Windows Security Log Events

All Sources
Windows Audit
SharePoint Audit (LOGbinder for SharePoint)
SQL Server Audit (LOGbinder for SQL Server)
Exchange Audit (LOGbinder for Exchange)
Sysmon (MS Sysinternals Sysmon)

SQL Server Audit Action Group:

Action Group All

SQL Server	24000	SQL audit event
SQL Server	24001	Login succeeded (action_id LGIS)
SQL Server	24002	Logout succeeded (action_id LGO)
SQL Server	24003	Login failed (action_id LGIF)
SQL Server	24004	Change own password succeeded (action_id PWCS; class_type LX)
SQL Server	24005	Change own password failed (action_id PWCS; class_type LX)
SQL Server	24006	Change password succeeded (action_id PWC class_type LX)
SQL Server	24007	Change password failed (action_id PWC class_type LX)
SQL Server	24008	Reset own password succeeded (action_id PWRS; class_type LX)
SQL Server	24009	Reset own password failed (action_id PWRS; class_type LX)
SQL Server	24010	Reset password succeeded (action_id PWR; class_type LX)
SQL Server	24011	Reset password failed (action_id PWR; class_type LX)
SQL Server	24012	Must change password (action_id PWMC)
SQL Server	24013	Account unlocked (action_id PWU)
SQL Server	24014	Change application role password succeeded (action_id PWC; class_type AR)
SQL Server	24015	Change application role password failed (action_id PWC class_type AR)
SQL Server	24016	Add member to server role succeeded (action_id APRL class_type SG)
SQL Server	24017	Add member to server role failed (action_id APRL class_type SG)
SQL Server	24018	Remove member from server role succeeded (action_id DPRL class_type SG)
SQL Server	24019	Remove member from server role failed (action_id DPRL class_type SG)
SQL Server	24020	Add member to database role succeeded (action_id APRL class_type RL)
SQL Server	24021	Add member to database role failed (action_id APRL class_type RL)
SQL Server	24022	Remove member from database role succeeded (action_id DPRL class_type RL)
SQL Server	24023	Remove member from database role failed (action_id DPRL class_type RL)
SQL Server	24024	Issued database backup command (action_id BA class_type DB)
SQL Server	24025	Issued transaction log backup command (action_id BAL)
SQL Server	24026	Issued database restore command (action_id RS class_type DB)
SQL Server	24027	Issued transaction log restore command (action_id RS class_type DB)
SQL Server	24028	Issued database console command (action_id DBCC)
SQL Server	24029	Issued a bulk administration command (action_id ADBO)
SQL Server	24030	Issued an alter connection command (action_id ALCN)
SQL Server	24031	Issued an alter resources command (action_id ALRS)
SQL Server	24032	Issued an alter server state command (action_id ALSS)
SQL Server	24033	Issued an alter server settings command (action_id ALST)
SQL Server	24034	Issued a view server state command (action_id VSST)
SQL Server	24035	Issued an external access assembly command (action_id XA)
SQL Server	24036	Issued an unsafe assembly command (action_id XU)
SQL Server	24037	Issued an alter resource governor command (action_id ALRS class_type RG)
SQL Server	24038	Issued a database authenticate command (action_id AUTH)
SQL Server	24039	Issued a database checkpoint command (action_id CP)
SQL Server	24040	Issued a database show plan command (action_id SPLN)
SQL Server	24041	Issued a subscribe to query information command (action_id SUQN)
SQL Server	24042	Issued a view database state command (action_id VDST)
SQL Server	24043	Issued a change server audit command (action_id AL class_type A)
SQL Server	24044	Issued a change server audit specification command (action_id AL class_type SA)
SQL Server	24045	Issued a change database audit specification command (action_id AL class_type DA)
SQL Server	24046	Issued a create server audit command (action_id CR class_type A)
SQL Server	24047	Issued a create server audit specification command (action_id CR class_type SA)
SQL Server	24048	Issued a create database audit specification command (action_id CR class_type DA)
SQL Server	24049	Issued a delete server audit command (action_id DR class_type A)
SQL Server	24050	Issued a delete server audit specification command (action_id DR class_type SA)
SQL Server	24051	Issued a delete database audit specification command (action_id DR class_type DA)
SQL Server	24052	Audit failure (action_id AUSF)
