	Security	Y
309	Event ID 309	Security	Y
324	Event ID 324	Security	Y
403	Event ID 403	Security	Y
404	Event ID 404	Security	Y
410	Event ID 410	Security	Y
411	Event ID 411	Security	Y
412	Event ID 412	Security	Y
413	Event ID 413	Security	Y
431	Event ID 431	Security	Y
500	Event ID 500	Security	Y
501	Event ID 501	Security	Y
510	Event ID 510	Security	Y
1026	Event ID 1026	Security	Y
1030	Event ID 1030	Security	Y
1034	Event ID 1034	Security	Y
1090	Event ID 1090	Security	Y
1122	Event ID 1122	Security	Y
1126	Event ID 1126	Security	Y
1200	Event ID 1200	Security	Y
1201	Event ID 1201	Security	Y
1202	Event ID 1202	Security	Y
1203	Event ID 1203	Security	Y
1206	Event ID 1206	Security	Y

Event ID 299

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 299,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632717,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "dfe08855-560f-41ef-aece-7943c7ce16a4",
    "Data_1": "ed63d0a9-7eb6-4970-a801-522c0914427d",
    "Data_2": "https://testrp4.example.com/claims",
    "Binary": ""
  },
  "message": ""
}

Event ID 307

Provider: AD FS Auditing
Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 307,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:04:29.340795+00:00",
    "event_record_id": 16606140,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 7996
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "c914da25-f07c-47a3-9e7b-d6e78d43f334",
    "Data_1": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_2": "ludus\\domainadmin",
    "Binary": ""
  },
  "message": ""
}

Event ID 309

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 309,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:03:42.728019+00:00",
    "event_record_id": 16595119,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Data_0": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_1": "ludus\\domainadmin",
    "Data_2": "    ConfigurationServiceAddress : net.tcp://localhost:1500/policy\r\n    ConfigurationDatabaseConnectionString : \r\n    ChannelMaxMessageSizeInBytes : 0\r\n",
    "Data_3": "    ConfigurationServiceAddress : net.tcp://localhost:1500/policy\r\n    ConfigurationDatabaseConnectionString : Data Source=np:\\\\.\\pipe\\microsoft##wid\\tsql\\query;Initial Catalog=AdfsConfigurationV4;Integrated Security=True\r\n    ChannelMaxMessageSizeInBytes : 20971520\r\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 324

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 324,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:37.247311+00:00",
    "event_record_id": 16621764,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "06aae50c-7a71-4208-a1b5-e4bd41408c7f",
    "Data_1": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_2": "ludus\\domainadmin\r\n",
    "Data_3": "https://testrp1.example.com/saml",
    "Binary": ""
  },
  "message": ""
}

Event ID 403

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 403,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.480193+00:00",
    "event_record_id": 16621720,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "d97c5901-104e-4ce1-a4f7-db055d721953",
    "Data_1": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_2": "2026-03-13 23:07:36",
    "Data_3": "10.2.10.11",
    "Data_4": "GET",
    "Data_5": "/adfs/.well-known/openid-configuration",
    "Data_6": "-",
    "Data_7": "443",
    "Data_8": "10.2.10.11",
    "Data_9": "-",
    "Data_10": "0",
    "Data_11": "-",
    "Data_12": "-",
    "Data_13": "-",
    "Data_14": "False",
    "Data_15": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 404

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 404,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.570719+00:00",
    "event_record_id": 16621723,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "11a30859-37ab-4075-9ee9-df451c9ccf38",
    "Data_1": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_2": "2026-03-13 23:07:36",
    "Data_3": "200",
    "Data_4": "OK",
    "Binary": ""
  },
  "message": ""
}

Event ID 410

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 410,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.495811+00:00",
    "event_record_id": 16621722,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "015df8f6-5754-48e9-1300-00400a0000ff",
    "Data_1": "X-MS-Client-Application",
    "Data_2": "-",
    "Data_3": "X-MS-Client-User-Agent",
    "Data_4": "-",
    "Data_5": "client-request-id",
    "Data_6": "-",
    "Data_7": "X-MS-Endpoint-Absolute-Path",
    "Data_8": "/adfs/.well-known/openid-configuration",
    "Data_9": "X-MS-Forwarded-Client-IP",
    "Data_10": "-",
    "Data_11": "X-MS-Proxy",
    "Data_12": "-",
    "Data_13": "X-MS-ADFS-Proxy-Client-IP",
    "Data_14": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 411

