Windows Security Events Monitoring Dashboard

Description:

This Splunk dashboard focuses on key Windows Security Event IDs that are important for authentication and privilege monitoring:

• • 4624 (Successful Logons): Tracks account login activity to help identify unusual spikes or odd timing patterns.

  • 4672 (Special Privileges Assigned): Highlights when accounts are granted administrator-level rights, useful for detecting privilege escalation attempts.

  • 4798 & 4799 (Group Enumeration): Monitors group membership lookups, which can indicate reconnaissance activity.
    
    

By filtering out noisy system events, this dashboard provides a clearer view of authentication behavior and potential misuse of privileges.