Daily Defender News
Aboutmerill.net
Microsoft Defender for Identity
Identity protection

Listen for SIEM events | Microsoft Defender for Identity

4 September 2026Doc update+9 / −12 lines

In brief

The page now clarifies supported SIEM event types, required message syntax, and examples for RSA Security Analytics, MicroFocus ArcSight, Splunk, and QRadar, including required CEF keys and timestamp guidance.

What Defender admins need to know

Review the examples when configuring standalone sensors to ensure forwarded Windows event 4776 messages use the required fields and formats.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Listen for SIEM events on your Defender for Identity standalone sensor

Configure RSA Security Analytics event collection

The following raw syslog example shows how a Windows event 4776 message should be formatted for RSA Security Analytics collection. Use the followingthis message syntax to configure your standalone sensor to listen for RSA Security Analytics events. In the example, <Syslog Header> represents the standard RFC 3164 syslog header prefix, which is optional:

<Syslog Header>RsaSA\n2015-May-19 09:07:09\n4776\nMicrosoft-Windows-Security-Auditing\nSecurity\XXXXX.subDomain.domain.org.il\nYYYYY$\nMMMMM \n0x0
<a name="microfocus-arcsight"></a>
## Configure MicroFocus ArcSight event collection

The following example shows a complete Common Event Format (CEF) event 4776 message with the required Extension keys (`externalId`, `rt`, `cat`, `shost`, `dhost`, and `duser`) populated. Use this syntax to configure your standalone sensor to listen for MicroFocus ArcSight events:

```text
CEF:0|Microsoft|Microsoft Windows||Microsoft-Windows-Security-Auditing:4776|The domain controller attempted to validate the credentials for an account.|Low| externalId=4776 cat=Security rt=1426218619000 shost=KKKKKK dhost=YYYYYY.subDomain.domain.com duser=XXXXXX cs2=Security cs3=Microsoft-Windows-Security-Auditing cs4=0x0 cs3Label=EventSource cs4Label=Reason or Error Code

- The header part, separated by a *pipe* (**|**) must be included, as stated in the protocol

- The following keys in the *Extension* part must be present in the event:CEF event message:

    |Key  |Description  |
    |---------|---------|

    The order isn't important for the *Extension* part.

- You must havedefine a custom key and **keyLable** for the following fields:

    - `EventSource` -field and the `Reason or Error Code` = Thefield (the result code of the NTLMNTLM).

<a name="splunk"></a>
## Configure Splunk event collection

The following key-value formatted syslog example shows a sample Splunk event message forhow to represent event 4776 for Splunk collection while preserving millisecond precision in key-value format, with the required fields in context.timestamp. Use this syntax to configure your standalone sensor to listen for Splunk events:

```text
<Syslog Header>\r\nEventCode=4776\r\nLogfile=Security\r\nSourceName=Microsoft-Windows-Security-Auditing\r\nTimeGenerated=20150310132717.784882-000\r\ComputerName=YYYYY\r\nMessage=

Because Defender for Identity needs millisecond data, you must first configure QRadar to use agentless Windows event collection. For more information, see [QRadar: Agentless Windows Events Collection using the MSRPC Protocol](https://www.ibm.com/support/pages/qradar-agentless-windows-events-collection-using-msrpc-protocol-msrpc-faq).

The following example shows a complete QRadar syslog message for Windows Security event 4776, collected agentlessly to preserve millisecond timestamp fidelity. Use the followingthis message syntax to configure your standalone sensor to listen for QRadar events:

```text
<13>Feb 11 00:00:00 %IPADDRESS% AgentDevice=WindowsLog AgentLogFile=Security Source=Microsoft-Windows-Security-Auditing Computer=%FQDN% User= Domain= EventID=4776 EventIDCode=4776 EventType=8 EventCategory=14336 RecordNumber=1961417 TimeGenerated=1456144380009 TimeWritten=1456144380009 Message=The computer attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: Administrator Source Workstation: HOSTNAME Error Code: 0x0