---
title: Event capture and Elastic Defend
description: Elastic Defend collects selective data on system activities in order to detect and prevent as many threats as possible, while balancing storage and performance...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9233/solutions/security/manage-elastic-defend/event-capture-elastic-defend
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Event capture and Elastic Defend
Elastic Defend collects selective data on system activities in order to detect and prevent as many threats as possible, while balancing storage and performance overhead. To that end, Elastic Defend isn’t designed to provide a complete capture of all system events. The event data that Elastic Defend generates might be aggregated, truncated, or deduplicated as needed to optimize threat detection and prevention.
You can supplement Elastic Defend's protection capabilities with additional [Elastic integrations](https://docs.elastic.co/en/integrations) and tools that provide more visibility and historical data. Consult the following sections to learn what Elastic Defend collects for specific system events and how to expand data collection.
The detailed event and API lists on this page cover Windows only. For other operating systems, Elastic Defend collects a similar selective set of events, but this page doesn't list them. To see which event categories Elastic Defend collects on each operating system, refer to [Event collection](/elastic/docs-content/pull/9233/solutions/security/configure-elastic-defend/configure-an-integration-policy-for-elastic-defend#event-collection).

## Network port creation and deletion

Elastic Defend tracks TCP connections. If a port is created but no traffic flows, no events are generated.
For complete capture of network port creation and deletion, consider capturing Windows event ID 5158 using the [Custom Windows Event Logs](https://docs.elastic.co/en/integrations/winlog) integration.

## Network in/out connections

Elastic Defend tracks TCP connections, which don’t include network in/out connections.
For complete network capture, consider deploying Packetbeat using the [Network Packet Capture](https://docs.elastic.co/en/integrations/network_traffic) integration.

## User behavior

Elastic Defend collects a selected set of user security events to support threat detection and prevention. It doesn't capture every user event, and the events it collects vary by operating system.

### Windows user events

On Windows, Elastic Defend uses Event Tracing for Windows (ETW) to collect the following Windows Security events and stores them in the `logs-endpoint.events.security-*` data stream.

| Windows event ID                                                                                                                                  | Description                                       |
|---------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|
| 4624                                                                                                                                              | An account was successfully logged on.            |
| 4625                                                                                                                                              | An account failed to log on.                      |
| 4634                                                                                                                                              | An account was logged off.                        |
| 4648                                                                                                                                              | A logon was attempted using explicit credentials. |
| 4672                                                                                                                                              | Special privileges were assigned to a new logon.  |
| 4720 <applies-to>Elastic Stack: Generally available since 9.5</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | A user account was created.                       |
| 4800                                                                                                                                              | The workstation was locked.                       |
| 4801                                                                                                                                              | The workstation was unlocked.                     |
| 5382 <applies-to>Elastic Stack: Generally available since 9.5</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | Vault credentials were read.                      |

Elastic Defend doesn't collect other user-related events, such as user account deletion or modification. To collect these events, use the [Custom Windows Event Logs](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/winlog) integration.

## System service registration, deletion, and modification

Elastic Defend only captures system service security events required by its behavioral protection engine.

### Windows service events

On Windows, Elastic Defend uses Event Tracing for Windows (ETW) to collect the following Windows Security events and stores them in the `logs-endpoint.events.security-*` data stream.

| Windows event ID                                                                                                                                  | Description                            |
|---------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------|
| 4697 <applies-to>Elastic Stack: Generally available since 9.5</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | A service was installed in the system. |

Service creation and modification can also be detected in registry activity, for which Elastic Defend has internal rules such as [Registry or File Modification from Suspicious Memory](https://github.com/elastic/protections-artifacts/blob/6d54ae289b290b1d42a7717569483f6ce907200a/behavior/rules/persistence_registry_or_file_modification_from_suspicious_memory.toml).
For complete capture of all or specific Windows security events, consider the [Custom Windows Event Logs](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/winlog) integration.

## Scheduled task creation and modification

Elastic Defend only captures scheduled task security events required by its behavioral protection engine.

