Event catalog update: 17 March 2026

There have been many enhancements. I'll start with the most visible changes. There is now a References page with information gleaned from Windows for access rights to a variety of objects, privilege constants, Sigma rules mapped to Windows events, and more.

If an event appears in a Sigma rule, the event page now shows the rule's description and a link to its SigmaHQ repo. The page lists the first five rules by default, with a dropdown button to expand the rest. The limit caps at 50 total rules, which doesn't impact many events. A few standouts like Sysmon Event ID 1 have 1167 rules. You can see all of them on the Sigma Rule References page. I might be a bit boring, but I've caught myself a few times opening the page, scrolling to a random event and start reading.

We added a Related Events section to event pages. It shows notable relationships to the event you are viewing. For example, Security-Auditing Event ID 4720, A user account was created, has these relationships.

Pairs with Microsoft-Windows-Security-Auditing Event ID 4726, A user account was deleted. One event creates the account, the other deletes it. Microsoft Learn

Often precedes Microsoft-Windows-Security-Auditing Event ID 4722, A user account was enabled. The account is created and then enabled. Microsoft Learn

Co-occurs in Sigma rules with Microsoft-Windows-Security-Auditing Event ID 4781, The name of an account was changed. Sigma rule

This is exceptionally useful for learning the context of a given event. I've started with documenting the relationships shown in existing Microsoft Learn documentation and Sigma rules. I hope to steadily grow coverage for more events using community contributions.

If the event is enabled via Audit Policy, the audit category and subcategory will be shown above the Description field with a Learn link.

Available event samples use JSON syntax highlighting chosen for each theme’s accessibility. I did not retain the original lab .evtx files used to create the JSON. I do have an almost complete script that converts a sample to XML. JPCERT/CC’s xml2evtx can then convert it to EVTX for SIEM testing.

We added more than 2,300 events. Nearly 4,500 events across 170+ providers now have real samples. Many more now include data from Windows Internals, Learn, and community sources.

• Enum/constant resolution for fields like Status, AccessMask, TicketOptions, and UAC flags resolving raw numeric values to human-readable labels using PDB debug symbols, SDK headers, and message tables from msobjs.dll
• Descriptions from ETW message templates for 62K+ events
• Task/opcode metadata extracted from manifests across 44k+ events
• Field descriptions parsed from adtschema message templates (3k+ fields) and Learn
• Collection priority recommendations from Microsoft Defender, Yamato-Security, and others

Thanks for reading! You can send me feedback at sonny@detection.wiki.