MSExchangeIS

12 events across 1 channel

Event	Title	Channel	Sample
1020	Event ID 1020	Application	Y
1024	Event ID 1024	Application	Y
1040	Event ID 1040	Application	Y
1041	Event ID 1041	Application	Y
1074	Event ID 1074	Application	Y
1075	Event ID 1075	Application	Y
40008	Event ID 40008	Application	Y
40018	Event ID 40018	Application	Y
40028	Event ID 40028	Application	Y
40034	Event ID 40034	Application	Y
40035	Event ID 40035	Application	Y
40036	Event ID 40036	Application	Y

Event ID 1020

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1020,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:49.979696+00:00",
    "event_record_id": 4924,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>b5002121-57f7-4b51-8c5a-51cea57ce925</string>\n<string>26204</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAAfgAAAP8UAAAAAAAAAAJwAAAAzOhQIAiDjgBTTTAxAAAAAMzoUCAIg44AU00wMgAAAADM6FAgCIOOAFNNMDMAAAAAzOhQIBeDjgBTTTA0AAAAAMzoUCBGg44AU00wNQAAAACYmkAQdwkAAMzoUCBWg44AU00wNgAAAACAiRAQ/EgAAA=="
  },
  "message": ""
}

Event ID 1024

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1024,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:25:25.714067+00:00",
    "event_record_id": 4834,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>905bb452-4510-4976-9c1d-d506b1fc2848</string>\n<string>1033</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAALgAAAP8wAAAAAAAAAAIgAAAAgKGAMCEhALX3V1FLjFpRzqV86SUAAAAAgIkQEBQqAAA="
  },
  "message": ""
}

Event ID 1040

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1040,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:30:22.307814+00:00",
    "event_record_id": 4963,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Folder</string>\n<string>6bb652da-511f-4bdb-a46e-4eb5818d6d5e[1]-C359D</string>\n<string>0.143</string>\n<string>0.144</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAAXgAAAP8VAAAAAAAAAAJQAAAAGugQEI8AAAAaiBAQuQAAAMzoUCAO7I8AV00zNgAuMTfM6FAgDuyPAFdNMzcALjE3gKGAMCEhALX3V1FLjFpRzqV86SViNTAwgIkQEFxmAAA="
  },
  "message": ""
}

Event ID 1041

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1041,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:30:22.307814+00:00",
    "event_record_id": 4964,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Folder</string>\n<string>6bb652da-511f-4bdb-a46e-4eb5818d6d5e[1]-C359D</string>\n<string>0.143</string>\n<string>0.185</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAAngAAAP8VAAAAAAAAAAKQAAAAGugQEI8AAAAaiBAQuQAAAMzoUCAO7I8AV00zNgAuMTfM6FAgDuyPAFdNMzcALjE3gKGAMCEhALX3V1FLjFpRzqV86SViNTAwgIkQEFxmAADM6FAgDuyPAFdNMzgAMWNlzOhQIA7sjwBXTTM5AFpRzoChgDAhIQC191dRS4xaUc6lfOklAAAAAICJEBBcZgAA"
  },
  "message": ""
}

Event ID 1074

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1074,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:16:06.198435+00:00",
    "event_record_id": 4763,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "W0RJQUdfQ1RYXQAAFgAAAP8oAAAAAAAAAAIIAAAAgIkQEEQlAAA="
  },
  "message": ""
}

Event ID 1075

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1075,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:16:06.198435+00:00",
    "event_record_id": 4764,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>0</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAAHgAAAP8oAAAAAAAAAAIQAAAAgIkQEEQlAACAiRAQRCUAAA=="
  },
  "message": ""
}