### Windows scheduled task events

On Windows, Elastic Defend uses Event Tracing for Windows (ETW) to collect the following Windows Security events and stores them in the `logs-endpoint.events.security-*` data stream.

| Windows event ID                                                                                                                                  | Description                   |
|---------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------|
| 4698 <applies-to>Elastic Stack: Generally available since 9.5</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | A scheduled task was created. |
| 4702 <applies-to>Elastic Stack: Generally available since 9.5</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to> | A scheduled task was updated. |

For complete capture of all or specific Windows security events, consider the [Custom Windows Event Logs](https://docs-v3-preview.elastic.dev/elastic/integration-docs/tree/main/reference/winlog) integration.

## Windows API calls

On Windows, Elastic Defend monitors calls to sensitive Windows APIs that malware commonly abuses, and stores selected calls as API events in the `logs-endpoint.events.api-*` data stream. The name of the called API is stored in the `process.Ext.api.name` field.
Elastic Defend doesn't generate an event for every call to a monitored API. Events are generated only under certain conditions. Also, some API events aren't sent to Elasticsearch by default. To send these events to Elasticsearch, set the [`windows.advanced.events.api_verbose`](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9233/reference/security/defend-advanced-settings) advanced policy setting to `true`.
<dropdown title="Monitored Windows APIs">
  - `AmsiScanBuffer`
  - `connect`
  - `CreateProcessAsUserA` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `CreateProcessAsUserW` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `DeviceIoControl`
  - `GetAsyncKeyState`
  - `ImpersonateLoggedOnUser` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `ImpersonateNamedPipeClient` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `INetFwRules::Add` <applies-to>Elastic Stack: Generally available since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `InternetOpenUrl` <applies-to>Elastic Stack: Generally available since 9.3</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `IoCreateDevice`
  - `IWbemServices` methods (WMI operations)
  - `IWbemServices::PutInstance` for WMI permanent event subscription creation
  - `ldap_search` <applies-to>Elastic Stack: Generally available since 9.2</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `MapViewOfFile`
  - `MapViewOfFile2`
  - `NtCreateProcess` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `NtCreateProcessEx` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `NtCreateUserProcess` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `NtFsControlFile` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `NtQueueApcThread`
  - `NtSetInformationThread` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `NtSuspendProcess`
  - `OpenProcess`
  - `OpenThread`
  - `QueueUserAPC`
  - `ReadProcessMemory`
  - `RegisterRawInputDevices`
  - `SetThreadContext`
  - `SetThreadToken` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `SetWindowsHookEx`
  - `SuspendThread`
  - `TpAllocWork` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `TpCallbackStart` <applies-to>Elastic Stack: Planned</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `VirtualAlloc`
  - `VirtualAllocEx`
  - `VirtualProtect`
  - `VirtualProtectEx`
  - `WinHttpOpenRequest` <applies-to>Elastic Stack: Generally available since 9.3</applies-to> <applies-to>Elastic Cloud Serverless: Generally available</applies-to>
  - `Wow64SetThreadContext`
  - `WriteProcessMemory`
</dropdown>

For some API events, `process.Ext.api.name` might contain the API that called the monitored API, rather than the monitored API itself.

## Kernel driver registration, deletion, and queries

Elastic Defend scans every driver as it is loaded, but it doesn’t generate an event each time.
Drivers are registered in the system as system services. You can capture this with Windows event ID 4697 using the [Custom Windows Event Logs](https://docs.elastic.co/en/integrations/winlog) integration.
Also consider capturing Windows event ID 6 using Winlogbeat's [Sysmon module](https://docs-v3-preview.elastic.dev/elastic/beats/tree/main/reference/winlogbeat/winlogbeat-module-sysmon).

## System configuration file creation, modification, and deletion

Elastic Defend tracks creation, modification, and deletion of all files on the system. However, as mentioned above, the data might be aggregated, truncated, or deduplicated to provide only what’s required for threat detection and prevention.