> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/windows-event-collector.md).

# Windows Event Collector

Alerts related to data source "Windows Event Collector".

| Alert                                                                                                                                                                                                |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [A computer account was promoted to DC](/analytics-alerts/alerts-by-name/a-computer-account-was-promoted-to-dc.md)                                                                                   |
| [A machine certificate was issued with a mismatch](/analytics-alerts/alerts-by-name/a-machine-certificate-was-issued-with-a-mismatch.md)                                                             |
| [A new machine attempted Kerberos delegation](/analytics-alerts/alerts-by-name/a-new-machine-attempted-kerberos-delegation.md)                                                                       |
| [A user account was modified to password never expires](/analytics-alerts/alerts-by-name/a-user-account-was-modified-to-password-never-expires.md)                                                   |
| [A user certificate was issued with a mismatch](/analytics-alerts/alerts-by-name/a-user-certificate-was-issued-with-a-mismatch.md)                                                                   |
| [A user changed the Windows system time](/analytics-alerts/alerts-by-name/a-user-changed-the-windows-system-time.md)                                                                                 |
| [A user enabled a default local account](/analytics-alerts/alerts-by-name/a-user-enabled-a-default-local-account.md)                                                                                 |
| [A user modified the CA audit policy](/analytics-alerts/alerts-by-name/a-user-modified-the-ca-audit-policy.md)                                                                                       |
| [A user printed an unusual number of files](/analytics-alerts/alerts-by-name/a-user-printed-an-unusual-number-of-files.md)                                                                           |
| [A user received multiple weakly encrypted service tickets](/analytics-alerts/alerts-by-name/a-user-received-multiple-weakly-encrypted-service-tickets.md)                                           |
| [A user requested multiple service tickets](/analytics-alerts/alerts-by-name/a-user-requested-multiple-service-tickets.md)                                                                           |
| [A user sent multiple TGT requests to irregular service](/analytics-alerts/alerts-by-name/a-user-sent-multiple-tgt-requests-to-irregular-service.md)                                                 |
| [A user was added to a Windows security group](/analytics-alerts/alerts-by-name/a-user-was-added-to-a-windows-security-group.md)                                                                     |
| [ADFS DKM Key Access](/analytics-alerts/alerts-by-name/adfs-dkm-key-access.md)                                                                                                                       |
| [Administrator groups enumerated via LDAP](/analytics-alerts/alerts-by-name/administrator-groups-enumerated-via-ldap.md)                                                                             |
| [Deletion of AD CS certificate database entries](/analytics-alerts/alerts-by-name/deletion-of-ad-cs-certificate-database-entries.md)                                                                 |
| [Excessive user account lockouts](/analytics-alerts/alerts-by-name/excessive-user-account-lockouts.md)                                                                                               |
| [Key credential attribute modification](/analytics-alerts/alerts-by-name/key-credential-attribute-modification.md)                                                                                   |
| [Local group enumeration](/analytics-alerts/alerts-by-name/local-group-enumeration.md)                                                                                                               |
| [Local user account creation](/analytics-alerts/alerts-by-name/local-user-account-creation.md)                                                                                                       |
| [Local user account creation by a machine account](/analytics-alerts/alerts-by-name/local-user-account-creation-by-a-machine-account.md)                                                             |
| [Machine account was added to a domain admins group](/analytics-alerts/alerts-by-name/machine-account-was-added-to-a-domain-admins-group.md)                                                         |
| [Mailbox Client Access Setting (CAS) changed](/analytics-alerts/alerts-by-name/mailbox-client-access-setting-cas-changed.md)                                                                         |
| [Masquerading as a default local account](/analytics-alerts/alerts-by-name/masquerading-as-a-default-local-account.md)                                                                               |
| [Member added to a Windows local security group](/analytics-alerts/alerts-by-name/member-added-to-a-windows-local-security-group.md)                                                                 |
| [Multiple suspicious user accounts were created](/analytics-alerts/alerts-by-name/multiple-suspicious-user-accounts-were-created.md)                                                                 |
| [Multiple TGT requests for users without Kerberos pre-authentication](/analytics-alerts/alerts-by-name/multiple-tgt-requests-for-users-without-kerberos-pre-authentication.md)                       |
| [Multiple user accounts were deleted](/analytics-alerts/alerts-by-name/multiple-user-accounts-were-deleted.md)                                                                                       |
