> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/event-viewer-basics.md).

# Event Viewer Basics

## Objective

Learn how to open Windows Event Viewer, navigate the main logs, and inspect an individual event.

## What You Will Learn

* where Windows stores common event logs
* how to filter events
* how to read event details
* the difference between a log source, event ID, level, time, and computer

## Lab System

Use `CLIENT01` for this exercise.

## Steps

### 1. Open Event Viewer

On `CLIENT01`:

1. Open **Start**.
2. Search for **Event Viewer**.
3. Open the application.

### 2. Explore Windows Logs

Expand:

```
Event Viewer
└── Windows Logs
```

You should see logs such as:

* Application
* Security
* Setup
* System
* Forwarded Events

### 3. Open the System Log

Select **System**.

Click a recent event and review:

* Level
* Date and Time
* Source
* Event ID
* Task Category
* Computer

### 4. Use Filter Current Log

In the right-side Actions pane, select **Filter Current Log**.

Try filtering by:

* Critical
* Error
* Warning

Clear the filter after reviewing the results.

### 5. Review Event Details

Open any normal event and compare the two tabs:

* **General** — easier human-readable summary
* **Details** — structured event data

## What Happened?

Windows continuously records operating-system, application, authentication, and security activity as events. Event Viewer provides a built-in interface for viewing these records.

## Security Relevance

Security investigations often begin with questions such as:

* Which user signed in?
* When did an event happen?
* Which computer generated it?
* Was the activity successful or unsuccessful?
* What process or service was involved?

Event Viewer provides the raw evidence used to answer many of these questions.

## Key Takeaways

* Windows maintains multiple event logs for different purposes.
* Event IDs help categorize activity, but the surrounding fields provide context.
* Filtering is useful when working with large logs.
* Security analysis requires understanding the event, not only memorizing its number.