Event ID 40008

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 40008,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:55.682779+00:00",
    "event_record_id": 4932,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>b5002121-57f7-4b51-8c5a-51cea57ce925</string>\n<string>5.7910397</string>\n<string>0x00000000</string>\n<string>NoError</string>\n<string>0x00000000</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAADgMAAP8UAAAAAAAAAAIAAwAAzOhQIAiDjgBTTTAxAAAAAMzoUCAIg44AU00wMgAAAADM6FAgCIOOAFNNMDMAAAAAzOhQIBeDjgBTTTA0AAAAAMzoUCBGg44AU00wNQAAAACYmkAQdwkAAMzoUCBWg44AU00wNgAAAACAiRAQ/EgAAMzoUCBUk44AU00wNwAAAADM6FAgkpOOAFNNMDgAAAAAzOhQIJKTjgBTTTA5AAAAAMzoUCDBk44AV00wMQAAAADM6FAgAJSOAFdNMDIAAAAAzOhQIC6UjgBXTTAzAAAAAMzoUCAulI4AV00wNAAAAAC0vRAQAAAAAMyIEBAAAAAAzIgQEAAAAADM6FAgfZSOAFdNMDgAAAAAzOhQIJyUjgBKSTAyAAAAAMzoUCCclI4ASkkwNgAAAADM6FAgq5SOAEpJMDcAAAAAzOhQINqUjgBKSTA4AAAAAMzoUCAZlY4ASkkxMgAAAADM6FAgGZWOAEpJMTMAAAAAzOhQIBmVjgBKSTE0AAAAAMzoUCAolY4ASkkxNQAAAADM6FAgKJWOAEpJMTYAAAAAzOhQIDiVjgBKSTE3AAAAAMzoUCA4lY4ASkkyMAAAAADM6FAgOJWOAFdNMTAAAAAAzOhQIFGWjgBXTTExAAAAAMzoUCBhlo4AQ00wMQAAAADM6FAgYZaOAFdNMzAAAAAAzOhQIGGWjgBXTTMxAAAAAMzoUCBxlo4AV00zMgAAAADM6FAgcZaOAFdNMTIAAAAAzOhQIHGWjgBXTTEzAAAAAMzoUCCKl44AV00xNAAAAADM6FAgAZmOAFdNMTUAAAAAzOhQID+ZjgBXTTE2AAAAAMzoUCBumY4AV00xNwAAAADM6FAgjZmOAFdNMTgAAAAAzOhQIJ2ZjgBXTTE5AAAAAIChgDAhIQC191dRS4xaUc6lfOklAAAAAICJEBBcZgAAzOhQIJ2ZjgBXTTIwAAAAAMzoUCCdmY4AV00yMwAAAADM6FAgrZmOAFNNMTAAAAAAzOhQIK2ZjgBTTTEyAAAAAICJEBD8SAAA"
  },
  "message": ""
}

Event ID 40018

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 40018,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:55.667149+00:00",
    "event_record_id": 4931,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Mailbox Database 1347825906</string>\n<string>b5002121-57f7-4b51-8c5a-51cea57ce925</string>\n<string>26204</string>\n<string>1.3906377</string>\n<string>0x14</string>\n<string>0</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAAJgIAAP8UAAAAAAAAAAIYAgAAzOhQIMGTjgBXTTAxAAAAAMzoUCAAlI4AV00wMgAAAADM6FAgLpSOAFdNMDMAAAAAzOhQIC6UjgBXTTA0AAAAALS9EBAAAAAAzIgQEAAAAADMiBAQAAAAAMzoUCB9lI4AV00wOAAAAADM6FAgnJSOAEpJMDIAAAAAzOhQIJyUjgBKSTA2AAAAAMzoUCCrlI4ASkkwNwAAAADM6FAg2pSOAEpJMDgAAAAAzOhQIBmVjgBKSTEyAAAAAMzoUCAZlY4ASkkxMwAAAADM6FAgGZWOAEpJMTQAAAAAzOhQICiVjgBKSTE1AAAAAMzoUCAolY4ASkkxNgAAAADM6FAgOJWOAEpJMTcAAAAAzOhQIDiVjgBKSTIwAAAAAMzoUCA4lY4AV00xMAAAAADM6FAgUZaOAFdNMTEAAAAAzOhQIGGWjgBDTTAxAAAAAMzoUCBhlo4AV00zMAAAAADM6FAgYZaOAFdNMzEAAAAAzOhQIHGWjgBXTTMyAAAAAMzoUCBxlo4AV00xMgAAAADM6FAgcZaOAFdNMTMAAAAAzOhQIIqXjgBXTTE0AAAAAMzoUCABmY4AV00xNQAAAADM6FAgP5mOAFdNMTYAAAAAzOhQIG6ZjgBXTTE3AAAAAMzoUCCNmY4AV00xOAAAAADM6FAgnZmOAFdNMTkAAAAAgKGAMCEhALX3V1FLjFpRzqV86SUAAAAAgIkQEFxmAAA="
  },
  "message": ""
}

