Search Tokens for AD Events and Alerts
You can use the search tokens in the Monitoring tabs to refine your search results. We have broadly classified the AD Events and AD Alerts search tokens in the Monitoring tab. Click each token to learn more about it.
Active Directory (AD) Events Token
Use these tokens to define search criteria for Active Directory events collected from domain controllers and other AD-integrated systems.
Use quotes or backticks within values to search events based on the action performed, such as account changes, logon activity, or object operations.
Examples
Show events related to account creation.
event.action: "Account Created"
Match an exact action value.
event.action: `Logon`
Use quotes or backticks within values to filter events collected by a specific Qualys Cloud Agent ID associated with a domain controller.
Examples
Show events from a specific agent.
event.agentId: "9831B87E-E9C5-473C-BD0C-08E25F863148"
Match an exact agent ID.
event.agentId: `9831B87E-E9C5-473C-BD0C-08E25F863148`
event.authenticationPackageNameevent.authenticationPackageName
Use this token to filter events by the authentication package used during the logon process, such as NTLM or Kerberos.
Examples
Show events authenticated using NTLM.
event.authenticationPackageName: NTLM
Show events authenticated using Kerberos.
event.authenticationPackageName: Kerberos
event.authenticationTypeevent.authenticationType
Use this token to filter events based on the authentication protocol used, such as Kerberos or NTLM, helping identify authentication patterns.
Examples
Show events authenticated using Kerberos.
event.authenticationType: Kerberos
Show events authenticated using NTLM.
event.authenticationType: NTLM
Use quotes or backticks within values to filter events based on the Windows audit category associated with the activity.
Examples
Show logon events.
event.category: "Logon/Logoff"
Match an exact category.
event.category: `Account Management`
Use quotes or backticks within values to filter events based on the domain (DNS format) reported in the event.
Examples
Show events in a specific domain.
event.domain: "emea.global"
Match an exact domain value.
event.domain: `emea.global`
event.domainPolicyChangedevent.domainPolicyChanged
Use quotes or backticks within values to search events involving changes to domain-level policies.
Examples
Show events where the lockout threshold was modified.
event.domainPolicyChanged: LockoutThreshold
Match an exact policy attribute.
event.domainPolicyChanged: `MaxPasswordAge`
event.elevatedTokenevent.elevatedToken
Use this token to filter events based on whether the logon session used an elevated token. Specific coded values indicate elevated or non-elevated states.
Examples
Show events with elevated privileges.
event.elevatedToken: "%%1842"
Show events without elevated privileges.
event.elevatedToken: "%%1843"
event.elevatedTokenNameevent.elevatedTokenName
Use quotes or backticks within values to filter events based on the readable elevated token state such as Yes or No.
Examples
Show events where elevated access was used.
event.elevatedTokenName: "Yes"
Show events without elevated access.
event.elevatedTokenName: "No"
Use this token to filter events based on the Windows Security Event ID associated with the activity.
Examples
Show successful logon events.
event.eventId: 4624
Show special logon events.
event.eventId: 4672
Use quotes or backticks within values to filter events based on the fully qualified hostname of the domain controller that generated the event.
Examples
Show events from a specific host.
event.host: "WIN2K12R2-2.emea.global"
Match an exact hostname.
event.host: `WIN2K12R2-2.emea.global`
Use quotes or backticks within values to search for a specific raw event using its unique object ID.
Examples
Look up a raw event.
event.id: "29e8895d-e5d4-35af-b921-03a6719904da"
Match an exact ID.
event.id: `29e8895d-e5d4-35af-b921-03a6719904da`
event.ipAddressevent.ipAddress
Use quotes or backticks within values to filter events based on the source IP address recorded in the event.
Examples
Show events originating from a specific IP.
event.ipAddress: "10.119.215.68"
Match an exact IP address.
event.ipAddress: `10.119.215.68`
event.isSuspiciousevent.isSuspicious
Use this token to filter events flagged by the detection engine as suspicious. Accepts true or false values.
Examples
Show only suspicious events.
event.isSuspicious: true
Show non-suspicious events.
event.isSuspicious: false
Use quotes or backticks within values to filter events based on Windows log level such as Information or Warning.
Examples
Show informational events.
event.level: "Information"
Show warning events.
event.level: Warning
event.logonTypeevent.logonType
Use this token to filter events based on the numeric Windows logon type, helping identify interaction type such as network or remote access.
Examples
Show network logon events.
event.logonType: 3
Show RDP logon events.
event.logonType: 10
event.logonTypeNameevent.logonTypeName
Use quotes or backticks within values to filter events based on the readable name of the logon type such as Network or RemoteInteractive.
Examples
Show network logon events.
event.logonTypeName: "Network"
Show remote interactive logons.
event.logonTypeName: RemoteInteractive
event.objectClassevent.objectClass
Use quotes or backticks within values to filter events based on the class of the directory object involved, such as user, computer, or groupPolicyContainer.
