Hayabusa: the channel and the event id are a pair

The id needs the channel

A timeline row has a channel, such as Security or System, and an event id. The id is meaningful inside that channel. Quoting 7045 without System, or 4624 without Security, leaves the record ambiguous. The pair is how you open the event.

The level and the rule title do not select the channel. A high row can be in System. A medium row can be in Security. Do not move an id to a different channel because the title sounds like it belongs there.

The same digits can appear twice

If two rows show the same event id and different channels, they are two records. Do not merge them into one because the number matches. Write both pairs. If you only have the id, write “channel not on this row” and do not guess Security.

What to file

File Computer, Channel, and EventID together, then the rule title as the rule’s name if you need it. When you open the log, open that channel’s file. Do not open Security.evtx for a System id and call it the same event.

Worked case: 7045 opened in the Security log

A row on LAB-02 shows Channel System, EventID 7045, a rule title about a new service. A draft looks in Security.evtx for 7045, finds nothing, and says the service event was not logged.

The note quotes System and 7045. The search of Security.evtx is a different channel. The event is not missing. It was looked up in the wrong log. The finding cites the System record once it is opened there.

Snippet

Computer: LAB-02
Channel: System  EventID: 7045
looked in Security.evtx: a different channel
write: open System for this id
not: the event was not logged

Diagram

Keep the channel with the id

Channel
Which log the event is in.
Row
```
System
```
EventID
The id inside that log.
Row
```
7045
```
Open
The file for that channel.
Log
```
System.evtx
```
Other channel
A different record, even with the same digits.
Note
```
do not merge them
```

Check yourself

1. A row shows EventID 7045 and Channel System. Where do you open it?

2. Two rows have the same event id and different channels. What are they?

3. The channel cell is empty and the id is 4624. What do you write?