Incorrect event id specified for "CA Permissions Corrupted or Missing" in section "Certificate Services" of "Windows Event Monitoring Guidance\Recommended Events to Collect" document
vburov opened this issue · 4 comments
According to Microsoft documentation the event id = 95 is wrote to log when security permissions are corrupted or missing:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd338541(v=ws.10)
@iadgovuser8 Might want to cross check with WELM data (attached to the latest release): https://github.com/nsacyber/Windows-Event-Log-Messages/releases
I need to split up that zip file so we don't have to download it all.
@iadgovuser1 I quickly checked with wevtutil.exe. Yes, the event ID should've been 95 as 90 deals with an exception being thrown which does not deal with permissions per documentation.
@iadgovuser8 Don't forget to update the csv and json files. :)
Accepted PR updating JSON 6e92d62