SQL Server	24053	Audit session changed (action_id AUSC)
SQL Server	24054	Started SQL server (action_id SVSR)
SQL Server	24055	Paused SQL server (action_id SVPD)
SQL Server	24056	Resumed SQL server (action_id SVCN)
SQL Server	24057	Stopped SQL server (action_id SVSD)
SQL Server	24058	Issued a create server object command (action_id CR; class_type AG, EP, SD, SE, T)
SQL Server	24059	Issued a change server object command (action_id AL; class_type AG, EP, SD, SE, T)
SQL Server	24060	Issued a delete server object command (action_id DR; class_type AG, EP, SD, SE, T)
SQL Server	24061	Issued a create server setting command (action_id CR class_type SR)
SQL Server	24062	Issued a change server setting command (action_id AL class_type SR)
SQL Server	24063	Issued a delete server setting command (action_id DR class_type SR)
SQL Server	24064	Issued a create server cryptographic provider command (action_id CR class_type CP)
SQL Server	24065	Issued a delete server cryptographic provider command (action_id DR class_type CP)
SQL Server	24066	Issued a change server cryptographic provider command (action_id AL class_type CP)
SQL Server	24067	Issued a create server credential command (action_id CR class_type CD)
SQL Server	24068	Issued a delete server credential command (action_id DR class_type CD)
SQL Server	24069	Issued a change server credential command (action_id AL class_type CD)
SQL Server	24070	Issued a change server master key command (action_id AL class_type MK)
SQL Server	24071	Issued a back up server master key command (action_id BA class_type MK)
SQL Server	24072	Issued a restore server master key command (action_id RS class_type MK)
SQL Server	24073	Issued a map server credential to login command (action_id CMLG)
SQL Server	24074	Issued a remove map between server credential and login command (action_id NMLG)
SQL Server	24075	Issued a create server principal command (action_id CR class_type LX, SL)
SQL Server	24076	Issued a delete server principal command (action_id DR class_type LX, SL)
SQL Server	24077	Issued a change server principal credentials command (action_id CCLG)
SQL Server	24078	Issued a disable server principal command (action_id LGDA)
SQL Server	24079	Issued a change server principal default database command (action_id LGDB)
SQL Server	24080	Issued an enable server principal command (action_id LGEA)
SQL Server	24081	Issued a change server principal default language command (action_id LGLG)
SQL Server	24082	Issued a change server principal password expiration command (action_id PWEX)
SQL Server	24083	Issued a change server principal password policy command (action_id PWPL)
SQL Server	24084	Issued a change server principal name command (action_id LGNM)
SQL Server	24085	Issued a create database command (action_id CR class_type DB)
SQL Server	24086	Issued a change database command (action_id AL class_type DB)
SQL Server	24087	Issued a delete database command (action_id DR class_type DB)
SQL Server	24088	Issued a create certificate command (action_id CR class_type CR)
SQL Server	24089	Issued a change certificate command (action_id AL class_type CR)
SQL Server	24090	Issued a delete certificate command (action_id DR class_type CR)
SQL Server	24091	Issued a back up certificate command (action_id BA class_type CR)
SQL Server	24092	Issued an access certificate command (action_id AS class_type CR)
SQL Server	24093	Issued a create asymmetric key command (action_id CR class_type AK)
SQL Server	24094	Issued a change asymmetric key command (action_id AL class_type AK)
SQL Server	24095	Issued a delete asymmetric key command (action_id DR class_type AK)
SQL Server	24096	Issued an access asymmetric key command (action_id AS class_type AK)
SQL Server	24097	Issued a create database master key command (action_id CR class_type MK)
SQL Server	24098	Issued a change database master key command (action_id AL class_type MK)
SQL Server	24099	Issued a delete database master key command (action_id DR class_type MK)
SQL Server	24100	Issued a back up database master key command (action_id BA class_type MK)
SQL Server	24101	Issued a restore database master key command (action_id RS class_type MK)
SQL Server	24102	Issued an open database master key command (action_id OP class_type MK)
