Application Event ID 1001 — Application fault bucket — SecOps Tools

Why event 1001 matters

Minimal additional value beyond 1000. Contains WER (Windows Error Reporting) data.

How to detect it

Use with 1000 for complete crash analysis.

Log source

Application

Logged by default in the Application channel; no audit policy required.

Fields to pivot on

Application NameFaulting ModuleComputer

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Application" and EventID == 1001   // Application fault bucket
// EventData holds: Application Name, Faulting Module, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Application" EventCode=1001
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Application fault bucket — add EventData fields: Application Name, Faulting Module, Computer`

Hunt event 1001 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Application Error events

1000 Application error

Frequently asked questions

What is Application Event ID 1001?

Application fault bucket. Error reporting bucket for a previous application fault. Generated after 1000 events.

Which log records event 1001?

Event 1001 is written to the Application channel by Application. Logged by default in the Application channel; no audit policy required.

How do you detect activity around event 1001?

Use with 1000 for complete crash analysis.