win:security 1102
The audit log was cleared.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- Tier, host type
- Minimum
- Techniques
- 3
- Rules depending on it
- Splunk 1, Sigma 1, Microsoft Sentinel 2
Why this tier
Microsoft Appendix L High; NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | Microsoft Appendix L High; NSA |
| Windows member server | Minimum | Microsoft Appendix L High; NSA |
| Windows domain controller | Minimum | Microsoft Appendix L High; NSA |
| Windows web server (IIS), internet-facing | Minimum | Microsoft Appendix L High; NSA |
Techniques it helps detect
Rules that depend on it
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Clearing Event Logs: Event Log was Cleared |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Medium to High: The audit log was cleared. |