Windows Events
A Kerberos authentication ticket (TGT) was requested
Event ID 4768
Security
Audit Kerberos Authentication Service
Main fields
IP address
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
User name
TargetUserName
Windows
Account Information: Account Name
ELK
winlog.event_data.TargetUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Important field
IpAddress
Windows
Network Information: Source Network Address
ELK
winlog.event_data.IpAddress
Microsoft Sentinel
-
QRadar
-
Splunk
-
Fields
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| TargetUserName | Account Information: Account Name | winlog.event_data.TargetUserName | - | - | - |
| TargetDomainName | Account Information: Account Domain | winlog.event_data.TargetDomainName | - | - | - |
| TargetSid | Account Information: User ID | winlog.event_data.TargetSid | - | - | - |
| ServiceName | Service Information: Service Name | winlog.event_data.ServiceName | - | - | - |
| ServiceSid | Service Information: Service ID | winlog.event_data.ServiceSid | - | - | - |
| TicketOptions | Additional Information: Ticket Options | winlog.event_data.TicketOptions | - | - | - |
| Status | Additional Information: Failure Code | winlog.event_data.Status | - | - | - |
| TicketEncryptionType | Additional Information: Ticket Encryption Type | winlog.event_data.TicketEncryptionType | - | - | - |
| PreAuthType | Additional Information: Pre-Authentication Type | winlog.event_data.PreAuthType | - | - | - |
| IpAddress | Network Information: Source Network Address | winlog.event_data.IpAddress | - | - | - |
| IpPort | Network Information: Client Port | winlog.event_data.IpPort | - | - | - |
| CertIssuerName | Certificate Information: Certificate Issuer Name | winlog.event_data.CertIssuerName | - | - | - |
| CertSerialNumber | Certificate Information: Certificate Serial Number | winlog.event_data.CertSerialNumber | - | - | - |
| CertThumbprint | Certificate Information: Certificate Thumbprint | winlog.event_data.CertThumbprint | - | - | - |
| ResponseTicket | Ticket information: Response ticket hash | winlog.event_data.ResponseTicket | - | - | - |
| IP System field | IP System field | - | - | - | - |
| Computer System field | Computer System field | winlog.computer_name | - | - | - |
| ProcessID System field | ProcessID System field | winlog.process.pid | - | - | - |
| ThreadID System field | ThreadID System field | winlog.process.thread.id | - | - | - |
Sample Event
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4768</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>14339</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-09T14:48:43.1320758Z" />
<EventRecordID>312254</EventRecordID>
<Correlation />
<Execution ProcessID="852" ThreadID="3128" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetUserName">DemoAdmin1</Data>
<Data Name="TargetDomainName">socpedia.net</Data>
<Data Name="TargetSid">S-1-5-21-1838030176-2987033226-1986555923-1124</Data>
<Data Name="ServiceName">krbtgt</Data>
<Data Name="ServiceSid">S-1-5-21-1838030176-2987033226-1986555923-502</Data>
<Data Name="TicketOptions">0x40800010</Data>
<Data Name="Status">0x0</Data>
<Data Name="TicketEncryptionType">0x12</Data>
<Data Name="PreAuthType">2</Data>
<Data Name="IpAddress">::ffff:192.168.0.238</Data>
<Data Name="IpPort">54980</Data>
<Data Name="CertIssuerName" />
<Data Name="CertSerialNumber" />
<Data Name="CertThumbprint" />
<Data Name="ResponseTicket">EvTiBvCmEbcpJNhJL4PTcmBK3JNerccRM/ikDKibhEI=</Data>
</EventData>
</Event>