Windows Security Events

ID	Event Description
4616	The system time was changed Audit Success
4624	An account was successfully logged on CJIS, Audit Success, ISO 27001:2013, HIPAA, NIST SP 800-53, CMMC L1, NIST 800-171, PCI-DSS
4625	An account failed to log on Audit Failure, CJIS, ISO 27001:2013, PCI-DSS, HIPAA, NIST SP 800-53, NIST 800-171, CMMC L1
4648	A logon was attempted using explicit credentials Audit Success
4649	A replay attack was detected Domain Controller, Audit Success, Audit Failure, PCI-DSS, HIPAA, CJIS, ISO 27001:2013
4656	A handle to an object was requested Audit Failure, Audit Success, CJIS
4657	A registry value was modified Audit Success
4658	The handle to an object was closed Audit Success
4660	An object was deleted Audit Success
4661	A handle to an object was requested Domain Controller, Audit Success, Audit Failure
4663	An attempt was made to access an object Audit Success, CJIS
4670	Permissions on an object were changed Audit Success
4673	A privileged service was called Audit Success, CMMC L2, NIST800-171, NIST800-53
4674	An operation was attempted on a privileged object Audit Failure, Audit Success, CMMC L2, NIST800-171, NIST800-53
4689	A process has exited Audit Success
4703	A token right was adjusted Audit Success, CMMC L2, NIST800-171, NIST800-53
4904	An attempt was made to register a security event source Audit Success
4905	An attempt was made to unregister a security event source Audit Success
4985	The state of a transaction has changed Audit Success