Examples
Show events involving user objects.
event.objectClass: user
Match an exact object class.
event.objectClass: `groupPolicyContainer`
Use quotes or backticks within values to search events based on the distinguished name (DN) of the directory object affected by the operation.
Examples
Show events modifying AdminSDHolder.
event.objectDN: "AdminSDHolder"
Match an exact DN value.
event.objectDN: `CN=AdminSDHolder,CN=System,DC=test,DC=com`
event.operationTypeevent.operationType
Use this token to filter events based on directory operation codes such as value added or deleted.
Examples
Show events where a value was added.
event.operationType: "%%14674"
Show events where a value was removed.
event.operationType: "%%14675"
event.processIdevent.processId
Use quotes or backticks within values to filter events based on the process ID associated with the activity.
Examples
Show events linked to a specific process ID.
event.processId: "508"
Match an exact process ID.
event.processId: `508`
event.samAccountNameevent.samAccountName
Use quotes or backticks within values to search events based on the SAM account name of the account involved. Wildcards can be used for pattern matching.
Examples
Show events for service accounts.
event.samAccountName: svc*
Match an exact account name.
event.samAccountName: `svc-backup`
event.sidHistoryevent.sidHistory
Use quotes or backticks within values to filter events involving SID History values added to accounts, often used to detect privilege escalation or SID injection.
Examples
Show events where high-privilege SIDs were added.
event.sidHistory: *-519
Match a specific SID value.
event.sidHistory: `S-1-5-21-...-519`
event.subjectDomainNameevent.subjectDomainName
Use quotes or backticks within values to filter events based on the domain of the initiating (caller) account.
Examples
Show events initiated by accounts in a domain.
event.subjectDomainName: "EMEA"
Match an exact domain.
event.subjectDomainName: `EMEA`
event.subjectLogonIdevent.subjectLogonId
Use quotes or backticks within values to correlate events belonging to the same logon session using the unique logon ID.
Examples
Show events from a specific session.
event.subjectLogonId: "0xF796886E"
Match an exact session ID.
event.subjectLogonId: `0xF796886E`
event.subjectUserNameevent.subjectUserName
Use quotes or backticks within values to filter events based on the username of the initiating account. Use wildcards or exclusions to refine searches.
Examples
Show events where username is populated.
event.subjectUserName: *
Exclude anonymous logons.
event.subjectUserName: * AND NOT event.subjectUserName:"-"
event.subjectUserSidevent.subjectUserSid
Use quotes or backticks within values to filter events based on the SID of the initiating account.
Examples
Show events not run by SYSTEM.
event.subjectUserSid: NOT "S-1-5-18"
Match a specific SID.
event.subjectUserSid: `S-1-5-21-...`
event.targetDomainNameevent.targetDomainName
Use quotes or backticks within values to filter events based on the NetBIOS domain of the target account.
Examples
Show events targeting a domain.
event.targetDomainName: "WPERF"
Match exact domain.
event.targetDomainName: `WPERF`
event.targetSidevent.targetSid
Use quotes or backticks within values to filter events based on the SID of the target object or group.
Examples
Show events targeting Domain Admins.
event.targetSid: *-512
Match exact SID.
event.targetSid: `S-1-5-21-...-512`
event.targetUserNameevent.targetUserName
Use quotes or backticks within values to search events based on the username of the target account.
Examples
Show events targeting Administrator.
event.targetUserName: "Administrator"
Match machine accounts.
event.targetUserName: *$
event.targetUserSidevent.targetUserSid
Use quotes or backticks within values to filter events based on the SID of the target user account.
Examples
Show events affecting Administrator account.
event.targetUserSid: *-500
Match exact SID.
event.targetUserSid: `S-1-5-21-...-500`
Use quotes or backticks within values to filter events based on the thread ID in which the event was generated.
Examples
Show events tied to a thread.
event.threadId: "1092"
Match exact thread ID.
event.threadId: `1092`
event.timeStampevent.timeStamp
Search events by specifying a time or time range corresponding to when the event occurred. Supports relative and absolute ranges.
Examples
Show events from the last hour.
event.timeStamp: [now-1h .. now]
Show events within a custom date range.
event.timeStamp: [2024-01-01 .. 2024-01-10]
event.userAccountControlevent.userAccountControl
Use quotes or backticks within values to filter events based on User Account Control flags associated with account configuration changes.
Examples
Show events enabling no pre-authentication.
event.userAccountControl: DONT_REQUIRE_PREAUTH
Match exact flag.
event.userAccountControl: `TRUSTED_FOR_DELEGATION`
event.userPrincipalNameevent.userPrincipalName
Use quotes or backticks within values to filter events based on the user principal name (UPN) of the account.
