# Analysis logs for security events **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 1, 2016, 4:59pm UTC](https://discuss.elastic.co/t/analysis-logs-for-security-events/48893 "2016-05-01T16:59:02Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [May 2, 2016, 2:11pm UTC](https://discuss.elastic.co/t/analysis-logs-for-security-events/48893/2 "2016-05-02T14:11:23Z")
I recommend following our [Getting Started guide](https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-getting-started.html) and using [Winlogbeat 5.0.0-alpha1](https://download.elastic.co/beats/winlogbeat/winlogbeat-5.0.0-alpha1-windows-64.zip) because it has some new features over 1.X that are very useful. When you install Winlogbeat with the default config, it will ship all events from the Security log to Elasticsearch. You can then build some custom searches and dashboards in Kibana to visualize the specific event IDs for logon events. Some of the more important event IDs are: - Account Lockouts - 4740 - User Added to Privileged Group - 4728, 4732, 4756 - Security-Enabled group Modification - 4735 - Successful User Account Login - 4624 - Failed User Account Login - 4625 - Account Login with Explicit Credentials - 4648 Remote desktop logins can be searched by looking within the login events for an `event_data.LoginType: 10` where 10 is the [login type](http://windowsitpro.com/systems-management/q-what-are-different-windows-logon-types-can-show-windows-event-log) for remote interactive logons. Visualization/Query example: [Reporting Windows Security Events in Kibana](https://discuss.elastic.co/t/reporting-windows-security-events-in-kibana/44748) --- _[View the full topic](https://discuss.elastic.co/t/analysis-logs-for-security-events/48893)._