EVID 7001-7002: CEIP Notification (Part 1)

Vendor Documentation

https://windows-event-explorer.app.elstc.co/publisher/Microsoft-Windows-Winlogon/event/7001/v0

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	<process>	<tag2>
EventID Qualifiers	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	N/A	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	<processid> <session>	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
Security	<domain> <login>	N/A
TSId	N/A	N/A
UserSid	<domain> <login>	<domainorigin> <login>
param1	N/A	<process>
param2	N/A	N/A
param3	N/A	<reason>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1008322	EVID 7001-7002: CEIP Notification	Base Rule	Authentication Activity	Authentication Success
	EVID 7001: CEIP User Logon Notification	Sub Rule	User Logon	Authentication Success
	EVID 7002: CEIP User Logoff Notification	Sub Rule	User Logoff	Authentication Success

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1012912	V 2.0 : EVID 7001: General Log Message	Base Rule	General Information Log Message	Information
	V 2.0 : EVID 7001: Winlogon: User Logon Notif Evnt	Sub Rule	General Notification	Information
	V 2.0 : EVID 7001: Svc Cntrl Mngr: Svc Failre Evnt	Sub Rule	Failed Service Start	Error