SQL Server	24103	Issued a create database symmetric key command (action_id CR class_type SK)
SQL Server	24104	Issued a change database symmetric key command (action_id AL class_type SK)
SQL Server	24105	Issued a delete database symmetric key command (action_id DR class_type SK)
SQL Server	24106	Issued a back up database symmetric key command (action_id BA class_type SK)
SQL Server	24107	Issued an open database symmetric key command (action_id OP class_type SK)
SQL Server	24108	Issued a create database object command (action_id CR)
SQL Server	24109	Issued a change database object command (action_id AL)
SQL Server	24110	Issued a delete database object command (action_id DR)
SQL Server	24111	Issued an access database object command (action_id AS)
SQL Server	24112	Issued a create assembly command (action_id CR class_type AS)
SQL Server	24113	Issued a change assembly command (action_id AL class_type AS)
SQL Server	24114	Issued a delete assembly command (action_id DR class_type AS)
SQL Server	24115	Issued a create schema command (action_id CR class_type SC)
SQL Server	24116	Issued a change schema command (action_id AL class_type SC)
SQL Server	24117	Issued a delete schema command (action_id DR class_type SC)
SQL Server	24118	Issued a create database encryption key command (action_id CR class_type DK)
SQL Server	24119	Issued a change database encryption key command (action_id AL class_type DK)
SQL Server	24120	Issued a delete database encryption key command (action_id DR class_type DK)
SQL Server	24121	Issued a create database user command (action_id CR; class_type US)
SQL Server	24122	Issued a change database user command (action_id AL; class_type US)
SQL Server	24123	Issued a delete database user command (action_id DR; class_type US)
SQL Server	24124	Issued a create database role command (action_id CR class_type RL)
SQL Server	24125	Issued a change database role command (action_id AL class_type RL)
SQL Server	24126	Issued a delete database role command (action_id DR class_type RL)
SQL Server	24127	Issued a create application role command (action_id CR class_type AR)
SQL Server	24128	Issued a change application role command (action_id AL class_type AR)
SQL Server	24129	Issued a delete application role command (action_id DR class_type AR)
SQL Server	24130	Issued a change database user login command (action_id USAF)
SQL Server	24131	Issued an auto-change database user login command (action_id USLG)
SQL Server	24132	Issued a create schema object command (action_id CR class_type D)
SQL Server	24133	Issued a change schema object command (action_id AL class_type D)
SQL Server	24134	Issued a delete schema object command (action_id DR class_type D)
SQL Server	24135	Issued a transfer schema object command (action_id TRO class_type D)
SQL Server	24136	Issued a create schema type command (action_id CR class_type TY)
SQL Server	24137	Issued a change schema type command (action_id AL class_type TY)
SQL Server	24138	Issued a delete schema type command (action_id DR class_type TY)
SQL Server	24139	Issued a transfer schema type command (action_id TRO class_type TY)
SQL Server	24140	Issued a create XML schema collection command (action_id CR class_type SX)
SQL Server	24141	Issued a change XML schema collection command (action_id AL class_type SX)
SQL Server	24142	Issued a delete XML schema collection command (action_id DR class_type SX)
SQL Server	24143	Issued a transfer XML schema collection command (action_id TRO class_type SX)
SQL Server	24144	Issued an impersonate within server scope command (action_id IMP; class_type LX)
SQL Server	24145	Issued an impersonate within database scope command (action_id IMP; class_type US)
SQL Server	24146	Issued a change server object owner command (action_id TO class_type SG)
SQL Server	24147	Issued a change database owner command (action_id TO class_type DB)
SQL Server	24148	Issued a change schema owner command (action_id TO class_type SC)
SQL Server	24150	Issued a change role owner command (action_id TO class_type RL)
SQL Server	24151	Issued a change database object owner command (action_id TO)
SQL Server	24152	Issued a change symmetric key owner command (action_id TO class_type SK)
SQL Server	24153	Issued a change certificate owner command (action_id TO class_type CR)
