Microsoft-Windows-OnlineResponder

38 events across 2 channels

Event	Title	Channel	Sample
17	Online Responder Service was started.	Application	Y
17	Event ID 17	Operational	N
18	Online Responder Service was stopped.	Application	Y
18	Event ID 18	Operational	N
20	The Online Responder Service did not start: ErrorCode.	Application	N
20	Event ID 20	Operational	N
21	FileIdentifier: The Online Responder Service detected an exception at address …	Application	N
21	Event ID 21	Operational	N
22	OCSP Responder Services did not process an extremely long request from …	Application	N
22	Event ID 22	Operational	N
23	The Online Responder Service could not locate a signing certificate for …	Application	N
23	Event ID 23	Operational	N
24	The Online Responder Service successfully (re)loaded a signing certificate for …	Application	N
24	Event ID 24	Operational	N
25	The signing certificate for Online Responder configuration CAConfigurationId …	Application	N
25	Event ID 25	Operational	N
26	The signing certificate for Online Responder configuration CAConfigurationId has …	Application	N
26	Event ID 26	Operational	N
27	The signing certificate for Online Responder configuration CAConfigurationId was …	Application	N
27	Event ID 27	Operational	N
28	The signing certificate for Online Responder configuration CAConfigurationId has …	Application	N
28	Event ID 28	Operational	N
29	Settings for Online Responder configuration CAConfigurationId cannot be loaded.	Application	N
29	Event ID 29	Operational	N
31	Performance counters for the Online Responder Service cannot be initialized.	Application	N
31	Event ID 31	Operational	N
32	The Online Responder Service detected a change in the signing certificate …	Application	N
32	Event ID 32	Operational	N
33	The Online Responder Service failed to create an enrollment request for the …	Application	N
33	Event ID 33	Operational	N
34	The Online Responder Service encountered an error while submitting the …	Application	N
34	Event ID 34	Operational	N
35	The Online Responder Service failed to install the enrollment response for …	Application	N
35	Event ID 35	Operational	N
36	The Online Responder Service successfully enrolled for a new signing certificate …	Application	N
36	Event ID 36	Operational	N
37	The signing certificate for Online Responder configuration CAConfigurationId …	Application	N
37	Event ID 37	Operational	N

Event ID 17: Online Responder Service was started.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application
Level: 4

Description

Online Responder Service was started.

Message #

Online Responder Service was started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-OnlineResponder",
    "guid": "{21b2e773-ebed-4ce1-834a-1444f9e20d6e}",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-05-08 17:33:26.099514+00:00",
    "event_record_id": 475,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 2272,
      "thread_id": 7252
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 17

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

Online Responder Service was started.

Event ID 18: Online Responder Service was stopped.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application
Level: 4

Description

Online Responder Service was stopped.

Message #

Online Responder Service was stopped.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-OnlineResponder",
    "guid": "{21b2e773-ebed-4ce1-834a-1444f9e20d6e}",
    "event_source_name": "",
    "event_id": 18,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-05-08 18:03:33.590929+00:00",
    "event_record_id": 535,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 2272,
      "thread_id": 7252
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 18

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

Online Responder Service was stopped.

Event ID 20: The Online Responder Service did not start: ErrorCode.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service did not start: ErrorCode.

Message #

The Online Responder Service did not start: %1.

Fields #

Name	Description
`ErrorCode` UnicodeString

Event ID 20

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service did not start: .

Fields #

Name	Description
`ErrorCode` UnicodeString

Event ID 21: FileIdentifier: The Online Responder Service detected an exception at address ExceptionAddress.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

FileIdentifier: The Online Responder Service detected an exception at address ExceptionAddress. Flags = ExeptionFlags. The exception is ErrorCode.

Message #

%1: The Online Responder Service detected an exception at address %2.  Flags = %3.  The exception is %4.

Fields #

Name	Description
`FileIdentifier` UnicodeString
`ExceptionAddress` UnicodeString
`ExeptionFlags` UnicodeString
`ErrorCode` UnicodeString

Event ID 21

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

: The Online Responder Service detected an exception at address . Flags = . The exception is .