Event ID 40028

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 40028,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:44.589037+00:00",
    "event_record_id": 4917,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Mailbox Database 1347825906</string>\n<string>b5002121-57f7-4b51-8c5a-51cea57ce925</string>\n<string>10772</string>\n<string>1.633197</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAA5gAAAP8LAAAAAAAAAALYAAAAzKhQIP5njgBXRDA1AAAAAMyoUCD+Z44AV0QwNgAAAADMkBAQAQAAAMyoUCD+Z44AV0QwOQAAAADMqFAg/meOAFdEMTAAAAAAzKhQIA5ojgBKVDA1AAAAAMyoUCAOaI4ASlQwNgAAAADMqFAg02mOAEpUMDcAAAAAzKhQIFdujgBKVDA4AAAAAMyoUCBXbo4AV0QxMQAAAADMqFAgV26OAFdEMTIAAAAAzKhQIFdujgBXRDEzAAAAAIChgDAhIQC191dRS4xaUc6lfOklAAAAAICJEBAUKgAA"
  },
  "message": ""
}

Event ID 40034

Provider: MSExchangeIS
Channel: Application
Level: 3

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 40034,
    "version": 0,
    "level": 3,
    "task": 7,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:48.073399+00:00",
    "event_record_id": 4922,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "W0RJQUdfQ1RYXQAAFgAAAP8GAAAAAAAAAAIIAAAAgIkQEPxIAAA="
  },
  "message": ""
}

