Before working with a SIEM, you need to understand what you are actually looking at when you read a Windows Security log. This lesson walks through Event Viewer — the built-in Windows tool giving you direct access to every logged event on that machine.
How to Access Security Event Logs
Option 1 — Event Viewer (GUI): Press Windows key → search Event Viewer → open it. Expand Windows Logs → click Security.
Option 2 — Filter by Event ID: Right-click Security → Filter Current Log → type an Event ID (e.g., 4625) → OK.
What You Are Looking At
- Date and Time: When it happened
- Event ID: What type of event (your primary classification)
- Level: Information, Warning, or Error
- Source: Which Windows component generated the event
- Details tab: The raw structured data — Account Name, Logon Type, Source IP
The Details tab is where investigations happen. The top-level view tells you what kind of event. The details tell you who, from where, and how.
📁 Free handout & resources: Download the Module 11 PDF — reference tables, Event ID cheat sheet, lab guides.
Learning Objective
After this lesson, you can navigate to the Windows Security Event Log in Event Viewer, filter by Event ID, and read the key fields in a log entry.
Try It
- Open Event Viewer
- Filter the Security log for EventCode 4625
- Read the Details on any entries — what Account_Name appears? What Logon Type?
- If there are no entries: correct answer — no failed logins on this machine
Part of the free Intro to Cyber course by Cover6 Solutions.