Security Log Reference: Error Codes and Log Formats
Vendor documentation explains error codes and log fields to the people who build on the platform. These pages explain them to the people investigating it: what a code says about the attacker, which fields carry the signal, and the query that confirms it. Every Microsoft code definition is quoted verbatim and re-checked against the published table on each build; every log field is checked against real sample files.
What each sign-in failure means for an investigation — above all, whether the password was correct.
All 5 →The Status and SubStatus values in events 4625 and 4776, read as attack signals rather than help-desk tickets.
All 4 →Field-by-field guides to security log formats, with real sample records and the parsing traps that drop data.
- Entra ID (Azure AD) Sign-In Log Fields
- CrowdStrike Falcon Event Log Fields
- Duo Security Log Format
- Kubernetes Audit Log Fields
- Okta System Log Format
- Sysmon Log Fields
- AWS VPC Flow Log Format
Have a log file in front of you?
The free browser analyzer recognises Entra ID sign-ins, Windows Security events, Linux auth.log, nginx/Apache, CloudTrail and Okta, links every code it finds back to these pages, and never uploads the file.
Open the free analyzer →