Breadcrumbs

EVID 4698-4702 : Scheduled Task Events (XML - Security)

Event Details

Event Type

Audit Other Object Access Events

Event Description

  • 4698(S)

    : A scheduled task was created.

  • 4699(S)

    : A scheduled task was deleted.

  • 4700(S): A scheduled task was enabled.

  • 4701(S): A scheduled task was disabled.

  • 4702(S): A scheduled task was updated.

Event IDs

4698, 4699, 4700, 4701, 4702

Log Fields and Parsing

This section details the log fields available in this log message type and values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means no value is parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

Provider

N/A

N/A

EventID

<vmid>

<vmid>

Version

N/A

N/A

Level

<severity>

<severity>

Task

<vendorinfo>

<vendorinfo>

Opcode

N/A

N/A

Keywords

<command>

<result>

TimeCreated

N/A

N/A

EventRecordID

N/A

N/A

Correlation

N/A

N/A

Execution

N/A

N/A

Channel

N/A

N/A

Computer

<dname>

<dname>

SubjectUserSid

N/A

N/A

SubjectUserName

<login>

<login>

SubjectDomainName

<domain>

<domainorigin>

SubjectLogonId

<session>

<session>

TaskName

<parentprocesspath>, <process>

<objecttype>

TaskContent

 N/A

N/A

LogonType

N/A

<sessiontype>

Command

N/A

<command>

Arguments

N/A

<object>

LogonTrigger/BootTrigger

N/A

<subject>

Enabled

N/A

<status>

Title

N/A

<object>

Body

N/A

<objectname>

ClientProcessId

N/A

<processid>

ParentProcessId

N/A

<parentprocessid>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Event

Classification

1007846

EVID 4698 - 4702: Scheduled Task Events

Base Rule

Configuration Enabled: System

Configuration

EVID 4702: Scheduled Task Updated

Sub Rule

Configuration Enabled: System

Configuration

EVID 4701: Scheduled Task Disabled

Sub Rule

Configuration Disabled: System

Configuration

EVID 4700: Scheduled Task Enabled

Sub Rule

Configuration Enabled: System

Configuration

EVID 4699: Scheduled Task Deleted

Sub Rule

Configuration Deleted: System

Configuration

EVID 4698: Scheduled Task Created

Sub Rule

Configuration Enabled: System

Configuration

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Common Event

Classification

1013657

V 2.0 : EVID 4698 : Scheduled Task Created

Base Rule

Scheduled Task Created

Information

1013659

V 2.0 : EVID 4699 : Scheduled Task Deleted

Base Rule

Configuration Deleted: System

Configuration

1013660

V 2.0 : EVID 4700 : Scheduled Task Enabled

Base Rule

Configuration Enabled : System

Configuration

1013661

V 2.0 : EVID 4701 : Scheduled Task Disabled

Base Rule

Configuration Disabled : System

Configuration

1013658

V 2.0 : EVID 4702 : Scheduled Task Updated

Base Rule

Configuration Modified : System

Configuration