Overview

Home About this project and why it exists

Reference

Windows Event Log Reference 99 events across 5 log sources NIST SP 800-53 Mapping 34 controls to event-code evidence MITRE ATT&CK Coverage 30 techniques, tactic gap analysis MITRE ATLAS Coverage AI/ML threat map, 6 techniques + honest gaps CIS Controls Coverage Controls 5 & 8, 6 safeguards + honest gaps PCI DSS Requirement 10 Log & monitor access, 7 sub-reqs + honest gaps DISA STIG Coverage Windows Server 2022 V2R4, 4 rules + honest gaps

Tools

Gravity Scanner Live policy, gap analyzer, dependency map 7 views

Blog

Blog Notes on logging, cost, and detection tradeoffs

NIST SP 800-53 Rev 5

Control-to-Event-Code Mapping

The Windows event codes that give an auditor direct evidence for each control below.

Scope: Only controls a log file can actually prove — policy, personnel, and process controls need their own documentation.

Version: Based on the Rev 5 baseline (1,189 controls). The 3 controls added in Release 5.2.0 (Aug 2025) are software-development-lifecycle controls, not something a runtime log can evidence, so they're excluded here.