CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-02 12:34:42 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
dev
WELA/config/baselines.json
T

2898 lines
85 KiB
JSON
Raw Permalink Blame History

{
"version": 1,
"catalog": [
{
"id": "application",
"category": "Application",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Application"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Application"
],
"provider": "Application"
}
},
{
"id": "applocker",
"category": "Applocker",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-AppLocker/MSI and Script",
"Microsoft-Windows-AppLocker/EXE and DLL",
"Microsoft-Windows-AppLocker/Packaged app-Deployment",
"Microsoft-Windows-AppLocker/Packaged app-Execution"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-AppLocker/MSI and Script",
"Microsoft-Windows-AppLocker/EXE and DLL",
"Microsoft-Windows-AppLocker/Packaged app-Deployment",
"Microsoft-Windows-AppLocker/Packaged app-Execution"
],
"provider": "AppLocker"
}
},
{
"id": "bits-client-operational",
"category": "Bits-Client Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-Bits-Client/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-Bits-Client/Operational"
],
"provider": "BITS"
}
},
{
"id": "codeintegrity-operational",
"category": "CodeIntegrity Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-CodeIntegrity/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-CodeIntegrity/Operational"
],
"provider": "CodeIntegrity"
}
},
{
"id": "crypto-dpapi-debug",
"category": "Crypto-DPAPI Debug",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-Crypto-DPAPI/Debug"
],
"guid": ""
},
"currentSetting": {
"type": "registry",
"paths": [
"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-Crypto-DPAPI/Debug"
],
"name": "Enabled",
"value": 1
}
},
{
"id": "dfsn-server-admin",
"category": "DFSN-Server Admin",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-DFSN-Server/Admin"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-DFSN-Server/Admin"
],
"provider": "DFSN"
}
},
{
"id": "diagnosis-scripted-operational",
"category": "Diagnosis-Scripted Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-Diagnosis-Scripted/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-Diagnosis-Scripted/Operational"
],
"provider": "Diagnosis"
}
},
{
"id": "driverframeworks-usermode-operational",
"category": "DriverFrameworks-UserMode Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-DriverFrameworks-UserMode/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-DriverFrameworks-UserMode/Operational"
],
"provider": "DriverFrameworks"
}
},
{
"id": "firewall",
"category": "Firewall",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"
],
"provider": "Firewall"
}
},
{
"id": "microsoft-windows-ntlm-operational",
"category": "Microsoft-Windows-NTLM/Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-NTLM/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-NTLM/Operational"
],
"provider": "NTLM"
}
},
{
"id": "powershell-classic",
"category": "PowerShell",
"subCategory": "Classic",
"select": {
"type": "filter",
"eventIds": [
"400"
],
"channels": [
"pwsh"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Windows PowerShell"
],
"provider": "PowerShellClassic"
}
},
{
"id": "powershell-module",
"category": "PowerShell",
"subCategory": "Module",
"select": {
"type": "filter",
"eventIds": [
"4103"
],
"channels": [
"pwsh"
],
"guid": ""
},
"currentSetting": {
"type": "registry",
"paths": [
"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging",
"HKLM:\\SOFTWARE\\Wow6432Node\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging"
],
"name": "EnableModuleLogging",
"value": 1
}
},
{
"id": "powershell-scriptblock",
"category": "PowerShell",
"subCategory": "ScriptBlock",
"select": {
"type": "filter",
"eventIds": [
"4104"
],
"channels": [
"pwsh"
],
"guid": ""
},
"currentSetting": {
"type": "registry",
"paths": [
"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging",
"HKLM:\\SOFTWARE\\Wow6432Node\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging"
],
"name": "EnableScriptBlockLogging",
"value": 1
}
},
{
"id": "printservice-printservice-admin",
"category": "PrintService",
"subCategory": "PrintService Admin",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-PrintService/Admin"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-PrintService/Admin"
],
"provider": "PrintService"
}
},
{
"id": "printservice-printservice-operational",
"category": "PrintService",
"subCategory": "PrintService Operational",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-PrintService/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-PrintService/Operational"
],
"provider": "PrintService"
}
},
{
"id": "security-advanced-account-logon-credential-validation",
"category": "Security Advanced (Account Logon)",
"subCategory": "Credential Validation",
"select": {
"type": "guid",
"guid": "0CCE923F-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-account-logon-kerberos-authentication-service",
"category": "Security Advanced (Account Logon)",
"subCategory": "Kerberos Authentication Service",
"select": {
"type": "guid",
"guid": "0CCE9242-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-account-logon-kerberos-service-ticket-operations",
"category": "Security Advanced (Account Logon)",
"subCategory": "Kerberos Service Ticket Operations",
