What useful security reports can be extracted from a Windows-based machine and its' related logs?

Question

What logs and event IDs should I be paying attention to when looking at a Windows-based machine (workstation, server, Domain Controller)?

Assuming I can aggregate them into a report what information should I include in Standard Operating Procedures (SOP) reviews?

Answer 1

For log analysis OSSEC has a few files with MS specific rules designed to extract interesting security events. To see individual rules one can peruse these files:

[/var/ossec/rules]# ls -l ms*
-r-xr-x--- 1 root ossec 31423 Sep 7 2010 msauth_rules.xml
-r-xr-x--- 1 root ossec 11978 Sep 7 2010 ms_dhcp_rules.xml
-r-xr-x--- 1 root ossec 1547 Sep 7 2010 ms-exchange_rules.xml
-r-xr-x--- 1 root ossec 2077 Sep 7 2010 ms_ftpd_rules.xml
-r-xr-x--- 1 root ossec 2190 Sep 7 2010 ms-se_rules.xml

For the latest copy of these rules files you can head over to bitbucket -> https://bitbucket.org/dcid/ossec-hids