System32
Sysmon
Events
Compliance
Validator
TLS/SSL
GeoIP
Tools
Windows Security Events
Audit Category
Logon/Logoff
(4)
Operating Systems
Windows 10
(4)
Windows 2008
(4)
Windows 2008 R2
(4)
Windows 2012
(4)
Windows 2012 R2
(4)
Windows 2016
(4)
Windows 2019
(4)
Windows 2022
(4)
Windows 7
(4)
Windows 8
(4)
Windows 8.1
(4)
Windows Vista
(4)
Windows 11
(3)
Tags
Audit Failure
(1)
Auditing
Volume
Audit Subcategory
IPsec Quick Mode
(4)
AppLocker
All AppLocker events
EventSentry
All EventSentry events
Security
All Windows Security events
Sysmon
All Sysmon events
ID
Event Description
4654
An IPsec quick mode negotiation failed
Audit Failure
4977
During quick mode negotiation, IPsec received an invalid negotiation packet
5451
An IPsec quick mode security association was established.
5452
An IPsec quick mode security association ended.