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 411,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.815622+00:00",
    "event_record_id": 16621740,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11176
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "fcdc6f25-76f3-4bc2-b0eb-7efebd19bd6c",
    "Data_1": "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName",
    "Data_2": "fakeuser-The user name or password is incorrect",
    "Data_3": "System.IdentityModel.Tokens.SecurityTokenValidationException: fakeuser ---> System.ComponentModel.Win32Exception: The user name or password is incorrect\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUser(String domain, String username, String password, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)\r\n   --- End of inner exception stack trace ---\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)\r\n   at Microsoft.IdentityServer.Service.Tokens.MsisLocalCpUserNameSecurityTokenHandler.ValidateTokenInternal(UsernameAuthenticationContext usernameAuthenticationContext, SecurityToken token)\r\n   at Microsoft.IdentityServer.Service.Tokens.MsisLocalCpUserNameSecurityTokenHandler.ValidateToken(SecurityToken token)\r\n\r\nSystem.ComponentModel.Win32Exception (0x80004005): The user name or password is incorrect\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserHandle(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, SafeCloseHandle& tokenHandle, SafeLsaReturnBufferHandle& profileHandle)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUserInfo(SafeHGlobalHandle pLogonInfo, Int32 logonInfoSize, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String authenticationType, String issuerName)\r\n   at Microsoft.IdentityServer.Tokens.LsaLogonUserHelper.GetLsaLogonUser(String domain, String username, String password, DateTime& nextPasswordChange, DateTime& lastPasswordChange, String issuerName)\r\n   at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ValidateUser(IAuthenticationContext context)",
    "Data_4": "10.2.10.11",
    "Binary": ""
  },
  "message": ""
}

Event ID 412

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 412,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.856834+00:00",
    "event_record_id": 16621748,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ef2825bb-1423-481d-8a2a-63d8bffc6bbe",
    "Data_1": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_2": "http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName",
    "Data_3": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 413

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 413,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:37.253084+00:00",
    "event_record_id": 16621769,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "ludus\\domainadmin\r\n",
    "Data_2": "-",
    "Data_3": "-",
    "Data_4": "https://testrp1.example.com/saml",
    "Data_5": "-",
    "Data_6": "10.2.10.11",
    "Binary": ""
  },
  "message": ""
}

Event ID 431

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 431,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.940716+00:00",
    "event_record_id": 16621755,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "-",
    "Data_2": "http://schemas.microsoft.com/idfx/keytype/bearer",
    "Data_3": "http://schemas.microsoft.com/idfx/requesttype/issue",
    "Data_4": "-",
    "Data_5": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 500

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Data_16`
`Data_17`
`Data_18`
`Data_19`
`Data_20`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 500,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632718,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "dfe08855-560f-41ef-aece-7943c7ce16a4",
    "Data_1": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod",
    "Data_2": "http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
    "Data_3": "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant",
    "Data_4": "2026-03-13T23:09:23.704Z",
    "Data_5": "-",
    "Data_6": "-",
    "Data_7": "-",
    "Data_8": "-",
    "Data_9": "-",
    "Data_10": "-",
    "Data_11": "-",
    "Data_12": "-",
    "Data_13": "-",
    "Data_14": "-",
    "Data_15": "-",
    "Data_16": "-",
    "Data_17": "-",
    "Data_18": "-",
    "Data_19": "-",
    "Data_20": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 501

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Data_16`
`Data_17`
`Data_18`
`Data_19`
`Data_20`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.856834+00:00",
    "event_record_id": 16621749,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ef2825bb-1423-481d-8a2a-63d8bffc6bbe",
    "Data_1": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "Data_2": "ludus\\domainadmin",
    "Data_3": "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
    "Data_4": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Data_5": "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid",
    "Data_6": "S-1-5-21-1006758700-2167138679-1475694448-513",
    "Data_7": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_8": "S-1-5-21-1006758700-2167138679-1475694448-513",
    "Data_9": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_10": "S-1-1-0",
    "Data_11": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_12": "S-1-5-32-555",
    "Data_13": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_14": "S-1-5-32-573",
    "Data_15": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_16": "S-1-5-32-545",
    "Data_17": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_18": "S-1-5-32-554",
    "Data_19": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
    "Data_20": "S-1-5-32-574",
    "Binary": ""
  },
  "message": ""
}