SQL Server	24154	Issued a change asymmetric key owner command (action_id TO class_type AK)
SQL Server	24155	Issued a change schema object owner command (action_id TO class_type OB)
SQL Server	24156	Issued a change schema type owner command (action_id TO class_type TY)
SQL Server	24157	Issued a change XML schema collection owner command (action_id TO class_type SX)
SQL Server	24158	Grant server permissions succeeded (action_id G class_type SR)
SQL Server	24159	Grant server permissions failed (action_id G class_type SR)
SQL Server	24160	Grant server permissions with grant succeeded (action_id GWG class_type SR)
SQL Server	24161	Grant server permissions with grant failed (action_id GWG class_type SR)
SQL Server	24162	Deny server permissions succeeded (action_id D class_type SR)
SQL Server	24163	Deny server permissions failed (action_id D class_type SR)
SQL Server	24164	Deny server permissions with cascade succeeded (action_id DWC class_type SR)
SQL Server	24165	Deny server permissions with cascade failed (action_id DWC class_type SR)
SQL Server	24166	Revoke server permissions succeeded (action_id R class_type SR)
SQL Server	24167	Revoke server permissions failed (action_id R class_type SR)
SQL Server	24168	Revoke server permissions with grant succeeded (action_id RWG class_type SR)
SQL Server	24169	Revoke server permissions with grant failed (action_id RWG class_type SR)
SQL Server	24170	Revoke server permissions with cascade succeeded (action_id RWC class_type SR)
SQL Server	24171	Revoke server permissions with cascade failed (action_id RWC class_type SR)
SQL Server	24172	Issued grant server object permissions command (action_id G; class_type LX)
SQL Server	24173	Issued grant server object permissions with grant command (action_id GWG; class_type LX)
SQL Server	24174	Issued deny server object permissions command (action_id D; class_type LX)
SQL Server	24175	Issued deny server object permissions with cascade command (action_id DWC; class_type LX)
SQL Server	24176	Issued revoke server object permissions command (action_id R; class_type LX)
SQL Server	24177	Issued revoke server object permissions with grant command (action_id; RWG class_type LX)
SQL Server	24178	Issued revoke server object permissions with cascade command (action_id RWC; class_type LX)
SQL Server	24179	Grant database permissions succeeded (action_id G class_type DB)
SQL Server	24180	Grant database permissions failed (action_id G class_type DB)
SQL Server	24181	Grant database permissions with grant succeeded (action_id GWG class_type DB)
SQL Server	24182	Grant database permissions with grant failed (action_id GWG class_type DB)
SQL Server	24183	Deny database permissions succeeded (action_id D class_type DB)
SQL Server	24184	Deny database permissions failed (action_id D class_type DB)
SQL Server	24185	Deny database permissions with cascade succeeded (action_id DWC class_type DB)
SQL Server	24186	Deny database permissions with cascade failed (action_id DWC class_type DB)
SQL Server	24187	Revoke database permissions succeeded (action_id R class_type DB)
SQL Server	24188	Revoke database permissions failed (action_id R class_type DB)
SQL Server	24189	Revoke database permissions with grant succeeded (action_id RWG class_type DB)
SQL Server	24190	Revoke database permissions with grant failed (action_id RWG class_type DB)
SQL Server	24191	Revoke database permissions with cascade succeeded (action_id RWC class_type DB)
SQL Server	24192	Revoke database permissions with cascade failed (action_id RWC class_type DB)
SQL Server	24193	Issued grant database object permissions command (action_id G class_type US)
SQL Server	24194	Issued grant database object permissions with grant command (action_id GWG; class_type US)
SQL Server	24195	Issued deny database object permissions command (action_id D; class_type US)
SQL Server	24196	Issued deny database object permissions with cascade command (action_id DWC; class_type US)
SQL Server	24197	Issued revoke database object permissions command (action_id R; class_type US)
SQL Server	24198	Issued revoke database object permissions with grant command (action_id RWG; class_type US)
SQL Server	24199	Issued revoke database object permissions with cascade command (action_id RWC; class_type US)
SQL Server	24200	Issued grant schema permissions command (action_id G class_type SC)
