Docs say where the data comes from. The Event ID cheat sheet says which number to ask. A number without channel and audit policy means nothing.
Lab channels
- Security — logon, process, account (4624 / 4625 / 4688 if enabled)
- System — services, including 7045 (new service)
- Application — only when the app logs at all
- PowerShell — 4103 / 4104 only if script audit is on
- Microsoft-Windows-Windows Defender/Operational — if Defender is in play
Quick channel check: Event Viewer → the right log, or wevtutil qe Security /c:5 /rd:true /f:text. An empty Security log after an “attack” usually means audit is not writing, not “the SIEM lost the event”.
Learning order
authentication → process creation → privilege use → account change → service install → PowerShell
Turn on 4688 with command line on purpose: that is telemetry, not default Windows Home. Sysmon is optional, not a day-one requirement — Security that actually exists comes first.
Correlation
A lone 4624 is not an incident. It is a logon of a given type, on a given host, at a given time. The same fact goes to the SIEM (Wazuh); the Event Log article uses:
event → context → correlation → hypothesis → check
Without NTP / a shared zone with Linux, the L1 timeline lies.