Microsoft-Windows-RPC-Audit
2 events across 1 channel
Event ID 1 —
Fields
| Name | Description |
|---|---|
InterfaceUuid | — |
OpNum | — |
SubjectUserSid | — |
SubjectLogonId | — |
LocalIpAddressLength | — |
LocalIpAddress | — |
RemoteIpAddressLength | — |
RemoteIpAddress | — |
ProtocolSequence | — |
AuthenticationService | — |
AuthenticationLevel | — |
Endpoint | — |
RemoteHost | — |
BufferSize | — |
Buffer | — |
Event ID 2 —
Fields
| Name | Description |
|---|---|
InterfaceUuid | — |
OpNum | — |
SubjectUserSid | — |
SubjectLogonId | — |
LocalIpAddressLength | — |
LocalIpAddress | — |
RemoteIpAddressLength | — |
RemoteIpAddress | — |
ProtocolSequence | — |
AuthenticationService | — |
AuthenticationLevel | — |
Endpoint | — |
RemoteHost | — |
ErrorCode | — |
IsBlockedByWFP | — |