SQL Server	24201	Issued grant schema permissions with grant command (action_id GWG class_type SC)
SQL Server	24202	Issued deny schema permissions command (action_id D class_type SC)
SQL Server	24203	Issued deny schema permissions with cascade command (action_id DWC class_type SC)
SQL Server	24204	Issued revoke schema permissions command (action_id R class_type SC)
SQL Server	24205	Issued revoke schema permissions with grant command (action_id RWG class_type SC)
SQL Server	24206	Issued revoke schema permissions with cascade command (action_id RWC class_type SC)
SQL Server	24207	Issued grant assembly permissions command (action_id G class_type AS)
SQL Server	24208	Issued grant assembly permissions with grant command (action_id GWG class_type AS)
SQL Server	24209	Issued deny assembly permissions command (action_id D class_type AS)
SQL Server	24210	Issued deny assembly permissions with cascade command (action_id DWC class_type AS)
SQL Server	24211	Issued revoke assembly permissions command (action_id R class_type AS)
SQL Server	24212	Issued revoke assembly permissions with grant command (action_id RWG class_type AS)
SQL Server	24213	Issued revoke assembly permissions with cascade command (action_id RWC class_type AS)
SQL Server	24214	Issued grant database role permissions command (action_id G class_type RL)
SQL Server	24215	Issued grant database role permissions with grant command (action_id GWG class_type RL)
SQL Server	24216	Issued deny database role permissions command (action_id D class_type RL)
SQL Server	24217	Issued deny database role permissions with cascade command (action_id DWC class_type RL)
SQL Server	24218	Issued revoke database role permissions command (action_id R class_type RL)
SQL Server	24219	Issued revoke database role permissions with grant command (action_id RWG class_type RL)
SQL Server	24220	Issued revoke database role permissions with cascade command (action_id RWC class_type RL)
SQL Server	24221	Issued grant application role permissions command (action_id G class_type AR)
SQL Server	24222	Issued grant application role permissions with grant command (action_id GWG class_type AR)
SQL Server	24223	Issued deny application role permissions command (action_id D class_type AR)
SQL Server	24224	Issued deny application role permissions with cascade command (action_id DWC class_type AR)
SQL Server	24225	Issued revoke application role permissions command (action_id R class_type AR)
SQL Server	24226	Issued revoke application role permissions with grant command (action_id RWG class_type AR)
SQL Server	24227	Issued revoke application role permissions with cascade command (action_id RWC class_type AR)
SQL Server	24228	Issued grant symmetric key permissions command (action_id G class_type SK)
SQL Server	24229	Issued grant symmetric key permissions with grant command (action_id GWG class_type SK)
SQL Server	24230	Issued deny symmetric key permissions command (action_id D class_type SK)
SQL Server	24231	Issued deny symmetric key permissions with cascade command (action_id DWC class_type SK)
SQL Server	24232	Issued revoke symmetric key permissions command (action_id R class_type SK)
SQL Server	24233	Issued revoke symmetric key permissions with grant command (action_id RWG class_type SK)
SQL Server	24234	Issued revoke symmetric key permissions with cascade command (action_id RWC class_type SK)
SQL Server	24235	Issued grant certificate permissions command (action_id G class_type CR)
SQL Server	24236	Issued grant certificate permissions with grant command (action_id GWG class_type CR)
SQL Server	24237	Issued deny certificate permissions command (action_id D class_type CR)
SQL Server	24238	Issued deny certificate permissions with cascade command (action_id DWC class_type CR)
SQL Server	24239	Issued revoke certificate permissions command (action_id R class_type CR)
SQL Server	24240	Issued revoke certificate permissions with grant command (action_id RWG class_type CR)
SQL Server	24241	Issued revoke certificate permissions with cascade command (action_id RWC class_type CR)
SQL Server	24242	Issued grant asymmetric key permissions command (action_id G class_type AK)
SQL Server	24243	Issued grant asymmetric key permissions with grant command (action_id GWG class_type AK)
