User or device claim information logged as supplement to 4624. Contains claim details for claims-based access.
Useful for dynamic access control investigations. Claims manipulation in DAC environments.
No standalone alerting. Correlate with 4624 for claims context.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4626 // User/Device claims information
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4626
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# User/Device claims information — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`User/Device claims information. User or device claim information logged as supplement to 4624. Contains claim details for claims-based access.
Event 4626 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
No standalone alerting. Correlate with 4624 for claims context.