Read a security event export

Start with a question

Which records describe failed logons? Import the supplied auth.csv and inspect its properties before filtering. This is a fictional, normalised export, not a live Windows event log. Each row preserves a RecordId and Computer so a finding can point back to its source.

Windows event 4625 describes a failed logon. It does not, by itself, prove an attack: expired credentials, a service configuration mistake, and an incorrect password can all need different follow-up. Event 4624 describes a successful logon. Keep the event type explicit in your filter.

Preserve useful context

Import-Csv produces objects whose property values are strings. Compare EventId with the string '4625', or deliberately convert it to an integer. Use TargetUser for the account attempting to log on; a real event's Subject fields can describe a different security context.

Import-Csv '/home/user/auth.csv' | Get-Member

Select properties after filtering. Avoid Format-Table in the exercise result: formatting produces display instructions instead of the original data objects. The lab checks object properties, so a pipeline and a loop can both be correct.

A source address of - means this export has no address for the event. Preserve it here; do not invent one. Later lessons will state when address-less rows should be excluded from a particular analysis.

Go deeper

Read the official reference.