SQL Server	24244	Issued deny asymmetric key permissions command (action_id D class_type AK)
SQL Server	24245	Issued deny asymmetric key permissions with cascade command (action_id DWC class_type AK)
SQL Server	24246	Issued revoke asymmetric key permissions command (action_id R class_type AK)
SQL Server	24247	Issued revoke asymmetric key permissions with grant command (action_id RWG class_type AK)
SQL Server	24248	Issued revoke asymmetric key permissions with cascade command (action_id RWC class_type AK)
SQL Server	24249	Issued grant schema object permissions command (action_id G class_type OB)
SQL Server	24250	Issued grant schema object permissions with grant command (action_id GWG class_type OB)
SQL Server	24251	Issued deny schema object permissions command (action_id D class_type OB)
SQL Server	24252	Issued deny schema object permissions with cascade command (action_id DWC class_type OB)
SQL Server	24253	Issued revoke schema object permissions command (action_id R class_type OB)
SQL Server	24254	Issued revoke schema object permissions with grant command (action_id RWG class_type OB)
SQL Server	24255	Issued revoke schema object permissions with cascade command (action_id RWC class_type OB)
SQL Server	24256	Issued grant schema type permissions command (action_id G class_type TY)
SQL Server	24257	Issued grant schema type permissions with grant command (action_id GWG class_type TY)
SQL Server	24258	Issued deny schema type permissions command (action_id D class_type TY)
SQL Server	24259	Issued deny schema type permissions with cascade command (action_id DWC class_type TY)
SQL Server	24260	Issued revoke schema type permissions command (action_id R class_type TY)
SQL Server	24261	Issued revoke schema type permissions with grant command (action_id RWG class_type TY)
SQL Server	24262	Issued revoke schema type permissions with cascade command (action_id RWC class_type TY)
SQL Server	24263	Issued grant XML schema collection permissions command (action_id G class_type SX)
SQL Server	24264	Issued grant XML schema collection permissions with grant command (action_id GWG class_type SX)
SQL Server	24265	Issued deny XML schema collection permissions command (action_id D class_type SX)
SQL Server	24266	Issued deny XML schema collection permissions with cascade command (action_id DWC class_type SX)
SQL Server	24267	Issued revoke XML schema collection permissions command (action_id R class_type SX)
SQL Server	24268	Issued revoke XML schema collection permissions with grant command (action_id RWG class_type SX)
SQL Server	24269	Issued revoke XML schema collection permissions with cascade command (action_id RWC class_type SX)
SQL Server	24270	Issued reference database object permissions command (action_id RF)
SQL Server	24271	Issued send service request command (action_id SN)
SQL Server	24272	Issued check permissions with schema command (action_id VWCT)
SQL Server	24273	Issued use service broker transport security command (action_id LGB)
SQL Server	24274	Issued use database mirroring transport security command (action_id LGM)
SQL Server	24275	Issued alter trace command (action_id ALTR)
SQL Server	24276	Issued start trace command (action_id TASA)
SQL Server	24277	Issued stop trace command (action_id TASP)
SQL Server	24278	Issued enable trace C2 audit mode command (action_id C2ON)
SQL Server	24279	Issued disable trace C2 audit mode command (action_id C2OF)
SQL Server	24280	Issued server full-text command (action_id FT)
SQL Server	24281	Issued select command (action_id SL)
SQL Server	24282	Issued update command (action_id UP)
SQL Server	24283	Issued insert command (action_id IN)
SQL Server	24284	Issued delete command (action_id DL)
SQL Server	24285	Issued execute command (action_id EX)
SQL Server	24286	Issued receive command (action_id RC)
SQL Server	24287	Issued check references command (action_id RF)
SQL Server	24288	Issued a create user-defined server role command (action_id CR class_type SG)
SQL Server	24289	Issued a change user-defined server role command (action_id AL class_type SG)
SQL Server	24290	Issued a delete user-defined server role command (action_id DR class_type SG)
SQL Server	24291	Issued grant user-defined server role permissions command (action_id G class_type SG)