Examples
Show events for a domain suffix.
event.userPrincipalName: @WPERF.com
Match exact UPN.
event.userPrincipalName: `[email protected]`
event.workstationNameevent.workstationName
Use quotes or backticks within values to filter events based on the workstation from which the activity originated.
Examples
Show events from a workstation.
event.workstationName: "138653-P14S"
Match exact workstation name.
event.workstationName: `138653-P14S`
Active Directory (AD) Alert Tokens
Use these tokens to define search criteria for Active Directory alerts generated by detection rules. Alerts represent suspicious or anomalous activities detected from underlying events.
Use this token to search for alerts generated by a specific Qualys Cloud Agent associated with a domain controller.
Example
Show alerts reported by a specific agent.
alert.agentId: "CF76B66F-D276-481C-9D48-623506240C5D"
Use this token to filter alerts based on the Windows audit category of the originating event. Quotes are recommended for multi-word values.
Example
Show alerts related to policy changes.
alert.category: "Policy Change"
alert.domainNamealert.domainName
Use this token to scope alerts to a specific Active Directory domain using DNS format.
Example
Show alerts for a particular domain.
alert.domainName: "WPERF.com"
alert.event.adminCountalert.event.adminCount
Use this token to identify alerts involving privileged accounts where adminCount is set to 1.
Example
Show alerts affecting privileged users.
alert.event.adminCount: 1
alert.event.auditPolicyCategoryalert.event.auditPolicyCategory
Use this token to search alerts involving changes to audit policy categories.
Example
Show audit-policy change alerts by category.
alert.event.auditPolicyCategory: *
alert.event.auditPolicySubcategoryalert.event.auditPolicySubcategory
Use this token to filter alerts by specific audit subcategory changes.
Example
Show alerts where Directory Service Access auditing was modified.
alert.event.auditPolicySubcategory: "Directory Service Access"
alert.event.authenticationPackageNamealert.event.authenticationPackageName
Use this token to filter alerts by the authentication package used, such as NTLM or Kerberos.
Example
Show alerts authenticated via NTLM.
alert.event.authenticationPackageName: NTLM
alert.event.elevatedTokenalert.event.elevatedToken
Use this token to filter alerts based on whether the logon session used an elevated token.
Example
Show alerts with elevated privileges.
alert.event.elevatedToken: "%%1842"
alert.event.ipAddressalert.event.ipAddress
Use this token to filter alerts based on the source IP address involved in the activity.
Example
Show alerts originating from a suspicious IP.
alert.event.ipAddress: "10.119.215.68"
alert.event.logonTypealert.event.logonType
Use this token to filter alerts based on numeric Windows logon types.
Example
Show network logon alerts.
alert.event.logonType: "3"
alert.event.logonTypeNamealert.event.logonTypeName
Use this token to filter alerts using the readable name of the logon type.
Example
Show alerts for network logons.
alert.event.logonTypeName: "Network"
alert.event.memberOfalert.event.memberOf
Use this token to search alerts involving accounts that belong to a specific group.
Example
Show alerts involving Domain Admin accounts.
alert.event.memberOf: "Domain Admins"
alert.event.objectClassalert.event.objectClass
Use this token to filter alerts based on the class of the directory object involved in the activity.
Example
Show alerts involving Group Policy objects.
alert.event.objectClass: groupPolicyContainer
alert.event.objectTypealert.event.objectType
Use this token to filter alerts based on the schema GUID representing the type of object accessed.
Example
Show alerts involving user-class objects.
alert.event.objectType: bf967aba
alert.event.sidHistoryalert.event.sidHistory
Use this token to search alerts involving SID History values added to accounts, which may indicate privilege escalation.
Example
Show alerts where privileged SIDs were injected.
alert.event.sidHistory: *-512
alert.event.subjectDomainNamealert.event.subjectDomainName
Use quotes or backticks within values to filter alerts based on the domain of the initiating account.
Example
Show alerts from a specific domain.
alert.event.subjectDomainName: "WPERF"
alert.event.objectDNalert.event.objectDN
Use quotes or backticks within values to search alerts by the distinguished name (DN) of directory objects affected in the event.
Examples
Show alerts affecting the AdminSDHolder container.
alert.event.objectDN: "AdminSDHolder"
Match an exact DN value.
alert.event.objectDN: `CN=AdminSDHolder,CN=System,DC=WPERF,DC=com`
alert.event.objectNamealert.event.objectName
Use quotes or backticks within values to search alerts based on the name of the accessed directory object.
Examples
Show alerts targeting a specific object name.
alert.event.objectName: Administrator
Match an exact object name.
alert.event.objectName: `AdminSDHolder`
alert.event.subjectLogonIdalert.event.subjectLogonId
Use quotes or backticks within values to correlate alerts belonging to the same logon session.