"select": {
"type": "guid",
"guid": "0CCE9240-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-account-management-computer-account-management",
"category": "Security Advanced (Account Management)",
"subCategory": "Computer Account Management",
"select": {
"type": "guid",
"guid": "0CCE9236-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-account-management-other-account-management-events",
"category": "Security Advanced (Account Management)",
"subCategory": "Other Account Management Events",
"select": {
"type": "guid",
"guid": "0CCE923A-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-account-management-security-group-management",
"category": "Security Advanced (Account Management)",
"subCategory": "Security Group Management",
"select": {
"type": "guid",
"guid": "0CCE9237-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-account-management-user-account-management",
"category": "Security Advanced (Account Management)",
"subCategory": "User Account Management",
"select": {
"type": "guid",
"guid": "0CCE9235-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-detailed-tracking-plug-and-play-events",
"category": "Security Advanced (Detailed Tracking)",
"subCategory": "Plug and Play Events",
"select": {
"type": "guid",
"guid": "0CCE9248-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-detailed-tracking-process-creation",
"category": "Security Advanced (Detailed Tracking)",
"subCategory": "Process Creation",
"select": {
"type": "guid",
"guid": "0CCE922B-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-detailed-tracking-process-termination",
"category": "Security Advanced (Detailed Tracking)",
"subCategory": "Process Termination",
"select": {
"type": "guid",
"guid": "0CCE922C-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-detailed-tracking-rpc-events",
"category": "Security Advanced (Detailed Tracking)",
"subCategory": "RPC Events",
"select": {
"type": "guid",
"guid": "0CCE922E-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-detailed-tracking-token-right-adjusted-events",
"category": "Security Advanced (Detailed Tracking)",
"subCategory": "Token Right Adjusted Events",
"select": {
"type": "guid",
"guid": "0CCE924A-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-ds-access-directory-service-access",
"category": "Security Advanced (DS Access)",
"subCategory": "Directory Service Access",
"select": {
"type": "guid",
"guid": "0CCE923B-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-ds-access-directory-service-changes",
"category": "Security Advanced (DS Access)",
"subCategory": "Directory Service Changes",
"select": {
"type": "guid",
"guid": "0CCE923C-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-logon-logoff-account-lockout",
"category": "Security Advanced (Logon/Logoff)",
"subCategory": "Account Lockout",
"select": {
"type": "guid",
"guid": "0CCE9217-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-logon-logoff-group-membership",
"category": "Security Advanced (Logon/Logoff)",
"subCategory": "Group Membership",
"select": {
"type": "guid",
"guid": "0CCE9249-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-logon-logoff-logoff",
"category": "Security Advanced (Logon/Logoff)",
"subCategory": "Logoff",
"select": {
"type": "guid",
"guid": "0CCE9216-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-logon-logoff-logon",
"category": "Security Advanced (Logon/Logoff)",
"subCategory": "Logon",
"select": {
"type": "guid",
"guid": "0CCE9215-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-logon-logoff-other-logon-logoff-events",
"category": "Security Advanced (Logon/Logoff)",
"subCategory": "Other Logon/Logoff Events",
"select": {
"type": "guid",
"guid": "0CCE921C-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-logon-logoff-special-logon",
"category": "Security Advanced (Logon/Logoff)",
"subCategory": "Special Logon",
"select": {
"type": "guid",
"guid": "0CCE921B-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-certification-services",
"category": "Security Advanced (Object Access)",
"subCategory": "Certification Services",
"select": {
"type": "guid",
"guid": "0CCE9221-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-detailed-file-share",
"category": "Security Advanced (Object Access)",
"subCategory": "Detailed File Share",
"select": {
"type": "guid",
"guid": "0CCE9244-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-file-share",
"category": "Security Advanced (Object Access)",
"subCategory": "File Share",
"select": {
"type": "guid",
"guid": "0CCE9224-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-file-system",
"category": "Security Advanced (Object Access)",
"subCategory": "File System",
"select": {
"type": "guid",
"guid": "0CCE921D-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-filtering-platform-connection",
"category": "Security Advanced (Object Access)",
"subCategory": "Filtering Platform Connection",
"select": {
"type": "guid",
"guid": "0CCE9226-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-filtering-platform-packet-drop",
"category": "Security Advanced (Object Access)",
"subCategory": "Filtering Platform Packet Drop",
"select": {
"type": "guid",
"guid": "0CCE9225-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-kernel-object",
"category": "Security Advanced (Object Access)",
"subCategory": "Kernel Object",
"select": {
