logparse

事件 ID（Event ID）
Event ID(2000/XP/2003)    Event ID(Vista/7/8/2008/2012)    描述
528     4624    成功登录
529     4625    失败登录
680     4776    成功/失败的账户认证
624     4720    创建用户
636     4732    添加用户到启用安全性的本地组中
632     4728    添加用户到启用安全性的全局组中
2934    7030    服务创建错误
2944    7040    IPSEC服务服务的启动类型已从禁用更改为自动启动
2949    7045    服务创建

事件类型(EventType)
登录类型    登录类型    描述
2     Interactive                用户登录到本机
3     Network                    用户或计算手机从网络登录到本机，如果网络共享，或使用 net use 访问网络共享，net view 查看网络共享
4     Batch                      批处理登录类型，无需用户干预
5     Service                    服务控制管理器登录
7     Unlock                     用户解锁主机
8     NetworkCleartext           用户从网络登录到此计算机，用户密码用非哈希的形式传递
9     NewCredentials             进程或线程克隆了其当前令牌，但为出站连接指定了新凭据
10    Remotelnteractive          使用终端服务或远程桌面连接登录
11    Cachedlnteractive          用户使用本地存储在计算机上的凭据登录到计算机（域控制器可能无法验证凭据），如主机不能连接域控，以前使用域账户登录过这台主机，再登录就会产生这样日志
12    CachedRemotelnteractive    与 Remotelnteractive 相同，内部用于审计目的
13    CachedUnlock               登录尝试解锁

LogParser.exe -i:EVT -o:DATAGRID "SELECT TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,'|') as username,EXTRACT_TOKEN(Strings, 8, '|') as LogonType,EXTRACT_TOKEN(Strings, 17, '|') AS ProcessName,EXTRACT_TOKEN(Strings, 18, '|') AS SourceIP , EXTRACT_TOKEN(Strings, 19, '|') AS SourcePort ,EXTRACT_TOKEN(Strings, 11, '|') AS WorkstationName  FROM Security.evtx where EventID=4624 AND TO_DATE(TimeGenerated) between timestamp('2018-07-12', 'yyyy-MM-dd') and timestamp('2038-10-27', 'yyyy-MM-dd')" -rtp:-1

LogParser.exe -i:EVT -o:DATAGRID "SELECT TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,'|') as username,EXTRACT_TOKEN(Strings, 8, '|') as LogonType,EXTRACT_TOKEN(Strings, 17, '|') AS ProcessName,EXTRACT_TOKEN(Strings, 18, '|') AS SourceIP FROM Security.evtx where EventID=4624 AND TO_DATE(TimeGenerated) between timestamp('2018-10-17', 'yyyy-MM-dd') and timestamp('2018-10-27', 'yyyy-MM-dd')" -rtp:-1 

LogParser.exe -i:EVT -o:DATAGRID "SELECT TimeGenerated as LoginTime,EXTRACT_TOKEN(Strings,5,'|') as username,EXTRACT_TOKEN(Strings, 10, '|') as LogonType,EXTRACT_TOKEN(Strings, 11, '|') AS ProcessName,EXTRACT_TOKEN(Strings, 13, '|') AS Workstation,EXTRACT_TOKEN(Strings, 19, '|') AS SourceIP FROM Security.evtx where EventID=4625" -rtp:-1

LogParser.exe -i:EVT -o:DATAGRID "SELECT TimeWritten,EventID,EventType,EventTypeName,SourceName,EXTRACT_TOKEN(Strings,0,'|') as service_name,EXTRACT_TOKEN(Strings,1,'|') as service_path,Message from system.evtx where TO_DATE(TimeGenerated) between timestamp('2018-10-19', 'yyyy-MM-dd') and timestamp('2018-10-20', 'yyyy-MM-dd')" -rtp:-1"

LogParser.exe -i:EVT -o:DATAGRID "SELECT * from Application.evtx where TO_DATE(TimeGenerated) between timestamp('2018-10-17', 'yyyy-MM-dd') and timestamp('2018-10-27', 'yyyy-MM-dd')" -rtp:-1"