Example
Show alerts tied to a specific session.
alert.event.subjectLogonId: "0x66CC4A94"
alert.event.subjectUserNamealert.event.subjectUserName
Use quotes or backticks within values to search alerts based on the username of the initiating account.
Examples
Show alerts for valid user accounts.
alert.event.subjectUserName: *
Exclude anonymous logons.
alert.event.subjectUserName: * AND NOT alert.event.subjectUserName:"-"
alert.event.subjectUserSidalert.event.subjectUserSid
Use quotes or backticks within values to search alerts based on the Security Identifier (SID) of the subject (caller) account involved in the activity. This is useful for identifying actions performed by specific system accounts or anonymous logons.
Examples
Show alerts where the caller SID is anonymous.
alert.event.subjectUserSid: "S-1-0-0"
Show alerts generated by the SYSTEM account.
alert.event.subjectUserSid: "S-1-5-18"
alert.event.targetDomainNamealert.event.targetDomainName
Use quotes or backticks within values to filter alerts based on the NetBIOS (short) domain name of the target account affected by the activity. This token helps scope alerts to a specific domain when investigating cross-domain or domain-specific actions.
Examples
Show alerts whose target account belongs to a specific domain.
alert.event.targetDomainName: "WPERF"
Match alerts for an exact domain value.
alert.event.targetDomainName: `WPERF`
alert.event.targetSidalert.event.targetSid
Use quotes or backticks within values to search for alerts based on the Security Identifier (SID) of the target object or group affected by the action. This helps identify activity impacting specific privileged groups or directory objects.
Examples
Show alerts targeting the Domain Admins group.
alert.event.targetSid: *-512
Match alerts for a specific SID value.
alert.event.targetSid: `S-1-5-21-...-512`
alert.event.targetUserNamealert.event.targetUserName
Use quotes or backticks within values to search for alerts based on the username of the target account affected by the activity. Wildcards such as * can be used, and values ending with $ represent machine accounts.
Examples
Show alerts targeting the built-in Administrator account.
alert.event.targetUserName: "Administrator"
Show alerts involving machine accounts.
alert.event.targetUserName: *$
alert.event.targetUserSidalert.event.targetUserSid
Use quotes or backticks within values to filter alerts based on the SID of the target user account impacted by the event. This is useful for identifying actions against well-known or privileged user accounts.
Examples
Show alerts affecting the built-in Administrator account.
alert.event.targetUserSid: *-500
Match alerts for an exact user SID.
alert.event.targetUserSid: `S-1-5-21-...-500`
alert.event.workstationNamealert.event.workstationName
Use quotes or backticks within values to search for alerts based on the source workstation from which the activity originated. This helps trace suspicious actions back to a specific endpoint.
Examples
Show alerts originating from a specific workstation.
alert.event.workstationName: "138653-P14S"
Match alerts for an exact workstation name.
alert.event.workstationName: `138653-P14S`
Use this token to filter alerts based on the Windows Security Event ID that triggered the alert.
Example
Show alerts generated from logon events.
alert.eventId: "4624"
alert.eventObjectIdalert.eventObjectId
Use this token to locate alerts linked to a specific source event object ID.
Example
Find alerts mapped to a known event.
alert.eventObjectId: "599aa857-976b-359a-85f4-5d1700e04c85"
Use this token to filter alerts based on the fully qualified hostname of the domain controller.
Example
Show alerts from a specific host.
alert.host: "W19QAGPERF3.WPERF.com"
Use this token to retrieve a specific alert using its unique identifier.
Example
Look up a single alert.
alert.id: "b4f7e433-332d-3c00-a4fa-f5cf37c3ae7a"
Use this token to search alerts generated by a specific detection rule.
Example
Show alerts created by a rule.
alert.ruleId: "ISPMRTPTHNTLMLateralMovementLogonType3"
Use quotes or backticks within values to search alerts based on the name of the detection rule that generated the alert. This token helps identify alerts tied to specific detection logic or use cases. Quotes are recommended for multi-word values, and backticks can be used for exact matching.
Examples
Show alerts generated by a rule containing a specific name.
alert.ruleName: Pass-the-Hash
Match alerts generated by an exact rule name.
alert.ruleName: `Pass-the-Hash NTLM Lateral Movement`
Use this token to filter alerts based on severity level from 1 to 5, where 5 represents the highest severity.
Example
Show only critical alerts.
alert.severity: "5"
Use this token to filter alerts based on when they were generated. Supports relative and range-based queries.
Examples
Show alerts from the last 24 hours.
alert.time: [now-24h .. now]
Show alerts from the last 7 days.
alert.time: [now-7d .. now]
Use this token to search alerts by their title or finding name. Quotes are recommended for phrases and backticks for exact matches.
Examples
Find alerts containing text.
alert.title: Pass-the-Hash
Match exact title.
alert.title: `Pass-the-Hash`
``