Elastic Windows Event Explorer


Publisher - Microsoft-Windows-User Device Registration

Event ID 363

Message:

The Microsoft Passport key is missing. 
Key ID: %{KeyId} 
Attestation level: %{AttLevel} 
AIK status: %{AikStatus} 
Key type: %{KeyType} 
Key name: %{KeyName} 
IDP domain: %{IdpDomain} 
Tenant ID: %{TenantId} 
User email: %{UserEmail}

Event Data:

# Name In Type
Out Type
1 KeyId win:GUID xs:GUID
2 AttLevel win:UInt64 xs:unsignedLong
3 AikStatus win:UInt64 xs:unsignedLong
4 KeyType win:UInt64 xs:unsignedLong
5 KeyName win:UnicodeString xs:string
6 IdpDomain win:UnicodeString xs:string
7 TenantId win:UnicodeString xs:string
8 UserEmail win:UnicodeString xs:string

Observed Windows Versions:

Version: 0

Fingerprint: 6G3CFWAKNN2WM