SQL Server	24292	Issued grant user-defined server role permissions with grant command (action_id GWG class_type SG)
SQL Server	24293	Issued deny user-defined server role permissions command (action_id D class_type SG)
SQL Server	24294	Issued deny user-defined server role permissions with cascade command (action_id DWC class_type SG)
SQL Server	24295	Issued revoke user-defined server role permissions command (action_id R class_type SG)
SQL Server	24296	Issued revoke user-defined server role permissions with grant command (action_id RWG class_type SG)
SQL Server	24297	Issued revoke user-defined server role permissions with cascade command (action_id RWC class_type SG)
SQL Server	24298	Database login succeeded (action_id DBAS)
SQL Server	24299	Database login failed (action_id DBAF)
SQL Server	24300	Database logout successful (action_id DAGL)
SQL Server	24301	Change password succeeded (action_id PWC; class_type US)
SQL Server	24302	Change password failed (action_id PWC; class_type US)
SQL Server	24303	Change own password succeeded (action_id PWCS; class_type US)
SQL Server	24304	Change own password failed (action_id PWCS; class_type US)
SQL Server	24305	Reset own password succeeded (action_id PWRS; class_type US)
SQL Server	24306	Reset own password failed (action_id PWRS; class_type US)
SQL Server	24307	Reset password succeeded (action_id PWR; class_type US)
SQL Server	24308	Reset password failed (action_id PWR; class_type US)
SQL Server	24309	Copy password (action_id USTC)
SQL Server	24310	User-defined SQL audit event (action_id UDAU)
SQL Server	24311	Issued a change database audit command (action_id AL class_type DU)
SQL Server	24312	Issued a create database audit command (action_id CR class_type DU)
SQL Server	24313	Issued a delete database audit command (action_id DR class_type DU)
SQL Server	24314	Issued a begin transaction command (action_id TXBG)
SQL Server	24315	Issued a commit transaction command (action_id TXCM)
SQL Server	24316	Issued a rollback transaction command (action_id TXRB)
SQL Server	24317	Issued a create column master key command (action_id CR; class_type CM)
SQL Server	24318	Issued a delete column master key command (action_id DR; class_type CM)
SQL Server	24319	A column master key was viewed (action_id VW; class_type CM)
SQL Server	24320	Issued a create column encryption key command (action_id CR; class_type CK)
SQL Server	24321	Issued a change column encryption key command (action_id AL; class_type CK)
SQL Server	24322	Issued a delete column encryption key command (action_id DR; class_type CK)
SQL Server	24323	A column encryption key was viewed (action_id VW; class_type CK)
SQL Server	24324	Issued a create database credential command (action_id CR; class_type DC)
SQL Server	24325	Issued a change database credential command (action_id AL; class_type DC)
SQL Server	24326	Issued a delete database credential command (action_id DR; class_type DC)
SQL Server	24327	Issued a change database scoped configuration command (action_id AL; class_type DS)
SQL Server	24328	Issued a create external data source command (action_id CR; class_type ED)
SQL Server	24329	Issued a change external data source command (action_id AL; class_type ED)
SQL Server	24330	Issued a delete external data source command (action_id DR; class_type ED)
SQL Server	24331	Issued a create external file format command (action_id CR; class_type EF)
SQL Server	24332	Issued a delete external file format command (action_id DR; class_type EF)
SQL Server	24333	Issued a create external resource pool command (action_id CR; class_type ER)
SQL Server	24334	Issued a change external resource pool command (action_id AL; class_type ER)
SQL Server	24335	Issued a delete external resource pool command (action_id DR; class_type ER)
SQL Server	24337	Global transaction login (action_id LGG)
SQL Server	24338	Grant permissions on a database scoped credential succeeded (action_id G; class_type DC)
SQL Server	24339	Grant permissions on a database scoped credential failed (action_id G; class_type DC)
SQL Server	24340	Grant permissions on a database scoped credential with grant succeeded (action_id GWG; class_type DC)
SQL Server	24341	Grant permissions on a database scoped credential with grant failed (action_id GWG; class_type DC)
SQL Server	24342	Deny permissions on a database scoped credential succeeded (action_id D; class_type DC)