| [PKINIT TGT authentication request](/analytics-alerts/alerts-by-name/pkinit-tgt-authentication-request.md)                                                                                           |
| [Possible Kerberos relay attack](/analytics-alerts/alerts-by-name/possible-kerberos-relay-attack.md)                                                                                                 |
| [Possible Privilege Escalation using Delegated MSA account](/analytics-alerts/alerts-by-name/possible-privilege-escalation-using-delegated-msa-account.md)                                           |
| [Potential DCSync by an unusual user](/analytics-alerts/alerts-by-name/potential-dcsync-by-an-unusual-user.md)                                                                                       |
| [PowerShell used to export mailbox contents](/analytics-alerts/alerts-by-name/powershell-used-to-export-mailbox-contents.md)                                                                         |
| [PowerShell used to remove mailbox export request logs](/analytics-alerts/alerts-by-name/powershell-used-to-remove-mailbox-export-request-logs.md)                                                   |
| [Privileged certificate request via certificate template](/analytics-alerts/alerts-by-name/privileged-certificate-request-via-certificate-template.md)                                               |
| [Rare machine account creation](/analytics-alerts/alerts-by-name/rare-machine-account-creation.md)                                                                                                   |
| [Sensitive account password reset attempt](/analytics-alerts/alerts-by-name/sensitive-account-password-reset-attempt.md)                                                                             |
| [Service ticket request with a spoofed sAMAccountName](/analytics-alerts/alerts-by-name/service-ticket-request-with-a-spoofed-samaccountname.md)                                                     |
| [Short-lived user account](/analytics-alerts/alerts-by-name/short-lived-user-account.md)                                                                                                             |
| [Single account excessively locked out](/analytics-alerts/alerts-by-name/single-account-excessively-locked-out.md)                                                                                   |
| [SPNs cleared from a machine account](/analytics-alerts/alerts-by-name/spns-cleared-from-a-machine-account.md)                                                                                       |
| [Suspicious access of the System Management Container](/analytics-alerts/alerts-by-name/suspicious-access-of-the-system-management-container.md)                                                     |
| [Suspicious account attribute modification that matches that of another account](/analytics-alerts/alerts-by-name/suspicious-account-attribute-modification-that-matches-that-of-another-account.md) |
| [Suspicious certificate template modification](/analytics-alerts/alerts-by-name/suspicious-certificate-template-modification.md)                                                                     |
| [Suspicious dNSHostName attribute change to DC name](/analytics-alerts/alerts-by-name/suspicious-dnshostname-attribute-change-to-dc-name.md)                                                         |
| [Suspicious domain user account creation](/analytics-alerts/alerts-by-name/suspicious-domain-user-account-creation.md)                                                                               |
| [Suspicious hidden user created](/analytics-alerts/alerts-by-name/suspicious-hidden-user-created.md)                                                                                                 |
| [Suspicious modification of the AdminSDHolder's ACL](/analytics-alerts/alerts-by-name/suspicious-modification-of-the-adminsdholder-s-acl.md)                                                         |
| [Suspicious sAMAccountName change](/analytics-alerts/alerts-by-name/suspicious-samaccountname-change.md)                                                                                             |
| [TGT request with a spoofed sAMAccountName - Event log](/analytics-alerts/alerts-by-name/tgt-request-with-a-spoofed-samaccountname-event-log.md)                                                     |
| [Unusual user account enablement](/analytics-alerts/alerts-by-name/unusual-user-account-enablement.md)                                                                                               |
| [Unusual user account unlock](/analytics-alerts/alerts-by-name/unusual-user-account-unlock.md)                                                                                                       |
| [User account delegation change](/analytics-alerts/alerts-by-name/user-account-delegation-change.md)                                                                                                 |
| [User added SID History to an account](/analytics-alerts/alerts-by-name/user-added-sid-history-to-an-account.md)                                                                                     |
| [User added to a group and removed](/analytics-alerts/alerts-by-name/user-added-to-a-group-and-removed.md)                                                                                           |
| [User added to the SMS Admins local group](/analytics-alerts/alerts-by-name/user-added-to-the-sms-admins-local-group.md)                                                                             |
| [Vulnerable certificate template loaded](/analytics-alerts/alerts-by-name/vulnerable-certificate-template-loaded.md)                                                                                 |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/windows-event-collector.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.