Event ID 510

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Data_8`
`Data_9`
`Data_10`
`Data_11`
`Data_12`
`Data_13`
`Data_14`
`Data_15`
`Data_16`
`Data_17`
`Data_18`
`Data_19`
`Data_20`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 510,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:04:29.340795+00:00",
    "event_record_id": 16606141,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 7996
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "c914da25-f07c-47a3-9e7b-d6e78d43f334",
    "Data_1": "Modify of a configuration object.\n\nConfiguration:\n    Type: ServiceSettings\n    Object ID: 863dfa3c-2755-4264-a651-e52ab76ff427\n    Name: ConfigurationSettings\n\n    Properties Replaced:\n        Property Name  : ServiceSettingsData\r\n        Property Value : \r\n            ServiceSettingsData\r\n                xmlns:i : http://www.w3.org/2001/XMLSchema-instance\r\n                xmlns : ",
    "Data_2": "http://schemas.datacontract.org/2012/04/ADFS\r\n                SecurityTokenService\r\n                    AdditionalEncryptionTokens\r\n                        CertificateReference\r\n                            IsChainIncluded\r\n                                false\r\n                            IsChainIncludedSpecified\r\n                                false\r\n                            FindValue\r\n      ",
    "Data_3": "                          01558C149B276D6BCECC61717C1291EB2EEFD21C\r\n                            RawCertificate\r\n                                ",
    "Data_4": "MIIE5DCCAsygAwIBAgIQWhuw5A0OGK5PnivlYq/ndzANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNBREZTIEVuY3J5cHRpb24gLSBhZGZzLmx1ZHVzLmRvbWFpbjAeFw0yNjAzMTMyMzAzNDVaFw0yNzAzMTMyMzAzNDVaMC4xLDAqBgNVBAMTI0FERlMgRW5jcnlwdGlvbiAtIGFkZnMubHVkdXMuZG9tYWluMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxTCUA/+UQOrvYAur7gQeLr+ShrHzQKWafQzKLxJmJlbcOQD2Lqk/+czQxbjkiwP1XDCXKC93ERf7Rjjd+nb4d2S8AysFOzfVUYyZM4WZ/trc4I3isb0pr8q9z4EV",