Fields #

Name	Description
`FileIdentifier` UnicodeString
`ExceptionAddress` UnicodeString
`ExeptionFlags` UnicodeString
`ErrorCode` UnicodeString

Event ID 22: OCSP Responder Services did not process an extremely long request from RequestName.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

OCSP Responder Services did not process an extremely long request from RequestName. This may indicate a denial-of-service attack. If the request was rejected in error, modify the MaxIncomingMessageSize property for the service. Unless exhaustive logging is enabled, this error will only be logged every 20 minutes.

Message #

OCSP Responder Services did not process an extremely long request from %1. This may indicate a denial-of-service attack. If the request was rejected in error, modify the MaxIncomingMessageSize property for the service. Unless exhaustive logging is enabled, this error will only be logged every 20 minutes.

Fields #

Name	Description
`RequestName` UnicodeString

Event ID 22

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Fields #

Name	Description
`RequestName` UnicodeString

Event ID 23: The Online Responder Service could not locate a signing certificate for configuration CAConfigurationId.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service could not locate a signing certificate for configuration CAConfigurationId.(ErrorCode).

Message #

The Online Responder Service could not locate a signing certificate for configuration %1.(%2)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 23

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service could not locate a signing certificate for configuration .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 24: The Online Responder Service successfully (re)loaded a signing certificate for configuration CAConfigurationId.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service successfully (re)loaded a signing certificate for configuration CAConfigurationId.

Message #

The Online Responder Service successfully (re)loaded a signing certificate for configuration %1.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 24

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service successfully (re)loaded a signing certificate for configuration .

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 25: The signing certificate for Online Responder configuration CAConfigurationId will expire soon.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId will expire soon.

Message #

The signing certificate for Online Responder configuration %1 will expire soon.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 25

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The signing certificate for Online Responder configuration will expire soon.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 26: The signing certificate for Online Responder configuration CAConfigurationId has expired.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId has expired. OCSP requests for this configuration will be rejected.

Message #

The signing certificate for Online Responder configuration %1 has expired. OCSP requests for this configuration will be rejected.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 26

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The signing certificate for Online Responder configuration has expired. OCSP requests for this configuration will be rejected.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 27: The signing certificate for Online Responder configuration CAConfigurationId was not updated.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId was not updated.(ErrorCode).

Message #

The signing certificate for Online Responder configuration %1 was not updated.(%2)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 27

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The signing certificate for Online Responder configuration was not updated.().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 28: The signing certificate for Online Responder configuration CAConfigurationId has been renewed.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId has been renewed. The hash for the new certificate can be located in additional data.

Message #

The signing certificate for Online Responder configuration %1 has been renewed. The hash for the new certificate can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 28

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The signing certificate for Online Responder configuration has been renewed. The hash for the new certificate can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 29: Settings for Online Responder configuration CAConfigurationId cannot be loaded.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

Settings for Online Responder configuration CAConfigurationId cannot be loaded. OCSP requests for this configuration will be rejected.(ErrorCode).

Message #

Settings for Online Responder configuration %1 cannot be loaded. OCSP requests for this configuration will be rejected.(%2)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 29

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

Settings for Online Responder configuration cannot be loaded. OCSP requests for this configuration will be rejected.().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`ErrorCode` UnicodeString

Event ID 31: Performance counters for the Online Responder Service cannot be initialized.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

Performance counters for the Online Responder Service cannot be initialized.

Message #

Performance counters for the Online Responder Service cannot be initialized.

Event ID 31

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

Performance counters for the Online Responder Service cannot be initialized.

Event ID 32: The Online Responder Service detected a change in the signing certificate template version for configuration CAConfigurationId.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service detected a change in the signing certificate template version for configuration CAConfigurationId. The old version was (OldMajorVersion,OldMinorVersion), the new version is (NewMajorVersion,NewMinorVersion).

