> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/08-wazuh-security-monitoring-basics/verify-windows-events.md).

# Verify Windows Events in Wazuh

Now that `CLIENT01` is enrolled, verify that Windows security activity can be observed centrally.

## Objective

Generate a small, known Windows event on `CLIENT01`, then locate the related activity in Wazuh.

## Generate Known Activity

Use a simple action that you already understand from the Windows Security Basics section.

For example:

1. lock `CLIENT01`
2. attempt one deliberate sign-in with an incorrect password
3. sign in normally with the correct password

Keep the test small. One controlled failure is enough.

## Note the Time

Record the approximate time when the activity occurred.

This makes it much easier to search the Wazuh data later.

Example:

```
Test host: CLIENT01
Test activity: One failed sign-in followed by a successful sign-in
Approximate time: Record actual lab time
```

## Review the Local Event First

On `CLIENT01`, open Event Viewer and confirm that the expected Windows security event exists locally.

For a failed logon, look for Event ID `4625` where the current audit configuration records it.

The local log is your reference point. It proves that the source system generated the activity before you troubleshoot Wazuh ingestion.

## Find the Activity in Wazuh

Open the Wazuh dashboard and search the relevant security event or alert data for:

* agent name `CLIENT01`
* the approximate test time
* the relevant Windows event ID when available

The exact search interface depends on the Wazuh release.

## Compare Local and Central Evidence

Compare the local Windows event with the Wazuh record.

Look for fields such as:

* host or agent name
* event ID
* username
* timestamp
* source information
* alert rule or description if Wazuh generated an alert

## Important Distinction

The source event and the Wazuh alert are not the same thing.

A Windows event records what Windows observed. Wazuh may then evaluate that event against its rules and create an alert when the conditions match.

Understanding this distinction prevents the monitoring platform from becoming a black box.

## Verification

The lab is complete when:

* the expected event exists on `CLIENT01`
* related data can be found in Wazuh
* the host and time match the test
* you can explain the difference between the original Windows event and a Wazuh alert

## Security Relevance

Centralized monitoring should be validated against the original data source. When an alert is important, analysts often need to understand both the detection and the underlying event that triggered it.