EVID 4826 : Boot Configuration Data Loaded

Event Details

Event Type	Boot Configuration Data Loaded
Event Description	4826(S) : Boot Configuration Data Loaded
Event ID	4826
Vendor Documentation	https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4826

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there isNo value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	N/A	<vmid>
Version	N/A	N/A
Level	N/A	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	N/A	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Channel	N/A	N/A
Computer	N/A	<dname>
SubjectUserSid	N/A	N/A
SubjectUserName	N/A	N/A
SubjectDomainName	N/A	N/A
SubjectLogonId	N/A	N/A
LoadOptions	N/A	N/A
AdvancedOptions	N/A	N/A
ConfigAccessPolicy	N/A	<policy>
RemoteEventLogging	N/A	N/A
KernelDebug	N/A	N/A
VsmLaunchType	N/A	N/A
TestSigning	N/A	N/A
FlightSigning	N/A	N/A
DisableIntegrityChecks	N/A	<status>
HypervisorLoadOptions	N/A	N/A
HypervisorLaunchType	N/A	N/A
HypervisorDebug	N/A	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

N/A

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1012327	V 2.0 : EVID 4826 : Boot Configuration Data Loaded	Base Rule	Configuration Loaded : System	Configuration