"type": "guid",
"guid": "0CCE921F-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-handle-manipulation",
"category": "Security Advanced (Object Access)",
"subCategory": "Handle Manipulation",
"select": {
"type": "guid",
"guid": "0CCE9223-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-other-object-access-events",
"category": "Security Advanced (Object Access)",
"subCategory": "Other Object Access Events",
"select": {
"type": "guid",
"guid": "0CCE9227-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-registry",
"category": "Security Advanced (Object Access)",
"subCategory": "Registry",
"select": {
"type": "guid",
"guid": "0CCE921E-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-removable-storage",
"category": "Security Advanced (Object Access)",
"subCategory": "Removable Storage",
"select": {
"type": "guid",
"guid": "0CCE9245-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-object-access-sam",
"category": "Security Advanced (Object Access)",
"subCategory": "SAM",
"select": {
"type": "guid",
"guid": "0CCE9220-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-policy-change-audit-policy-change",
"category": "Security Advanced (Policy Change)",
"subCategory": "Audit Policy Change",
"select": {
"type": "guid",
"guid": "0CCE922F-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-policy-change-authentication-policy-change",
"category": "Security Advanced (Policy Change)",
"subCategory": "Authentication Policy Change",
"select": {
"type": "guid",
"guid": "0CCE9230-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-policy-change-authorization-policy-change",
"category": "Security Advanced (Policy Change)",
"subCategory": "Authorization Policy Change",
"select": {
"type": "guid",
"guid": "0CCE9231-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-policy-change-filtering-platform-policy-change",
"category": "Security Advanced (Policy Change)",
"subCategory": "Filtering Platform Policy Change",
"select": {
"type": "guid",
"guid": "0CCE9233-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-policy-change-mpssvc-rule-level-policy-change",
"category": "Security Advanced (Policy Change)",
"subCategory": "MPSSVC Rule-Level Policy Change",
"select": {
"type": "guid",
"guid": "0CCE9232-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-policy-change-other-policy-change-events",
"category": "Security Advanced (Policy Change)",
"subCategory": "Other Policy Change Events",
"select": {
"type": "guid",
"guid": "0CCE9234-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-privilege-use-non-sensitive-privilege-use",
"category": "Security Advanced (Privilege Use)",
"subCategory": "Non-Sensitive Privilege Use",
"select": {
"type": "guid",
"guid": "0CCE9229-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-privilege-use-sensitive-privilege-use",
"category": "Security Advanced (Privilege Use)",
"subCategory": "Sensitive Privilege Use",
"select": {
"type": "guid",
"guid": "0CCE9228-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-system-other-system-events",
"category": "Security Advanced (System)",
"subCategory": "Other System Events",
"select": {
"type": "guid",
"guid": "0CCE9214-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-system-security-state-change",
"category": "Security Advanced (System)",
"subCategory": "Security State Change",
"select": {
"type": "guid",
"guid": "0CCE9210-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-system-security-system-extension",
"category": "Security Advanced (System)",
"subCategory": "Security System Extension",
"select": {
"type": "guid",
"guid": "0CCE9211-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-advanced-system-system-integrity",
"category": "Security Advanced (System)",
"subCategory": "System Integrity",
"select": {
"type": "guid",
"guid": "0CCE9212-69AE-11D9-BED3-505054503030"
},
"currentSetting": {
"type": "auditpol"
}
},
{
"id": "security-mitigations-kernelmode",
"category": "Security-Mitigations KernelMode",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-Security-Mitigations/KernelMode"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-Security-Mitigations/KernelMode"
],
"provider": "ExploitProtection"
}
},
{
"id": "security-mitigations-usermode",
"category": "Security-Mitigations UserMode",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-Security-Mitigations/UserMode"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-Security-Mitigations/UserMode"
],
"provider": "ExploitProtection"
}
},
{
"id": "smbclient-security",
"category": "SMBClient Security",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-SmbClient/Security"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-SmbClient/Security"
],
"provider": "SMBClient"
}
},
{
"id": "system",
"category": "System",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"System"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"System"
],
"provider": "System"
}
},
{
"id": "taskscheduler-operational",
"category": "TaskScheduler Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-TaskScheduler/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "registry",
"paths": [
"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Microsoft-Windows-TaskScheduler/Operational"
],
"name": "Enabled",
"value": 1
}
},
{
"id": "terminalservices-localsessionmanager-operational",