    "Data_5": "dL8l9zaKBJn4qYQYrk4oi6Wuue4MtZWDkSoxvyywk++TVvPDR+Cjy+wpKgPP2o3isCjahN4c6DYf0Cyc4QBqbgBdhUqidxPkYcQurqFr7Pd41wNsNk+SWthBFilaHzYfTZcL5cElqPjNtKauPhbwXLdV1H8lqB3AHk78wQ+OsGYNB4Vxylh+Ww6kTZjv1zH2r+Lvyj4WOFUX+01JfebeyjkGCMZRHQVYaD20kEWQ5zkv5dNcnl4vMDkbXovYm5PEz5kK7cNlQcsfMV903oh1BuBBWyOht5T0MV6qdPyLSRjdq3ylfWj4p8SgrwKHqzhp/WJYdoE/FyM3LNoFxajqTX+pf5HNFmfd4vekV/yye6z9KXXgVex9iU4UBl9RKBK2s8F6chuK4qUBHgP8",
    "Data_6": "8BlLVJoAshcMrOJcRy8TmxknyuPI0/MiCpZ6RtmuUr/yhtqc9s66vBF2nPibd5GVFu98eq1dhxEOmwSLlRmigRKXBYQOVXpM/XkiE7PyqT4iaCQwvBRB/91YvgOEPORMJjRzHcm7Je9tY5cQ4XfQ/Y0za/8519kCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAHBkYJW0/us0tQT7d+3UCpTppvK/Eu7cxvvC4zcvBLcsulg8Z1xdYOz0rnh/R83BhQ6WrChoS2Nimqk9YJurhXEGUo8X8BTVipQIM/sZ0Oz87W35VcEknCiVuGXfs9PdEQyA5Yg3F77J+qwoVkpWLObEWnzZMBSL7tc1jUOAXH+cClMBejvcylltwDPOBmBkOa1QOB2+A1DOOLsgX",
    "Data_7": "u1OCPG6bs+beIpinpULFVul4jhQi/Vui774xKLO7wIjxL7TGKPScmj8S9JvmrE4/YRVTFvllDAcIvi04kp1hjoj8wg63O4SUbnW2ysfQR1IXafIupHTNATzarIVJJEFRBYjwgczkcgolezzkcXx0uaTQw8J/ihuZHexyESx87Prf36PjpSyg7y4R7XlmBd3bHoxp+9fDmA/69Nm6v0sDEfpNYQ0xm5+Bc7mbtTpaUXsy49CB6FWp35xL6Plm/PFLnrhnT/tyXAgwDLeqcGkwYFkd6gJsQx/nYuYN7zRGz4kDnt/Vr3EdhAW4Wc9XD8Y4OTGHd3vBQbcPCfm2732R0gdtce2r42xvRXYSYZwS7AYqOWRupBbxmfMx6Fy4Ik/41M/Q6cHUIkZ/eB7j",
    "Data_8": "Kzxxvy0YKTSEc0hWOndcb/LDXiaB61WZu1ZW8YUy5SjQfZ2/ei+X70O6Z0F+nw8ITTei8ntTNG8=\r\n                            EncryptedPfx\r\n                                ",
    "Data_9": "AAAAAQAAAAAEEDEBQeN1uZlCqft6FErqM0wGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIC6Q+/c54AD4ScU7ZszEEhMO8+Gsl1aM3Gpq9H6M8Z1kBBCOOzSqGbXoD5gYdaS4I3lYIIIQoKp62gOK56pS/oApdd6cd9aADWn6Q9sBk7phR6G2s3l+vM3JYW4Lo9qgudOl/bEoCMZxTeymcSkNgzUMU+hiE4ilugl4uxUon9u185N+XuamuTyKBXsIxSUEAXRXWUSyccUdujvzA84gUFBknWc9499q3MOl/EcvKxSOjH+pqwNSQMH+8cJ97h1FTCOnApLnmYgEARpNmerlaE9x1LxVqVCnNiHLN8CNbkjgpR3VgFCTkZUEBubrDebd",
    "Data_10": "zuQYyPS+X+7uGwAIa3QsgW8rXGLw7CMxyxZD632hMBCrdDNEhko092JcjXjxU24MisINXOEwRueEKdXXHsBwpgzrxw9IAo2q2geJzdS4VLRPjFjey8Janxixv4alQahF0yfygDSFxDiBXckZJMThhIJxWhcgfJ593H9QgVon5AZT+LMimooTmoXxPuasd6DwF6IJmsPTZr4FxAB19ow5dPV3/deyAYTATBw+E1fYf6bfEhtNFLMPLgXI8tMdCN5FBhzYuOhSfLc9z7PMXD/zgDS94e2qAPGu+Kbe7d4tLsFG5YKOwdXJyTocA3qbJLv8tnxCEzJlT5c1dshiHwa1eqmJTzRxV7LweLqZ4HE8uLqVP+4i/O2ryeLjvTXpkuE2Q1nxWluY9R/hpRfp",
