Active Directory Security Event IDs Used by PaloAlto User-ID Agent 

Environment -

• Windows based User-ID Agent.
• All version.

2000 - 2003:

SUCCESS_NET_LOGON = 540
AUTH_TICKET_GRANTED = 672
SERVICE_TICKET_GRANTED = 673
TICKET_GRANTED_RENEW = 674 


2008 and above:

LOGON_SUCCESS_W2008 = 4624
AUTH_TICKET_GRANTED_W2008 = 4768
SERVICE_TICKET_GRANTED = 4769
TICKET_GRANTED_RENEW_W2008 = 4770