Palo Alto – Security Event IDS from Active Directory Used with User-ID Agent


2000 – 2003
SUCCESS_NET_LOGON = 540
AUTH_TICKET_GRANTED = 672
SERVICE_TICKET_GRANTED = 673
TICKET_GRANTED_RENEW = 674

2008 – 2012 (including R2)
LOGON_SUCCESS_W2008 = 4624
AUTH_TICKET_GRANTED_W2008 = 4768
SERVICE_TICKET_GRANTED = 4769
TICKET_GRANTED_RENEW_W2008 = 4770

More Stories
Changing the MAC Address on a Kali Box