Event ID 40035

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 40035,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:48.120275+00:00",
    "event_record_id": 4923,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>{\n  \"TrackAllLockAcquisition\":false,\n  \"LogPath\":\"%ExchangeInstallDir%\\\\Logging\\\\Store\\\\\",\n  \"ThreadHangDetectionTimeout\":\"02:00:00\",\n  \"MaintenanceControlPeriod\":\"00:30:00\",\n  \"MaintenanceItemsAgeInstrumentationTaskPeriod\":\"00:01:00\",\n  \"DefaultMaximumRpcThreads\":100,\n  \"MaximumAdminRpcThreads\":100,\n  \"RpcThreadCountBuffer\":5,\n  \"PerUserCacheSize\":1000,\n  \"PerUserCacheExpirationInMinutes\":\"00:10:00\",\n  \"UrgentTombstoneTableCleanupTaskRecurrenceInterval\":\"00:05:07\",\n  \"DirectIndexUpdateInstrumentation\":false,\n  \"IndexUpdateBreadcrumbsInstrumentation\":false,\n  \"EseConfigOverrides\":{},\n  \"InstanceStatusTimeoutSeconds\":\"00:00:10\",\n  \"DiscoverPotentiallyExpiredMailboxesTaskPeriod\":\"1.00:00:00\",\n  \"DiscoverPotentiallyDisabledMailboxesTaskPeriod\":\"1.00:00:00\",\n  \"MaxIdleCleanupPeriod\":\"30.00:00:00\",\n  \"MailboxWideIndicesMaxIdleCleanupPeriodFactor\":24,\n  \"StopMaintenanceThreshold\":50000,\n  \"WlmMaintenanceThreshold\":100000,\n  \"NumberOfRecordsToMaintain\":5000,\n  \"NumberOfRecordsToReadFromMaintenanceTable\":20000,\n  \"MaintenanceTimePeriodToKeep\":\"30.00:00:00\",\n  \"WlmMinNumberOfChunksToProceed\":1,\n  \"EnableReadFromPassive\":true,\n  \"EnableDbDivergenceDetection\":false,\n  \"MailboxMaintenanceIntervalMinutes\":1440,\n  \"MailboxMaintenanceInteractiveLogonDelay\":\"6.00:00:00\",\n  \"EnableDatabaseUnusedSpaceScrubbing\":true,\n  \"EseLrukCorrInterval\":\"00:00:00.1280000\",\n  \"EseLrukTimeout\":\"00:01:40\",\n  \"MailboxInfoCacheSize\":1000,\n  \"MailboxInfoCacheTTL\":\"00:15:00\",\n  \"ForeignMailboxInfoCacheSize\":1000,\n  \"ForeignMailboxInfoCacheTTL\":\"00:15:00\",\n  \"AddressInfoCacheSize\":1000,\n  \"AddressInfoCacheTTL\":\"00:15:00\",\n  \"IncompleteAddressInfoCacheSize\":1000,\n  \"IncompleteAddressInfoCacheTTL\":\"00:15:00\",\n  \"ForeignAddressInfoCacheSize\":1000,\n  \"ForeignAddressInfoCacheTTL\":\"00:15:00\",\n  \"DatabaseInfoCacheSize\":1000,\n  \"DatabaseInfoCacheTTL\":\"02:13:00\",\n  \"OrganizationContainerCacheSize\":100,\n  \"OrganizationContainerCacheTTL\":\"00:15:00\",\n  \"ClientSecurityContextCacheTTL\":\"00:05:00\",\n  \"MaterializedRestrictionSearchFolderConfigStage\":1,\n  \"ServerInfoCacheTTL\":\"02:13:00\",\n  \"TransportInfoCacheTTL\":\"02:13:00\",\n  \"DatabaseMountTimeout\":\"01:30:00\",\n  \"QuarantineTaskRunInterval\":\"00:01:00\",\n  \"MetaCacheDatabaseTableSpaceUsageInventoryDelay\":\"00:10:00\",\n  \"MetaCacheDatabaseTableSpaceUsageInventoryInterval\":\"1.00:00:00\",\n  \"MetaCacheDatabaseSpaceUsageMonitorInterval\":\"00:05:00\",\n  \"MetaCacheDatabaseFolderSpaceUsageInventoryDelay\":\"00:10:00\",\n  \"MetaCacheDatabaseFolderSpaceUsageInventoryInterval\":\"1.00:00:00\",\n  \"DecommissionFast\":true,\n  \"EnableDefragmentSequentialBTrees\":true,\n  \"BigFunnelInMemoryFilterTableCacheSize\":20,\n  \"BigFunnelInMemoryFilterTableCacheTTL\":\"00:05:00\",\n  \"BigFunnelInMemoryAttributeVectorTableCacheSize\":20,\n  \"BigFunnelInMemoryAttributeVectorTableCacheTTL\":\"00:15:00\",\n  \"BigFunnelPostingListDirectoryCacheSize\":20,\n  \"BigFunnelPostingListDirectoryCacheTTL\":\"00:15:00\",\n  \"BigFunnelOnPagePOIThreshold\":2048,\n  \"BigFunnelDatabaseStatisticsIsEnabled\":true,\n  \"StopMountDatabaseWithOutOfDateIndex\":false,\n  \"BigFunnelDefaultL1RankerFeatures\":[\"BM25f_simple\"],\n  \"BigFunnelDefaultL1RankerWeights\":[1.526E-05],\n  \"BigFunnelDefaultL1RankerAddExtractionFeatures\":true,\n  \"BigFunnelDefaultL1RankerItemAgeHalfLife\":\"7.00:00:00\",\n  \"BigFunnelDefaultL1RankerItemAgeWeight\":2.0,\n  \"BigFunnelEnableRankerPreload\":true,\n  \"MetaCacheDatabaseCachePriorityOnActive\":5,\n  \"MetaCacheDatabaseCachePriorityOnPassive\":5,\n  \"EnableLcidRemapping\":false,\n  \"ReplayIgnoreLogRecordsBeforeMinRequiredLog\":true,\n  \"DatabaseCacheSizePassiveActiveRatioPct\":20\n}</string>\n<string>{\n  \"Guid\": \"c00cf515-885b-4005-885c-b0562e768287\",\n  \"ServerName\": \"EX-DC01-2022.ludus.domain\",\n  \"ForestName\": \"LUDUS\",\n  \"ExchangeLegacyDN\": \"/o=ludus/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EX-DC01-2022\",\n  \"InstallPath\": \"C:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V15\",\n  \"IsMultiRole\": true,\n  \"ContinuousReplicationMaxMemoryPerDatabase\": 10485760,\n  \"Edition\": 2,\n  \"MaxRecoveryDatabases\": 1,\n  \"MaxTotalDatabases\": 5,\n  \"DatabaseOptions\": {\n    \"BackgroundDatabaseMaintenance\": true,\n    \"ReplayBackgroundDatabaseMaintenance\": true\n  }\n}</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAAHgAAAP8GAAAAAAAAAAIQAAAAgIkQEPxIAACAiRAQ/EgAAA=="
  },
  "message": ""
}

