Start with three sources: Security log logon events (4624 and 4625), Security log process creation (4688), and, if it was deployed, the Sysmon Operational log. Together they answer the first questions of most endpoint investigations: who got in, what ran, and what it connected to. None of them is a verdict on its own, and none exists unless auditing or Sysmon was configured before the activity happened.
Step 0: Frame the question and preserve the data
Before opening Event Viewer, decide the host, the time window, the accounts of interest, and the specific question (for example, “how did this account get a session at 02:10, and what did it launch?”). Export the relevant logs rather than only reading them live, and record the time zone of the machine, of your viewer, and of any central collection platform. Sysmon timestamps are UTC according to Microsoft’s Sysmon events documentation, so mismatches with local-time Security events are a common source of timeline errors.
As an Amazon Associate I earn from qualifying purchases.
This guide is a starting workflow built on Microsoft documentation. It is not a complete incident response playbook, and it does not cover every attack technique or Windows version.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 1: Logon events in the Security log
4624: a logon session was created
Event 4624 means an account was successfully logged on, and it is recorded on the destination computer where the session was created, per Microsoft’s 4624 reference. For an investigation, read these elements together:
#1 Best Overall
- Used Book in Good Condition
- Account that logged on, and the account that requested the logon (they can differ).
- Logon type, which tells you how the session was created (interactive, network, remote and so on) and changes what the event means.
- Source information such as workstation name and source address, where populated.
- Identifiers: Logon ID and Logon GUID let you tie this event to later events from the same session. Microsoft also notes that process IDs can link a logon record to process creation evidence.
4625: failed logons
Look at failures near the successes. A cluster of failures followed by a success for the same account is a lead worth examining, not proof of a guessed password; users mistype too. Compare source, logon type, and timing.
Microsoft’s Sentinel Windows security event reference lists these logon events among its collection sets, which is useful if you rely on centralized collection.
Step 2: Process creation with 4688
Event 4688 records that a new process was created, with parent and child context, as defined in Microsoft’s 4688 reference. Pull the 4688 events that fall inside the sessions you identified in step 1 and check what launched what.
Command lines are optional and sensitive
Two separate settings matter. Audit Process Creation produces the event; including the command line is a different policy. Per Microsoft’s command-line process auditing page, command lines are stored in plain text, so passwords or personal data typed into arguments can be exposed to anyone who can read the Security log. If you enable them, restrict log access and apply retention accordingly. If a 4688 event has no command line, that may simply mean the policy was off, not that the process had no arguments.
Rank #3
- TRACK MILEAGE AND MORE: Tracking mileage and expenses for work doesn’t have to be a time-consuming chore. With the Portage mileage notebook, keeping track of business expenses is easy.
- EXTRA PAGES: Meant to last the whole year, the Portage mileage log includes 60 pages, 33% more pages than other top brands. This mileage notebook measures 5” x 8”, making it large enough to comfortably fill out while being small enough to fit in a glove compartment, center console or work bag.
- SIMPLE FORMAT - Each page is designed with spaces for the date, business purpose, odometer reading, and total mileage. The larger form boxes give you plenty of space to write comfortably, so notes and details are easy to add and view
- DURABLE DESIGN - Built to last, our spiral mileage logbook is constructed with extra-thick paper and a stiff backing meant to stand up to daily use. The extra stiff back ensures you never have to worry about finding a surface to write on
- RECORD ON YOUR TERMS - Whether you need to track expenses or just mileage for a flat deduction rate, this journal has you covered. With plenty of room for notes and more pages than other brands, Portage notebooks are built to last and priced to sell
Step 3: Sysmon, if it exists
Sysmon writes to the Windows Event Log; check Applications and Services Logs > Microsoft > Windows > Sysmon > Operational. Microsoft is explicit that “Sysmon doesn’t analyze events or generate alerts” (Enable and configure Sysmon). It is telemetry that you or other tooling must analyze.
- Don’t assume it is installed, or that its configuration collects the event types you need. It must be configured, and filters can remove useful context (see Read and tune Sysmon events).
- Use the event type, paths, hashes, and network details as present in each configured event type.
- Prefer the process GUID for correlating Sysmon process events. Windows reuses process IDs, so PID alone can join unrelated processes (Sysmon overview).
Step 4: Check what could have been recorded
Before treating a missing record as meaningful, verify the audit policy, the Sysmon configuration, the log size and retention (logs that wrapped lose old events), and whether your collection pipeline forwards the events. Absence of an event is not proof the activity did not happen; it may reflect policy, filtering, deployment gaps, or retention. Microsoft’s Sentinel event sets also show that bundles differ and that high-volume events affect collected volume, so a central platform may hold less than the endpoint did (Microsoft gives no universal volume figure).
Rank #4
- The perfect product for busy offices, walk-in advising centers, call centers, and other high-traffic businesses
- Keep track of activities and follow-ups
- Includes columns for date, time, name of contact, phone number, subject, follow-up action required, initials of individual completing the log, and check box to signal completion
- Spiral bound at left
- 100 pages per book
Step 5: Build the timeline
| Link | Join on | Caveat |
|---|---|---|
| Logon to later activity | Logon ID / Logon GUID (4624) | Only where the later event carries the field |
| Logon to process | Process ID, account, time | PIDs get reused; confirm by time |
| Parent to child process | 4688 parent/child fields; Sysmon process GUIDs | Command line only if enabled |
| Process to network or files | Sysmon process GUID, paths, network fields | Only for event types Sysmon was configured to log |
Normalize all times to UTC, then order events by actor, host, session, and process. Write down what each link rests on and what remains uncertain. A successful logon, a process start, or an unusual path is an observation. Corroborate with other evidence before stating attribution or intent.
Choosing what to collect going forward
| Axis | Native Security auditing | Sysmon | Central collection |
|---|---|---|---|
| Prerequisite | Audit policy (plus command-line policy for 4688) | Deployment and configuration | Forwarding rules and an event set |
| Strength | Logons, process creation | Process GUIDs, hashes, network details when configured | Retention beyond the endpoint |
| Risk | Plain-text command lines | Over-filtering hides context | Volume and gaps from selective sets |
Choose according to the questions you must answer, how long you must retain data, and who may read it. Avoid copying an event list without understanding its context.
Quick Recap
Best Value
- Daily log books for truckers with detailed DVIR includes record of duty status regulations on the inside back cover to simplify vehicle log book completion.
- Drivers daily log book offer monthly summary sheet and 7- and 8-day recap to help drivers quickly determine hours available.
- This vehicle log book set comes with 10 books. Each book contains 31 sets of forms. Total, you will receive 310 forms.
- Driver log book is 2-ply with carbon.
- DOT log book measures 8.5" x 5.5".
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
