Windows Event Logs (EVTX)
| Artifact | Description | Article |
|---|---|---|
| Security.evtx | 13 Event IDs: logons, Kerberos, NTLM, RDP | Read → |
| Terminal Services | RDP session lifecycle (LSM, RDPClient, RCM, RdpCoreTS) | Read → |
| SMB | SMB server and client connections | Read → |
| Sysmon | Event ID 3: network connections on lateral-movement service ports | Read → |
| Prefetch | Evidence of program execution on Windows | Read → |
Linux
| Artifact | Description | Article |
|---|---|---|
| Linux Logs | auth.log, secure, messages, audit.log, systemd-journald, utmp, wtmp, btmp, lastlog — loose, in zip / tar.gz, or UAC triages | Read → |
Other Sources
| Artifact | Description | Article |
|---|---|---|
| Winlogbeat | Windows log parsing from JSON format | Read → |
| Cortex XDR | Network data and forensic agent collections | Read → |
| Custom parsers | VPN, firewall, proxy and JSON logs via YAML rules | Read → |
Total: 33 Windows Event IDs across 12 EVTX sources + 9 Linux artifact types + Winlogbeat JSON + Cortex XDR + YAML custom parsers.