Message #

The Online Responder Service detected a change in the signing certificate template version for configuration %1. The old version was (%2,%3), the new version is (%4,%5).

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`OldMajorVersion` UnicodeString
`OldMinorVersion` UnicodeString
`NewMajorVersion` UnicodeString
`NewMinorVersion` UnicodeString

Event ID 32

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service detected a change in the signing certificate template version for configuration . The old version was (,), the new version is (,).

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`OldMajorVersion` UnicodeString
`OldMinorVersion` UnicodeString
`NewMajorVersion` UnicodeString
`NewMinorVersion` UnicodeString

Event ID 33: The Online Responder Service failed to create an enrollment request for the signing certificate template CertificateTemplateName for configuration CAConfigurationId.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service failed to create an enrollment request for the signing certificate template CertificateTemplateName for configuration CAConfigurationId.(ErrorCode).

Message #

The Online Responder Service failed to create an enrollment request for the signing certificate template %2 for configuration %1.(%3)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`ErrorCode` UnicodeString

Event ID 33

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service failed to create an enrollment request for the signing certificate template for configuration .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`ErrorCode` UnicodeString

Event ID 34: The Online Responder Service encountered an error while submitting the enrollment request for configuration CAConfigurationId to certification authority CAConfig.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service encountered an error while submitting the enrollment request for configuration CAConfigurationId to certification authority CAConfig. The request ID is RequestId.(ErrorCode).

Message #

The Online Responder Service encountered an error while submitting the enrollment request for configuration %1 to certification authority %2. The request ID is %3.(%4)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CAConfig` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 34

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service encountered an error while submitting the enrollment request for configuration to certification authority . The request ID is .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CAConfig` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 35: The Online Responder Service failed to install the enrollment response for configuration CAConfigurationId for the signing certificate template CertificateTemplateName .

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service failed to install the enrollment response for configuration CAConfigurationId for the signing certificate template CertificateTemplateName . The request ID is RequestId.(ErrorCode).

Message #

The Online Responder Service failed to install the enrollment response for configuration %1 for the signing certificate template %2 . The request ID is %3.(%4)

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 35

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service failed to install the enrollment response for configuration for the signing certificate template . The request ID is .().

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateTemplateName` UnicodeString
`RequestId` UnicodeString
`ErrorCode` UnicodeString

Event ID 36: The Online Responder Service successfully enrolled for a new signing certificate for configuration CAConfigurationId.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The Online Responder Service successfully enrolled for a new signing certificate for configuration CAConfigurationId. The new certificate's hash can be located in additional data.

Message #

The Online Responder Service successfully enrolled for a new signing certificate for configuration %1. The new certificate's hash can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 36

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Description

The Online Responder Service successfully enrolled for a new signing certificate for configuration . The new certificate's hash can be located in additional data.

Fields #

Name	Description
`CAConfigurationId` UnicodeString
`CertificateHash` Binary

Event ID 37: The signing certificate for Online Responder configuration CAConfigurationId does not include the mandatory OCSP No Revocation Checking extension.

Provider: Microsoft-Windows-OnlineResponder
Channel: Application

Description

The signing certificate for Online Responder configuration CAConfigurationId does not include the mandatory OCSP No Revocation Checking extension. You must configure an OCSP Response Signing certificate template to include this extension in all OCSP Response Signing certificates. For more information, see Configure a CA to Support OCSP Responders in the Online Responder console Help.

Message #

The signing certificate for Online Responder configuration %1 does not include the mandatory OCSP No Revocation Checking extension. You must configure an OCSP Response Signing certificate template to include this extension in all OCSP Response Signing certificates. For more information, see Configure a CA to Support OCSP Responders in the Online Responder console Help.

Fields #

Name	Description
`CAConfigurationId` UnicodeString

Event ID 37

Provider: Microsoft-Windows-OnlineResponder
Channel: Operational

Fields #

Name	Description
`CAConfigurationId` UnicodeString

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)