    "Data_11": "qI2zS4L6gks6+QdcHA2Io+4QvWpyw3wNpt3wzxR9PZeRTx0UwmCMDB6RVOp0x+sf6ryKpPAv0m6/zm5oYPtBbqM1wQCzEOBCTNnMTy1G43T2wZDIgygF7IQPK/h1Q3ih9e8RusQzOHukxeuVp8YqEERtCAUGdBsLbun9osYzRBpxVsSG/3aYiu7w4o+4dSwJ2hMi2T7h2yvnycHl4oKE1MvLFK/Cg8jZcNooiC7js0Bsln4BoSqAMh2HJ7nl7Io/TH5gJnrJUvMX+8JtSr7vlroKjINGzYbhwCyiWIYUf7TDx39evbx83mXAEFquczB//jzqBcRfk7yyqmQ+3X4A1Rvb4pmsjwFxCHwd4tdbVzjstQsDV9BbGBE4xUEcF8WwtIyECq1xRxYFX2rU",
    "Data_12": "JKES5wRp+R64ixTbpl9AugvdWkAQlkBh+TFCIKCK3qqSTt0fWjFG7WROs3RMJO4GbsWXV8vsMxHwtBpqO4TxtxSYmpgzD1aUSdXy+AWcYFF43xVy5IFZKAMEzt2QOKy5O5Gq23HidfF3PTOb+i8JCLhWk/QsMMRBlL6OTjT/kKY+ttDyY1Oo1V9yjqj1FHIjkQ7tuXa3E4N4LnQiz3L4sJfGoSt5QSfAjXjJJMtWcyy6QTyS5hF280oivwQ9DsfC3vgU2lj9JDKcqp/2ijvn22SEaa4wIejO0mSS4k46KS8cRE+0V68jJ7yY0knoQiXzESmbEIkEBt0bUT1tw0lqHucExj094rXx3r8oPw5R1+I7N5d0iSNDp8R1+Ic10giZFSof4eamQWq4nfzA",
    "Data_13": "NPu5+JbxokEnSdLm8ASwwlKdfRNtXUT+WAQhDE4PimppXcQd7JhyVVVu1s1O4abvjsuzUOuNeDhe5vW4YgNL+jE7GoVJsd5ypughNFLST9HkrCCmkp6LqY/CPEz2gZXwLTbDg8cv3tD+pJWG9N34wmTMvnKEGB3RZPTdWfWghUYN4JpdHRpK/YCkDjlkSJPyVwSRWU08kz+Qx2D2M07uEUBrGk5ArT27KBMfSHzd42SwmqHuMruJ26Ns92YTLMOk3sqSkDOiKVwxq7M7vcMHU8k7OVfGpmplJy3r+PLfpHHhFSMAA9L+eYLRTdcZRFlH7lmHnJPezK7c6FCUrq9EfZkW20P19RmshjZ020KEcMTz5k+7n8Tz8sF3Ggs6Z6EDgLpr/dwiDMi6390B",
    "Data_14": "XSwz0B5xn4ne+lSQ4ODl7BMXIgqkUSlzp5Scb8NluBIsXrXVsRK5ckWQJDPhw5kzL6A3M213+nWbJtXiyeHy7sV0t8CuROMJgk+Hl9QVg+WG3Ud3zDPRMWhwJOL2dqAwtBwTtTCTR8YIFoq1cX6nl0k7ng4mgnLzkomVSOD0JYYrSMQDEHEt+42WDR0Q0hUnQavDncbbcreXxXjeLk54B16bg/ucb/dFgL30bDC16qpJ9Hlh5fwUA2QYDf2+ZAR6wGVr/OSWaGG6GTbSYstKRKQ+CXqHp8gArNe4xR0PARYMtTUObGFCZ0vCpqguuSvTCjginfZdXbfCA2ONLsaamU3BXyYlCWpIJYP6ie8JQ66H87SJKlpNHE5uYZ+0+BMwpzCXlRjDHSdLUr8W",
    "Data_15": "DvQLrv5n+5IW4kbRod34UXv/dNGNgifUxDqRKEjkqiSS6fyqoczVbchriJg4ccn0RyGvlMT8StJ5NwOhxhkHUfR5LyTzGNK0aqInKlRVkCC8AifCQTqdRrGr7yuTg0FjrWh4FKEvXVdo/On3C/CAl5I3ExuXstVW0NLeWLKnBsLYhWCmo+YIQwBtgcghLnwz9LGroPw7ndEqTpLY1j4VUPlJw06NstWqCt8pYAmG1dwZXAHQfr2AHx7V5SlLzYcIjPo8YN1kQUf8Jb1+hh88VFOnq9hVgHZKL1vKARl1ENO/2F5jkpUqhjn2Rp2ydJUGYABN75cCtyqg87KbXNIXwanpqvwi1BiJQFSCyyoD3hV07mhL/2Q7NHgmjUsL/4SWO4BvoWmigVw7OYGL",
