# Windows Event IDs

Read a raw Security or Sysmon entry, and pull out the fields triage actually turns on.

Canonical: https://www.cyberkit.win/drills/event-ids/

This runs in the browser. Nothing you enter is uploaded.