windows security log event ID

윈도우 보안로그의 이벤트 ID를 아래와 같이 정리하였습니다.

Event ID	Task Category	Description	한글 설명
4611	Security System Extension	A trusted logon process has been registered with the Local Security Authority.	신뢰할 수 있는 로그온 프로세스가 로컬 보안 기관에 등록되었습니다. 이 로그온 프로세스는 로그온 요청을 전송하도록 신뢰됩니다.
4624	Logon	An account was successfully logged on.	계정이 성공적으로 로그온되었습니다.
4625	Logon	An account failed to log on.	계정을 로그온하지 못했습니다.
4627	Group Membership	Group membership information.	그룹 구성원 정보입니다.
4634	Logoff	An account was logged off.	계정이 로그오프되었습니다.
4648	Logon	A logon was attempted using explicit credentials.	명시적 자격 증명을 사용하여 로그온을 시도했습니다.
4656	Kernel Object	A handle to an object was requested.	개체에 대한 핸들을 요청했습니다.
4658		The handle to an object was closed.	개체에 대한 핸들을 닫았습니다.
4663		An attempt was made to access an object.	개체에 액세스하려고 했습니다.
4648	Logon	A logon was attempted using explicit credentials.	권한 있는 서비스를 호출했습니다.
4670	Authorization Policy Change	Permissions on an object were changed.	개체에 대한 권한을 변경했습니다.
4672	Special Logon	Special privileges assigned to new logon.	특수 권한을 새 로그온에 할당했습니다.
4673	Sensitive Privilege Use	A privileged service was called.	권한 있는 서비스를 호출했습니다.
4674	Sensitive Privilege Use	An operation was attempted on a privileged object.	권한 있는 개체에 대한 작업을 시도했습니다.
4688	Process Creation	A new process has been created.	새 프로세스가 만들어졌습니다.
4689	Process Termination	A process has exited.	프로세스가 끝났습니다.
4690	Handle Manipulation	An attempt was made to duplicate a handle to an object.	개체에 대한 핸들을 중복하려고 했습니다.
4703	Token Right Adjusted Events	A token right was adjusted.	토큰 권한이 조정되었습니다.
4719	Audit Policy Change	System audit policy was changed.	시스템 감사 정책을 변경했습니다.
4738	User Account Management	A user account was changed.	사용자 계정을 변경했습니다.
4776	Credential Validation	The domain controller attempted to validate the credentials for an account.	컴퓨터에서 계정의 자격 증명에 대한 유효성 검사를 시도했습니다.
4797	User Account Management	An attempt was made to query the existence of a blank password for an account.	계정의 빈 암호가 존재하는지 쿼리하려고 했습니다.
4798	User Account Management	A user's local group membership was enumerated.	사용자의 로컬 그룹 구성원이 열거되었습니다.
4800	Other Logon/Logoff Events	The workstation was locked	워크스테이션이 잠겨 있습니다.
4801	Other Logon/Logoff Events	The workstation was unlocked	워크스테이션 잠금을 해제했습니다.
4957	MPSSVC Rule-Level Policy Change	Windows Firewall did not apply the following rule	Windows 방화벽에서 적용하지 않은 규칙은 다음과 같습니다.
5031	Filtering Platform Packet Drop	The Windows Firewall Service blocked an application from accepting incoming connections on the network.	Windows 방화벽 서비스에서 응용 프로그램이 네트워크에서 들어오는 연결을 허용하지 않습니다.
5152	Filtering Platform Packet Drop	The Windows Filtering Platform blocked a packet.	Windows 필터링 플랫폼에서 패킷을 차단했습니다.
5154	Filtering Platform Connection	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections	Windows 필터링 플랫폼에서 응용 프로그램 또는 서비스의 들어오는 연결에 대한 포트 수신을 허용했습니다.
5156	Filtering Platform Connection	The Windows Filtering Platform has allowed a connection.	Windows 필터링 플랫폼에서 연결을 허용했습니다.
5157		The Windows Filtering Platform has blocked a connection.	Windows 필터링 플랫폼에서 연결을 차단했습니다.
5158		The Windows Filtering Platform has permitted a bind to a local port.	Windows 필터링 플랫폼에서 로컬 포트에 대한 바인딩을 허용했습니다.
5379	Other System Events	Credential Manager credentials were read.	자격 증명 관리자 자격 증명을 읽었습니다.
5382		Vault credentials were read.	자격 증명 모음 자격 증명을 읽었습니다.