    "Data_16": "+4ovjQrbPApDhlenJv5UUmGMSRXk0vvdeOAm2ZmjZkvoGXygzF9lkkZd8b6wUDvIEzx8Q3FxjhgcCFrff1S+Ro4x7MaMq5A1OHKfEv9HHHRDrAy31ZKxkOmKJFSKsdO2NkZOs0gEqxPJLfAWKoMpzAs6n/JYLat6gu3WRL0ByiPscb8u4UUN8PbBgyrsWOQzsc27B/QA1WVX8k8yFbektCx40ynN2RVwVud4ymwgyt11+e0ApkmNvABZjI3TnAtbrCTujalsiTwcFuM/ulBqPJavdp/0ZOFU4ztMKxigucphfFwiHL14z5Khd1z6m9Uc0zslFWCoaIERGlwQBfLnEeOzrIW9Zw8jCvE6WtbuPa3P1gsA4G4nPYSy193eP7xX4SRvnEaqbCTFU/7C",
    "Data_17": "CvaTZyuiuKMQRD/+XOU7vKVs4fc1tMirHY+2AZDNE/+ngnh0ZaU69XoPBpJhSksJdgNhx7hrEaZDErQjkVlK5jsq8x9KEceN9ZYv+Jva4SnERhyXOX5S7fU1pt6Wso7/iv7CY/OdZAlvMpNyWCLUjz9Zq9CzpDG7iIWYpDK/dRK9gO8SmioUtXqB99GTGOAfyr3owC4zw1oV8zDu//n2rIP6NzlRgvsawMSuK1P0si1sw1Gq+e0hcHhyfbOYw6lAT2uw5BbXnPV3MmR2ksfrQwCDQXPZ0uVO8ZDdY5k74cBV1DBqxtlBOY3p+6YDZA1CxEmY849+ce1h0ZynsgdJyFRbTRuH7gjPkQDABcqq94HZ/bhh80inLBU8wNQNbRk/ssLftR9ykPIEV1tl",
    "Data_18": "+Um46B48tlZc442sS6WOipJHAYI7sZ1YJ1wK5ybZdDttlbdFFDxUQvIMIIK7PIEfGMG3dJiaL2m3HJFd9PTmm1+tf1V0Hab/ivMrlnjBQRnrYIYKtuctjY5TU3jUwgI9e8H7/yYhFFmcdAQ2VtasnD2Ri4q9qXXD617F4ERKaZ/sxbU6hgrCnJVg9yAG5mmgyVIQlpi0gy86nly/jQ/FwskF1spKpvtPsn2srixjJBaND2zHntL4pZsVdIyzDx2SGP5hGQY8rynH1jidLx2d5NZnwgcu1zlNxRuX8cwTGtbv2svSBlnVIZzEVtOLg8hM0Wx5/trs99DA+HjTFPupV1AX2sWSxdF5/wkRNmg52PINUUJ8RRIC+ayN42DVXPZVUqYvaVWghdTn6c5Y",
    "Data_19": "VG45kGQRlaDiNH7PYrY7UUUqokzavw7GFJnRBqMei7RSqlHGsUrjUBXw5E7FFkuqpqMyT4IKD8j9jvJFjakrDQpHC4Max4aM+G7Uh4VkmLwLADaEfVp+Umfq58FDyZnWQnhcYr+7I3mX/4ogPJxUiVjnFXLA3PsuVRPHV4Hb8EsFkHjXjNMQoXZ4cwu8DB97cUSJ+uBRFACwrilEqHlCi4xaehkpWkKO2t7uCDA2gvnQz2SrovexCjznaPl6srkCcxZqun2ZHWfB0n6FaN/9fQLTHtdEHB+7kFm8D1PyfPAJpuXHoW1YNCC7dnq53hMIC39All0EXjX9DnzZS+exY6culHwaFn/KXWmifl4osmfTYu0Z99xtA1vUFkOFQPQBXD2P4JnxsJ5BPT9c",
    "Data_20": "AUNkPEI6P3EqkyJ+eT5nZ0kh2/6uXLZgzQkN+oC3V9tqEQzLw2hdvA65QsMG9DtuuARNSPYb1l6P33DS+/tSFlr/m24cafoq9uX3XxW4LMMDXUQrIiFa7fZ5pMC7BFb3VkA6lYasPC+KvAptfVuOFMYVwugyOcDJz/OTCazMwQMjG5xi4I5cQRBaKzWPFl8hpd4B8HcLB5C502do8x1/6djUq6JayL7/u/v9FZvz5ZlF9+RRrES346r+x+un2wVS4zZcP2TSgfgf9TBfjAil2SEsV8VivQ/SXnNYT+GS5efxeM3xa5aAA5VGPIEErpE9kDVvqjHvJKGi2XpirDf5n65T/pVfrkYjMHah1qyg8I25q4KRamwHMdvVgUXBbXPcSBq7GAbXZclunUPK",
    "Binary": ""
  },
  "message": ""
}