"category": "TerminalServices-LocalSessionManager Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
],
"provider": "TerminalServices"
}
},
{
"id": "wmi-activity-operational",
"category": "WMI-Activity Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-WMI-Activity/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-WMI-Activity/Operational"
],
"provider": "WMI"
}
},
{
"id": "windows-defender-operational",
"category": "Windows Defender Operational",
"subCategory": "",
"select": {
"type": "filter",
"eventIds": [],
"channels": [
"Microsoft-Windows-Windows Defender/Operational"
],
"guid": ""
},
"currentSetting": {
"type": "native-channel",
"channels": [
"Microsoft-Windows-Windows Defender/Operational"
],
"provider": "Defender"
}
}
],
"baselines": {
"YamatoSecurity": {
"application": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"applocker": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": "Enabled if AppLocker is enabled?"
},
"bits-client-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"codeintegrity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"crypto-dpapi-debug": {
"ideal": true,
"defaultSetting": "Disabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"dfsn-server-admin": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": "Only exists on servers with the DFS Namespaces role installed."
},
"diagnosis-scripted-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"driverframeworks-usermode-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"firewall": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"microsoft-windows-ntlm-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": "This log is recommended to enable if you want to disable NTLM authentication"
},
"powershell-classic": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"powershell-module": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Enabled",
"volume": "High",
"note": ""
},
"powershell-scriptblock": {
"ideal": true,
"defaultSetting": "Partially Enabled",
"recommendedSetting": "Enabled",
"volume": "High",
"note": "On Win 10/2016+, if a PowerShell script is flagged as suspicious by AMSI, it will be logged with a level of Warning in default setting"
},
"printservice-printservice-admin": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"printservice-printservice-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"security-advanced-account-logon-credential-validation": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Client and Server OSes: Success and Failure",
"volume": "Depends on NTLM usage. Could be high on DCs and low on clients and servers.",
"note": ""
},
"security-advanced-account-logon-kerberos-authentication-service": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Client OS: No Auditing | Server OS: Success and Failure",
"volume": "High",
"note": ""
},
"security-advanced-account-logon-kerberos-service-ticket-operations": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Domain Controllers: Success and Failure",
"volume": "High",
"note": ""
},
"security-advanced-account-management-computer-account-management": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Domain Controllers: Success and Failure",
"volume": "High",
"note": ""
},
"security-advanced-account-management-other-account-management-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-account-management-security-group-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-account-management-user-account-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-detailed-tracking-plug-and-play-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-detailed-tracking-process-creation": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "High",
"note": "if sysmon is not configured"
},
"security-advanced-detailed-tracking-process-termination": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "High",
"note": "unless you want to track the lifespan of processes"
},
"security-advanced-detailed-tracking-rpc-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "High on RPC servers (According to Microsoft)",
"note": ""
},
"security-advanced-detailed-tracking-token-right-adjusted-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "",
"note": ""
},
"security-advanced-ds-access-directory-service-access": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Client OS: No Auditing | ADDS Server: Success and Failure",
"volume": "High",
"note": ""
},
"security-advanced-ds-access-directory-service-changes": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Client OS: No Auditing | ADDS Server: Success and Failure",
"volume": "High",
"note": ""
},
"security-advanced-logon-logoff-account-lockout": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-logon-logoff-group-membership": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "Adds an extra 4627 event to every logon",
"note": ""
},
"security-advanced-logon-logoff-logoff": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-logon": {
"ideal": true,
"defaultSetting": "Client OS: Success | Server OS: Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "Low on clients, medium on DCs or network servers",
"note": ""
},
"security-advanced-logon-logoff-other-logon-logoff-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-logon-logoff-special-logon": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "Low on clients. Medium on DC or network servers",
