Microsoft-Windows-HCAP

Event	Title	Channel	Sample	Rule
1	The HCAP Server started successfully.	System	N	N
2	The HCAP Server stopped successfully.	System	N	N
3	The HCAP Server failed to start.	System	N	N
4	The HCAP Server failed to stop.	System	N	N
5	The HCAP Server cannot contact the NPS Server.	System	N	N
6	The NPS server rejected the connection request.	System	N	N
7	The HCAP Request is malformed.	System	N	N
8	The HCAP Request code {RequestCode} is unknown.	System	N	N
9	The HCAP Request type {RequestType} is unknown.	System	N	N
10	The HCAP Request version {Version} is not supported.	System	N	N
11	The HCAP Request had no TLVs when at least one was expected.	System	N	N
12	The HCAP Request TLV {MalformedTLV} is malformed.	System	N	N
15	The HCAP Request TLV type is not supported.	System	N	N
16	The HCAP Request did not have SOH TLV.	System	N	N
17	The HCAP server could not match the HCAP Request against any Network Policy.	System	N	N
18	The HCAP server did not get a response from Network Policy Server.	System	N	N
19	The HCAP server encountered a general failure.	System	N	N
20	The NPS server encountered a general failure.	System	N	N
21	The HCAP server encountered an internal error.	System	N	N
22	Successful HCAP Response was returned.	System	N	N
23	Failure HCAP Response was returned with result code {ResultCode}HCAP client host …	System	N	N
24	A failure response was sent.	System	N	N

Event ID 1: The HCAP Server started successfully.

Channel: System

Event ID 2: The HCAP Server stopped successfully.

Channel: System

Event ID 3: The HCAP Server failed to start.

Channel: System

Event ID 4: The HCAP Server failed to stop.

Channel: System

Event ID 5: The HCAP Server cannot contact the NPS Server.

Channel: System

Description

The HCAP Server cannot contact the NPS Server.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Server cannot contact the NPS Server.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 6: The NPS server rejected the connection request.

Channel: System

Description

The NPS server rejected the connection request.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The NPS server rejected the connection request.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 7: The HCAP Request is malformed.

Channel: System

Description

The HCAP Request is malformed.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request is malformed.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 8: The HCAP Request code {RequestCode} is unknown.

Channel: System

Description

The HCAP Request code {RequestCode} is unknown.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request code {RequestCode} is unknown.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`RequestCode`
`HostName`
`HostIP`
`RequestID`

Event ID 9: The HCAP Request type {RequestType} is unknown.

Channel: System

Description

The HCAP Request type {RequestType} is unknown.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request type {RequestType} is unknown.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`RequestType`
`HostName`
`HostIP`
`RequestID`

Event ID 10: The HCAP Request version {Version} is not supported.

Channel: System

Description

The HCAP Request version {Version} is not supported.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request version {Version} is not supported.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`Version`
`HostName`
`HostIP`
`RequestID`

Event ID 11: The HCAP Request had no TLVs when at least one was expected.

Channel: System

Description

The HCAP Request had no TLVs when at least one was expected.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request had no TLVs when at least one was expected.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 12: The HCAP Request TLV {MalformedTLV} is malformed.

Channel: System

Description

The HCAP Request TLV {MalformedTLV} is malformed.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request TLV {MalformedTLV} is malformed.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`MalformedTLV`
`HostName`
`HostIP`
`RequestID`

Event ID 15: The HCAP Request TLV type is not supported.

Channel: System

Description

The HCAP Request TLV type is not supported.Unsupported TLVs: {TLVs}HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request TLV type is not supported.Unsupported TLVs: {TLVs}HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`TLVs`
`HostName`
`HostIP`
`RequestID`

Event ID 16: The HCAP Request did not have SOH TLV.

Channel: System

Description

The HCAP Request did not have SOH TLV.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP Request did not have SOH TLV.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 17: The HCAP server could not match the HCAP Request against any Network Policy.

Channel: System

Description

The HCAP server could not match the HCAP Request against any Network Policy.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP server could not match the HCAP Request against any Network Policy.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 18: The HCAP server did not get a response from Network Policy Server.

Channel: System

Description

The HCAP server did not get a response from Network Policy Server.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP server did not get a response from Network Policy Server.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 19: The HCAP server encountered a general failure.

Channel: System

Description

The HCAP server encountered a general failure.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP server encountered a general failure.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 20: The NPS server encountered a general failure.

Channel: System

Description

The NPS server encountered a general failure.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The NPS server encountered a general failure.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 21: The HCAP server encountered an internal error.

Channel: System

Description

The HCAP server encountered an internal error.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}.

Message #

The HCAP server encountered an internal error.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`

Event ID 22: Successful HCAP Response was returned.

Channel: System

Message #

Successful HCAP Response was returned.HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}Version: {Version}User Name: {UserName}User Groups: {UserGroup}Endpoint ID: {EndpointID}Endpoint Location: {EndpointLocation}Endpoint IPv4 Address: {EndpointIPv4Address}Endpoint IPv6 Address: {HostName}0Posture State returned: {HostName}1Extended State returned: {HostName}2

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`
`Version`
`UserName`
`UserGroup`
`EndpointID`
`EndpointLocation`
`EndpointIPv4Address`

Event ID 23: Failure HCAP Response was returned with result code {ResultCode}HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {Reque...

Channel: System

Message #

Failure HCAP Response was returned with result code {ResultCode}HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}Version: {Version}User Name: {UserName}User Groups: {UserGroup}Endpoint ID: {EndpointID}Endpoint Location: {EndpointLocation}Endpoint IPv4 Address: {ResultCode}0Endpoint IPv6 Address: {ResultCode}1

Fields #

Name	Description
`ResultCode`
`HostName`
`HostIP`
`RequestID`
`Version`
`UserName`
`UserGroup`
`EndpointID`
`EndpointLocation`

Event ID 24: A failure response was sent.

Channel: System

Message #

A failure response was sent.  The HCAP Server sent Negatively Acknowledgment (NAK) for unsupported mandatory TLVs. HCAP client host name: {HostName}HCAP client IP address: {HostIP}Request ID: {RequestID}Version: {Version}User Name: {UserName}User Groups: {UserGroup}Endpoint ID: {EndpointID}Endpoint Location: {EndpointLocation}Endpoint IPv4 Address: {EndpointIPv4Address}Endpoint IPv6 Address: {HostName}0

Fields #

Name	Description
`HostName`
`HostIP`
`RequestID`
`Version`
`UserName`
`UserGroup`
`EndpointID`
`EndpointLocation`
`EndpointIPv4Address`