Security subsystem started. Generated at boot.
Use to establish boot timeline. Correlate with 6005 (System log). Unexpected Windows restarts warrant review.
No standalone alerting. Use for forensic timeline reconstruction.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4608 // Windows is starting up
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4608
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Windows is starting up — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`Windows is starting up. Security subsystem started. Generated at boot.
Event 4608 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'System' subcategory (Success and/or Failure).
No standalone alerting. Use for forensic timeline reconstruction.