Windows Server Update Services

19 events across 1 channel

Event	Title	Channel
501	Event ID 501	Application
502	Event ID 502	Application
12000	Event ID 12000	Application
12002	Event ID 12002	Application
12010	Event ID 12010	Application
12012	Event ID 12012	Application
12020	Event ID 12020	Application
12022	Event ID 12022	Application
12030	Event ID 12030	Application
12032	Event ID 12032	Application
12040	Event ID 12040	Application
12042	Event ID 12042	Application
12050	Event ID 12050	Application
12052	Event ID 12052	Application
12070	Event ID 12070	Application
12072	Event ID 12072	Application
13040	Event ID 13040	Application
13042	Event ID 13042	Application
13051	Event ID 13051	Application

Event ID 501:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 16:59:32.807997+00:00",
    "event_record_id": 466,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Update Services Service Started</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 502:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 502,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:24:01.642078+00:00",
    "event_record_id": 854,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Update Services Service Has Stopped</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12000:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12000,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7778,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Reporting Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12002:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12002,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2725,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Reporting Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12010:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12010,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7779,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The API Remoting Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12012:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12012,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2726,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The API Remoting Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12020:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12020,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7781,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Client Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12022:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12022,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2728,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Client Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12030:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12030,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7780,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Server Synchronization Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12032:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12032,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2727,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The Server Synchronization Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12040:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12040,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.389688+00:00",
    "event_record_id": 7782,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The SimpleAuth Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12042:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12042,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2729,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The SimpleAuth Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12050:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12050,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.389688+00:00",
    "event_record_id": 7783,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The DSS Authentication Web Service is working correctly.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12052:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12052,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2730,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The DSS Authentication Web Service is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12070:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12070,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.389688+00:00",
    "event_record_id": 7784,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The WSUS content directory is accessible.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 12072:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 12072,
    "version": 0,
    "level": 2,
    "task": 9,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2731,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>The WSUS content directory is not accessible.\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 10.4.10.11:8530\n   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\n   at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\n   --- End of inner exception stack trace ---\n   at System.Net.HttpWebRequest.GetResponse()\n   at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger)</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 13040:

Provider: Windows Server Update Services
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 13040,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 09:53:51.374126+00:00",
    "event_record_id": 7777,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Self-update is working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 13042:

Provider: Windows Server Update Services
Channel: Application
Level: 2

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 13042,
    "version": 0,
    "level": 2,
    "task": 6,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 21:34:47.177019+00:00",
    "event_record_id": 2723,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Self-update is not working.</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 13051:

Provider: Windows Server Update Services
Channel: Application
Level: 3

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "Windows Server Update Services",
    "guid": "",
    "event_source_name": "",
    "event_id": 13051,
    "version": 0,
    "level": 3,
    "task": 6,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 16:59:40.953760+00:00",
    "event_record_id": 467,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>No client computers have ever contacted the server.</string>\n",
    "Binary": ""
  },
  "message": ""
}

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)