A curated set of 28 Windows Security and System event IDs that come up
constantly in real investigations — not an exhaustive dump of every event ID Windows can
generate. Search by ID number, a keyword (event name or what it's used for), or filter by
category. Each entry includes typical meaning, severity guidance, common investigation
steps, MITRE ATT&CK mappings where applicable, and related event IDs. Pairs with this
site's Windows Security Event IDs
guide, which this dataset builds on. Runs entirely in your browser; nothing you search
is sent anywhere.
A note on scope
28 event IDs is a deliberately small, curated set — the ones that come up constantly in
real triage, not a complete Windows event catalog (Windows defines thousands). Severity
guidance and investigation steps reflect general practice; always weigh them against your
own environment's baseline — the same event ID can be routine in one environment and a
strong signal in another.