"note": ""
},
"security-advanced-object-access-certification-services": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure for AD CS role servers",
"volume": "Low to medium",
"note": ""
},
"security-advanced-object-access-detailed-file-share": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "Very high for file servers and DCs, however, may be necessary if you want to track who is accessing what files as well as detect various lateral movement",
"note": "Due to the high noise level. Enable if you can though"
},
"security-advanced-object-access-file-share": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "High for file servers and DCs",
"note": ""
},
"security-advanced-object-access-file-system": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Enabled",
"volume": "Depends on SACL rules",
"note": "Enable SACLs just for sensitive files"
},
"security-advanced-object-access-filtering-platform-connection": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "High",
"note": "Success and Failure if you have enough space and are not monitoring network connections with sysmon. This should cause a high amount of events though"
},
"security-advanced-object-access-filtering-platform-packet-drop": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "High",
"note": "for AD CS role servers"
},
"security-advanced-object-access-kernel-object": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "High if auditing access of global object access is enabled",
"note": "Success and Failure but do not enable Audit the access of global system objects as you will generate too many 4663: Object Access events"
},
"security-advanced-object-access-handle-manipulation": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "High",
"note": ""
},
"security-advanced-object-access-other-object-access-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-object-access-registry": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Depends on SACLs",
"note": "Set SACLs for only the registry keys that you want to monitor"
},
"security-advanced-object-access-removable-storage": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Depends on how much removable storage is used",
"note": "if you want to monitor external device usage"
},
"security-advanced-object-access-sam": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Success and Failure if you can but may cause too high volume of noise so should be tested beforehand",
"note": "for AD CS role servers"
},
"security-advanced-policy-change-audit-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-policy-change-authentication-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-policy-change-authorization-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "Medium to High",
"note": ""
},
"security-advanced-policy-change-filtering-platform-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "Low",
"note": ""
},
"security-advanced-policy-change-mpssvc-rule-level-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "Low",
"note": ""
},
"security-advanced-policy-change-other-policy-change-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "Low",
"note": "ACSC recommends Success and Failure, however, this results in a lot of noise of 5447 (A Windows Filtering Platform filter has been changed) events being generated"
},
"security-advanced-privilege-use-non-sensitive-privilege-use": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "Very high",
"note": ""
},
"security-advanced-privilege-use-sensitive-privilege-use": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "High",
"note": "However, this may be too noisy"
},
"security-advanced-system-other-system-events": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "",
"volume": "Low",
"note": ""
},
"security-advanced-system-security-state-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-advanced-system-security-system-extension": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "Low, but more on DCs",
"note": ""
},
"security-advanced-system-system-integrity": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "Low",
"note": ""
},
"security-mitigations-kernelmode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"security-mitigations-usermode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"smbclient-security": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"system": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"taskscheduler-operational": {
"ideal": true,
"defaultSetting": "Disabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"terminalservices-localsessionmanager-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"wmi-activity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"windows-defender-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
}
},
"ASD": {
"application": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"applocker": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"bits-client-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"codeintegrity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"crypto-dpapi-debug": {
"ideal": false,
"defaultSetting": "Disabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"dfsn-server-admin": {
"ideal": false,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": "Only exists on servers with the DFS Namespaces role installed."
