How mdecrevoisier/microsoft-eventlog-mindmap works
This repository is a reference library of five Microsoft event-log and auditing mind maps, rather than a software runtime. Defenders consult the maps to understand available log sources and auditing capabilities for collection, threat hunting, incident response, forensics, and troubleshooting. The Exchange email-compromise map focuses on hunting abused email rules. The PDFs are listed in the tree, but their contents were not sampled; descriptions and relationships here rely on the README.
Main entry points: windows-auditing-baseline-map.pdf Windows OS baseline · windows-server-roles-map.pdf Server roles auditing · active-directory-map.pdf Active Directory auditing · exchange-server-map.pdf Exchange Server logs
Components 6
Windows auditing
- Windows OS baseline
windows-auditing-baseline-map/windows-auditing-baseline-map.pdf - Server roles auditing
windows-server-roles-map/windows-server-roles-map.pdf - Active Directory auditing
active-directory-map/active-directory-map.pdf
Exchange
- Exchange Server logs
exchange-server-map/exchange-server-map.pdf - Email rule hunting
exchange-email-compromise-map/exchange-email-compromise.pdf
Other components
- Defender
Connections 5
- Defender → Windows OS baseline: consults
- Defender → Server roles auditing: consults
- Defender → Active Directory auditing: consults
- Defender → Exchange Server logs: consults
- Defender → Email rule hunting: consults