Config Changes
A change row records one durable change to one object on one device. Three fields carry it: sparklogs.config_change.type is the kind of object that changed, sparklogs.config_change.action is what was done to it, and sparklogs.config_change.target is which object it was.
Over a window you get one row per changed object per device, with the repeats counted rather than listed.
sparklogs.target.* is the security principal a change acted on. It is there only when the event carried one, and it is never filled in from whoever made the change.
service is the subsystem an event belongs to, as the sender named it or as the feed assigned it. It is not a Windows service: a change to a Windows service carries windows_service in sparklogs.config_change.type.
| Object | What it is | Identity | Actions | Sources |
|---|---|---|---|---|
| Account | A user or computer account in the directory or on the local host. | a name, or a fixed name where a host carries only one | created, deleted, disabled, enabled, updated | 1 |
| Audit policy subcategory | One subcategory of the Windows audit policy, which decides what the Security log records. | a GUID | updated | 1 |
| Endpoint protection setting | One setting of the endpoint protection product on the host. | a name | updated | 1 |
| Endpoint protection component | One protection component of the endpoint protection product, such as real-time scanning. | a name | disabled, enabled | 1 |
| Directory object | A directory object that is neither an account nor a group, such as an organizational unit or a policy container. | a directory distinguished name | created, deleted, updated | 1 |
| Domain policy | The password and lockout policy of one domain. | a name | updated | 1 |
| Firewall rule | One rule in the Windows Firewall, which decides what traffic the host accepts. | a name | created, deleted, disabled, enabled, updated | 1 |
| Security group | A security group, both the group itself and who belongs to it. | a name | created, deleted, member_added, member_removed, updated | 1 |
| Logon right | A right that decides how an account may sign in, such as locally at the keyboard or as a service. | a name | created, deleted | 1 |
| Registry value | A value in the Windows registry that auditing is turned on for. | a name | created, deleted, updated | 1 |
| Scheduled task | A job Task Scheduler runs on a trigger or a clock. | a name | created, deleted, disabled, updated | 1 |
| Network share | A folder the host publishes on the network over SMB. | a name | created | 1 |
| System clock | The clock of the host the event came from. | a fixed name where a host carries only one | updated | 1 |
| Windows service | A background program the Service Control Manager starts and stops on the host. | a name | installed | 2 |
Also reported as inventory changes
An inventory topic reports what the host looks like, so its news is the difference between two reports rather than an audited event. Those deltas carry none of the sparklogs.config_change.* fields above and are read on the topic's own page.
| Topic | What it reports changing |
|---|---|
| Device drivers | driver updated, driver added, driver removed |
| Installed products | product installed, product removed, product version changed |
| System information | reboot pending, Secure Boot state changed, TPM state changed, host roles changed, OS build changed |