Event ID 40036

Provider: MSExchangeIS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchangeIS",
    "guid": "",
    "event_source_name": "",
    "event_id": 40036,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:52.745319+00:00",
    "event_record_id": 4925,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>b5002121-57f7-4b51-8c5a-51cea57ce925</string>\n<string>{\n  \"TrackAllLockAcquisition\":false,\n  \"LogPath\":\"%ExchangeInstallDir%\\\\Logging\\\\Store\\\\\",\n  \"ThreadHangDetectionTimeout\":\"02:00:00\",\n  \"MaintenanceControlPeriod\":\"00:30:00\",\n  \"MaintenanceItemsAgeInstrumentationTaskPeriod\":\"00:01:00\",\n  \"DefaultMaximumRpcThreads\":100,\n  \"MaximumAdminRpcThreads\":100,\n  \"RpcThreadCountBuffer\":5,\n  \"PerUserCacheSize\":1000,\n  \"PerUserCacheExpirationInMinutes\":\"00:10:00\",\n  \"UrgentTombstoneTableCleanupTaskRecurrenceInterval\":\"00:05:07\",\n  \"DirectIndexUpdateInstrumentation\":false,\n  \"IndexUpdateBreadcrumbsInstrumentation\":false,\n  \"EseConfigOverrides\":{},\n  \"InstanceStatusTimeoutSeconds\":\"00:00:10\",\n  \"DiscoverPotentiallyExpiredMailboxesTaskPeriod\":\"1.00:00:00\",\n  \"DiscoverPotentiallyDisabledMailboxesTaskPeriod\":\"1.00:00:00\",\n  \"MaxIdleCleanupPeriod\":\"30.00:00:00\",\n  \"MailboxWideIndicesMaxIdleCleanupPeriodFactor\":24,\n  \"StopMaintenanceThreshold\":50000,\n  \"WlmMaintenanceThreshold\":100000,\n  \"NumberOfRecordsToMaintain\":5000,\n  \"NumberOfRecordsToReadFromMaintenanceTable\":20000,\n  \"MaintenanceTimePeriodToKeep\":\"30.00:00:00\",\n  \"WlmMinNumberOfChunksToProceed\":1,\n  \"EnableReadFromPassive\":true,\n  \"EnableDbDivergenceDetection\":false,\n  \"MailboxMaintenanceIntervalMinutes\":1440,\n  \"MailboxMaintenanceInteractiveLogonDelay\":\"6.00:00:00\",\n  \"EnableDatabaseUnusedSpaceScrubbing\":true,\n  \"EseLrukCorrInterval\":\"00:00:00.1280000\",\n  \"EseLrukTimeout\":\"00:01:40\",\n  \"MailboxInfoCacheSize\":1000,\n  \"MailboxInfoCacheTTL\":\"00:15:00\",\n  \"ForeignMailboxInfoCacheSize\":1000,\n  \"ForeignMailboxInfoCacheTTL\":\"00:15:00\",\n  \"AddressInfoCacheSize\":1000,\n  \"AddressInfoCacheTTL\":\"00:15:00\",\n  \"IncompleteAddressInfoCacheSize\":1000,\n  \"IncompleteAddressInfoCacheTTL\":\"00:15:00\",\n  \"ForeignAddressInfoCacheSize\":1000,\n  \"ForeignAddressInfoCacheTTL\":\"00:15:00\",\n  \"DatabaseInfoCacheSize\":1000,\n  \"DatabaseInfoCacheTTL\":\"02:13:00\",\n  \"OrganizationContainerCacheSize\":100,\n  \"OrganizationContainerCacheTTL\":\"00:15:00\",\n  \"ClientSecurityContextCacheTTL\":\"00:05:00\",\n  \"MaterializedRestrictionSearchFolderConfigStage\":1,\n  \"ServerInfoCacheTTL\":\"02:13:00\",\n  \"TransportInfoCacheTTL\":\"02:13:00\",\n  \"DatabaseMountTimeout\":\"01:30:00\",\n  \"QuarantineTaskRunInterval\":\"00:01:00\",\n  \"MetaCacheDatabaseTableSpaceUsageInventoryDelay\":\"00:10:00\",\n  \"MetaCacheDatabaseTableSpaceUsageInventoryInterval\":\"1.00:00:00\",\n  \"MetaCacheDatabaseSpaceUsageMonitorInterval\":\"00:05:00\",\n  \"MetaCacheDatabaseFolderSpaceUsageInventoryDelay\":\"00:10:00\",\n  \"MetaCacheDatabaseFolderSpaceUsageInventoryInterval\":\"1.00:00:00\",\n  \"DecommissionFast\":true,\n  \"EnableDefragmentSequentialBTrees\":true,\n  \"BigFunnelInMemoryFilterTableCacheSize\":20,\n  \"BigFunnelInMemoryFilterTableCacheTTL\":\"00:05:00\",\n  \"BigFunnelInMemoryAttributeVectorTableCacheSize\":20,\n  \"BigFunnelInMemoryAttributeVectorTableCacheTTL\":\"00:15:00\",\n  \"BigFunnelPostingListDirectoryCacheSize\":20,\n  \"BigFunnelPostingListDirectoryCacheTTL\":\"00:15:00\",\n  \"BigFunnelOnPagePOIThreshold\":2048,\n  \"BigFunnelDatabaseStatisticsIsEnabled\":true,\n  \"StopMountDatabaseWithOutOfDateIndex\":false,\n  \"BigFunnelDefaultL1RankerFeatures\":[\"BM25f_simple\"],\n  \"BigFunnelDefaultL1RankerWeights\":[1.526E-05],\n  \"BigFunnelDefaultL1RankerAddExtractionFeatures\":true,\n  \"BigFunnelDefaultL1RankerItemAgeHalfLife\":\"7.00:00:00\",\n  \"BigFunnelDefaultL1RankerItemAgeWeight\":2.0,\n  \"BigFunnelEnableRankerPreload\":true,\n  \"MetaCacheDatabaseCachePriorityOnActive\":5,\n  \"MetaCacheDatabaseCachePriorityOnPassive\":5,\n  \"EnableLcidRemapping\":false,\n  \"ReplayIgnoreLogRecordsBeforeMinRequiredLog\":true,\n  \"DatabaseCacheSizePassiveActiveRatioPct\":20\n}</string>\n",
    "Binary": "W0RJQUdfQ1RYXQAAFgAAAP8BAAAAAAAAAAIIAAAAgIkQEFxmAAA="
  },
  "message": ""
}

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

MSExchangeIS

Event ID 1020

Fields #

Example Event #

Event ID 1024

Fields #

Example Event #

Event ID 1040

Fields #

Example Event #

Event ID 1041

Fields #

Example Event #

Event ID 1074

Fields #

Example Event #

Event ID 1075

Fields #

Example Event #

Event ID 40008

Fields #

Example Event #

Event ID 40018

Fields #

Example Event #

Event ID 40028

Fields #

Example Event #

Event ID 40034

Fields #

Example Event #

Event ID 40035

Fields #

Example Event #

Event ID 40036

Fields #

Example Event #

Keyboard shortcuts

Search operators