},
"diagnosis-scripted-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"driverframeworks-usermode-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"firewall": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"microsoft-windows-ntlm-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-classic": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-module": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"powershell-scriptblock": {
"ideal": true,
"defaultSetting": "Partially",
"recommendedSetting": "Enabled",
"volume": "",
"note": ""
},
"printservice-printservice-admin": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"printservice-printservice-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-logon-credential-validation": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-logon-kerberos-authentication-service": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-logon-kerberos-service-ticket-operations": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-management-computer-account-management": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-management-other-account-management-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-management-security-group-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-management-user-account-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-plug-and-play-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-process-creation": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": "Include command line in process creation events"
},
"security-advanced-detailed-tracking-process-termination": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-rpc-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-token-right-adjusted-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "",
"note": ""
},
"security-advanced-ds-access-directory-service-access": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-ds-access-directory-service-changes": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-account-lockout": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-group-membership": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-logoff": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-logon": {
"ideal": true,
"defaultSetting": "Client OS: Success | Server OS: Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-other-logon-logoff-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-special-logon": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-certification-services": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-detailed-file-share": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "No Auditing",
"volume": "",
"note": "Enabling this setting is not recommended due to the high noise level"
},
"security-advanced-object-access-file-share": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-file-system": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-filtering-platform-connection": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-filtering-platform-packet-drop": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-kernel-object": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-handle-manipulation": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-other-object-access-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-registry": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-removable-storage": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-sam": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-audit-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-policy-change-authentication-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-authorization-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-filtering-platform-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-mpssvc-rule-level-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-other-policy-change-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-privilege-use-non-sensitive-privilege-use": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-privilege-use-sensitive-privilege-use": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-other-system-events": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-security-state-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-security-system-extension": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-system-integrity": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-mitigations-kernelmode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-mitigations-usermode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"smbclient-security": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"system": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"taskscheduler-operational": {
"ideal": true,
"defaultSetting": "Disabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"terminalservices-localsessionmanager-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"wmi-activity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"windows-defender-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
}
},
"Microsoft_Client": {
"application": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"applocker": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"bits-client-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"codeintegrity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"crypto-dpapi-debug": {
"ideal": false,
"defaultSetting": "Disabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"dfsn-server-admin": {
"ideal": false,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": "Only exists on servers with the DFS Namespaces role installed."