Event ID 1026

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Data_6`
`Data_7`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1026,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:52.834431+00:00",
    "event_record_id": 16624207,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11176
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "2d2b5fdb-5717-4ed1-0300-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "fake",
    "Data_3": "https://localhost/cb",
    "Data_4": "-",
    "Data_5": "-",
    "Data_6": "-",
    "Data_7": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidClientException: MSIS9241: Received invalid OAuth access token request. The received 'client_id' is invalid as no registered client was found with this client identifier. Make sure that the client is registered. Received client_id: 'fake'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthAccessTokenRequestContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1030

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.668865+00:00",
    "event_record_id": 16621734,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "43ebe48f-e201-482c-1500-00400a0000ff",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "nonexistent",
    "Data_4": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidClientException: MSIS9241: Received invalid OAuth access token request. The received 'client_id' is invalid as no registered client was found with this client identifier. Make sure that the client is registered. Received client_id: 'nonexistent'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenRequestContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthClientCredentialsContext.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1034

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Data_5`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1034,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:52.885864+00:00",
    "event_record_id": 16624228,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "e12e6b70-d9df-4a65-0600-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "fake",
    "Data_4": "-",
    "Data_5": "Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthInvalidRequestException: MSIS9380: The 'requested_token_use' parameter is not specified. The access token request must contain the 'requested_token_use' parameter for 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer'. \r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthOnBehalfOfContextBase.ValidateCore()\r\n   at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()\r\n   at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)",
    "Binary": ""
  },
  "message": ""
}

Event ID 1090

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1090,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:08:53.172704+00:00",
    "event_record_id": 16624277,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "33d19343-e8af-4588-0d00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "https://adfs.ludus.domain:443/adfs/userinfo",
    "Data_3": "Microsoft.IdentityServer.Web.Protocols.UserInfo.UserInfoMissingAccessTokenException: MSIS9914: Received invalid UserInfo request. Access token is not present in the request. The access token needs to be carried in Authorization Request Header Field or Form-Encoded Body Parameter.\r\n   at Microsoft.IdentityServer.Web.UserInfoListener.ParseRequest(WrappedHttpListenerContext context)\r\n   at Microsoft.IdentityServer.Web.UserInfoListener.OnGetContext(WrappedHttpListenerContext context)\r\n\r\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 1122

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1122,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.211424+00:00",
    "event_record_id": 16624283,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "26b7203e-f387-4b80-0e00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "-",
    "Data_3": "-",
    "Binary": ""
  },
  "message": ""
}

Event ID 1126

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1126,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.142472+00:00",
    "event_record_id": 16624268,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "81f6458e-a9c1-4762-0c00-0040080000f4",
    "Data_1": "10.2.10.11",
    "Data_2": "<null>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1200

Provider: AD FS Auditing
Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1200,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:09:23.769691+00:00",
    "event_record_id": 16632722,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11000
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ed63d0a9-7eb6-4970-a801-522c0914427d",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\r\n  <AuditType>AppToken</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>https://testrp4.example.com/claims</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>ludus\\domainadmin</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>WsTrust</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1201

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1201,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.730824+00:00",
    "event_record_id": 16621737,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "43ebe48f-e201-482c-1500-00400a0000ff",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"AppTokenAudit\">\r\n  <AuditType>AppToken</AuditType>\r\n  <AuditResult>Failure</AuditResult>\r\n  <FailureType>CredentialValidationError</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>N/A</ClaimsProvider>\r\n      <UserId>N/A</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>N/A</Server>\r\n      <AuthProtocol>OAuth</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/token</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1202