SQL Server	24343	Deny permissions on a database scoped credential failed (action_id D; class_type DC)
SQL Server	24344	Deny permissions on a database scoped credential with cascade succeeded (action_id DWC; class_type DC)
SQL Server	24345	Deny permissions on a database scoped credential with cascade failed (action_id DWC; class_type DC)
SQL Server	24346	Revoke permissions on a database scoped credential succeeded (action_id R; class_type DC)
SQL Server	24347	Revoke permissions on a database scoped credential failed (action_id R; class_type DC)
SQL Server	24348	Revoke permissions with cascade on a database scoped credential succeeded (action_id RWC; class_type DC)
SQL Server	24349	Issued a change assembly owner command (action_id TO class_type AS)
SQL Server	24350	Revoke permissions with cascade on a database scoped credential failed (action_id RWC; class_type DC)
SQL Server	24351	Revoke permissions with grant on a database scoped credential succeeded (action_id RWG; class_type DC)
SQL Server	24352	Revoke permissions with grant on a database scoped credential failed (action_id RWG; class_type DC)
SQL Server	24353	Issued a change database scoped credential owner command (action_id TO; class_type DC)
SQL Server	24354	Issued a create external library command (action_id CR; class_type EL)
SQL Server	24355	Issued a change external library command (action_id AL; class_type EL)
SQL Server	24356	Issued a drop external library command (action_id DR; class_type EL)
SQL Server	24357	Grant permissions on an external library succeeded (action_id G; class_type EL)
SQL Server	24358	Grant permissions on an external library failed (action_id G; class_type EL)
SQL Server	24359	Grant permissions on an external library with grant succeeded (action_id GWG; class_type EL)
SQL Server	24360	Grant permissions on an external library with grant failed (action_id GWG; class_type EL)
SQL Server	24361	Deny permissions on an external library succeeded (action_id D; class_type EL)
SQL Server	24362	Deny permissions on an external library failed (action_id D; class_type EL)
SQL Server	24363	Deny permissions on an external library with cascade succeeded (action_id DWC; class_type EL)
SQL Server	24364	Deny permissions on an external library with cascade failed (action_id DWC; class_type EL)
SQL Server	24365	Revoke permissions on an external library succeeded (action_id R; class_type EL)
SQL Server	24366	Revoke permissions on an external library failed (action_id R; class_type EL)
SQL Server	24367	Revoke permissions with cascade on an external library succeeded (action_id RWC; class_type EL)
SQL Server	24368	Revoke permissions with cascade on an external library failed (action_id RWC; class_type EL)
SQL Server	24369	Revoke permissions with grant on an external library succeeded (action_id RWG; class_type EL)
SQL Server	24370	Revoke permissions with grant on an external library failed (action_id RWG; class_type EL)
SQL Server	24371	Issued a create database scoped resource governor command (action_id CR; class_type DR)
SQL Server	24372	Issued a change database scoped resource governor command (action_id AL; class_type DR)
SQL Server	24373	Issued a drop database scoped resource governor command (action_id DR; class_type DR)
SQL Server	24374	Issued a database bulk administration command (action_id DABO; class_type DB)
SQL Server	24375	Command to change permission failed (action_id D, DWC, G, GWG, R, RWC, RWG; class_type DC, EL)

Upcoming Webinars

Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

Encyclopedia

•	Event IDs
•	All Event IDs
•	Audit Policy

Go To Event ID:

Must be a 1-5 digit number No such event ID

Security Log
Quick Reference
Chart
Download now!

User name:
Password:
	/ Forgot?
	Register

April 2024 Patch Tuesday	"Patch Tuesday - One Zero Day and Record Number of Patches! " - sponsored by LOGbinder

Follow @randyfsmith

About | Newsletter | Contact

Ultimate IT Security is a division of Monterey Technology Group, Inc. ©2006-2024 Monterey Technology Group, Inc. All rights reserved.
Disclaimer: We do our best to provide quality information and expert commentary but use all information at your own risk. For complaints, please contact abuse@ultimatewindowssecurity.com.