},
"diagnosis-scripted-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"driverframeworks-usermode-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"firewall": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"microsoft-windows-ntlm-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-classic": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-module": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-scriptblock": {
"ideal": true,
"defaultSetting": "Partially",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"printservice-printservice-admin": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"printservice-printservice-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-logon-credential-validation": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-logon-kerberos-authentication-service": {
"ideal": false,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-logon-kerberos-service-ticket-operations": {
"ideal": false,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-management-computer-account-management": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-account-management-other-account-management-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-account-management-security-group-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-account-management-user-account-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-plug-and-play-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-process-creation": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": "Include command line in process creation events"
},
"security-advanced-detailed-tracking-process-termination": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-rpc-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-token-right-adjusted-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-ds-access-directory-service-access": {
"ideal": false,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-ds-access-directory-service-changes": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-account-lockout": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-group-membership": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-logoff": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-logon": {
"ideal": true,
"defaultSetting": "Client OS: Success | Server OS: Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-other-logon-logoff-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-special-logon": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-object-access-certification-services": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-detailed-file-share": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": "Enabling this setting is not recommended due to the high noise level)"
},
"security-advanced-object-access-file-share": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-file-system": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-filtering-platform-connection": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-filtering-platform-packet-drop": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-kernel-object": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-handle-manipulation": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-other-object-access-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-registry": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-removable-storage": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-sam": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-audit-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-policy-change-authentication-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-policy-change-authorization-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-filtering-platform-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-mpssvc-rule-level-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-other-policy-change-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-privilege-use-non-sensitive-privilege-use": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-privilege-use-sensitive-privilege-use": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-other-system-events": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-security-state-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-system-security-system-extension": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-system-integrity": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-mitigations-kernelmode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-mitigations-usermode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"smbclient-security": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"system": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"taskscheduler-operational": {
"ideal": true,
"defaultSetting": "Disabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"terminalservices-localsessionmanager-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"wmi-activity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"windows-defender-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
}
},
"Microsoft_Server": {
"application": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"applocker": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"bits-client-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"codeintegrity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"crypto-dpapi-debug": {
"ideal": false,
"defaultSetting": "Disabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"dfsn-server-admin": {
"ideal": false,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": "Only exists on servers with the DFS Namespaces role installed."
},
"diagnosis-scripted-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"driverframeworks-usermode-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"firewall": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"microsoft-windows-ntlm-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-classic": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-module": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"powershell-scriptblock": {
"ideal": true,
"defaultSetting": "Partially",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"printservice-printservice-admin": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"printservice-printservice-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-logon-credential-validation": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-logon-kerberos-authentication-service": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-logon-kerberos-service-ticket-operations": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-account-management-computer-account-management": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-management-other-account-management-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-management-security-group-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-account-management-user-account-management": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-plug-and-play-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-process-creation": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": "Include command line in process creation events"
},
"security-advanced-detailed-tracking-process-termination": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-rpc-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-detailed-tracking-token-right-adjusted-events": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-ds-access-directory-service-access": {
"ideal": true,
"defaultSetting": "Client OS: No Auditing | Server OS: Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-ds-access-directory-service-changes": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-account-lockout": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-group-membership": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-logoff": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-logon": {
"ideal": true,
"defaultSetting": "Client OS: Success | Server OS: Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-other-logon-logoff-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-logon-logoff-special-logon": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-object-access-certification-services": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-detailed-file-share": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": "Enabling this setting is not recommended due to the high noise level)"
},
"security-advanced-object-access-file-share": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-file-system": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-filtering-platform-connection": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-filtering-platform-packet-drop": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-kernel-object": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-handle-manipulation": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-other-object-access-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-registry": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-object-access-removable-storage": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-object-access-sam": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-audit-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-policy-change-authentication-policy-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success",
"volume": "",
"note": ""
},
"security-advanced-policy-change-authorization-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-filtering-platform-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-mpssvc-rule-level-policy-change": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-policy-change-other-policy-change-events": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-privilege-use-non-sensitive-privilege-use": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-privilege-use-sensitive-privilege-use": {
"ideal": false,
"defaultSetting": "No Auditing",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-other-system-events": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-advanced-system-security-state-change": {
"ideal": true,
"defaultSetting": "Success",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-system-security-system-extension": {
"ideal": true,
"defaultSetting": "No Auditing",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-advanced-system-system-integrity": {
"ideal": true,
"defaultSetting": "Success and Failure",
"recommendedSetting": "Success and Failure",
"volume": "",
"note": ""
},
"security-mitigations-kernelmode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"security-mitigations-usermode": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"smbclient-security": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"system": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"taskscheduler-operational": {
"ideal": true,
"defaultSetting": "Disabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"terminalservices-localsessionmanager-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"wmi-activity-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
},
"windows-defender-operational": {
"ideal": true,
"defaultSetting": "Enabled",
"recommendedSetting": "",
"volume": "",
"note": ""
}
}
}
}
Reference in new issue View Git Blame Copy Permalink