Provider: AD FS Auditing
Channel: Security
Collection Priority: Recommended (ASD)

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1202,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:07:36.872525+00:00",
    "event_record_id": 16621752,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "9ae06e63-2f0d-47e6-820d-3f3eaadf8f67",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>\r\n      <UserId>ludus\\domainadmin</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1203

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1203,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9263904433501110272,
    "time_created": "2026-03-13T23:07:36.818834+00:00",
    "event_record_id": 16621741,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 11144
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "fcdc6f25-76f3-4bc2-b0eb-7efebd19bd6c",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"FreshCredentialAudit\">\r\n  <AuditType>FreshCredentials</AuditType>\r\n  <AuditResult>Failure</AuditResult>\r\n  <FailureType>CredentialValidationError</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"ResourceAuditComponent\">\r\n      <RelyingParty>N/A</RelyingParty>\r\n      <ClaimsProvider>N/A</ClaimsProvider>\r\n      <UserId>LUDUS\\fakeuser</UserId>\r\n    </Component>\r\n    <Component xsi:type=\"AuthNAuditComponent\">\r\n      <PrimaryAuth>N/A</PrimaryAuth>\r\n      <DeviceAuth>false</DeviceAuth>\r\n      <DeviceId>N/A</DeviceId>\r\n      <MfaPerformed>false</MfaPerformed>\r\n      <MfaMethod>N/A</MfaMethod>\r\n      <TokenBindingProvidedId>false</TokenBindingProvidedId>\r\n      <TokenBindingReferredId>false</TokenBindingReferredId>\r\n      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>\r\n    </Component>\r\n    <Component xsi:type=\"ProtocolAuditComponent\">\r\n      <OAuthClientId>N/A</OAuthClientId>\r\n      <OAuthGrant>N/A</OAuthGrant>\r\n    </Component>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>http://adfs.ludus.domain/adfs/services/trust</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/services/trust/2005/usernamemixed</Endpoint>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

Event ID 1206

Provider: AD FS Auditing
Channel: Security

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "AD FS Auditing",
    "guid": "",
    "event_source_name": "",
    "event_id": 1206,
    "version": 0,
    "level": 0,
    "task": 3,
    "opcode": 0,
    "keywords": 9268408033128480768,
    "time_created": "2026-03-13T23:08:53.223207+00:00",
    "event_record_id": 16624284,
    "correlation": {
      "ActivityID": "0D26E79C-B333-0001-07E8-260D33B3DC01"
    },
    "execution": {
      "process_id": 936,
      "thread_id": 13940
    },
    "channel": "Security",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "26b7203e-f387-4b80-0e00-0040080000f4",
    "Data_1": "<?xml version=\"1.0\" encoding=\"utf-16\"?>\r\n<AuditBase xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:type=\"SignOutAudit\">\r\n  <AuditType>SignOut</AuditType>\r\n  <AuditResult>Success</AuditResult>\r\n  <FailureType>None</FailureType>\r\n  <ErrorCode>N/A</ErrorCode>\r\n  <ContextComponents>\r\n    <Component xsi:type=\"RequestAuditComponent\">\r\n      <Server>N/A</Server>\r\n      <AuthProtocol>N/A</AuthProtocol>\r\n      <NetworkLocation>Intranet</NetworkLocation>\r\n      <IpAddress>10.2.10.11</IpAddress>\r\n      <ForwardedIpAddress />\r\n      <ProxyIpAddress>N/A</ProxyIpAddress>\r\n      <NetworkIpAddress>N/A</NetworkIpAddress>\r\n      <ProxyServer>N/A</ProxyServer>\r\n      <UserAgentString>N/A</UserAgentString>\r\n      <Endpoint>/adfs/oauth2/logout</Endpoint>\r\n    </Component>\r\n    <Component xsi:type=\"SignOutAuditComponent\">\r\n      <SignedInRPs>\r\n        <SignedInRPs>N/A</SignedInRPs>\r\n      </SignedInRPs>\r\n    </Component>\r\n  </ContextComponents>\r\n</AuditBase>",
    "Binary": ""
  },
  "message": ""
}

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)