Internal Resources Allocated For The Queuing Of Audit Messages Have Been Exhausted, Leading To The Loss Of Some Audits

Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.

Configuration

query

EventID:4612 OR EventID:516

config

Key | Value — | — type | aggregation-v1 query | EventID:4612 OR EventID:516 streams | [5f74fe0891d2ba1b645adb8d] conditions | {expression:null} search_within_ms | 3600000 execute_every_ms | 3600000

SIEM Microsoft Events to Monitor
notes
SIEM Microsoft Events to Monitor
notes

Last modified December 31, 1969