Event IDs worth knowing Pro

The lookup done more often than any other, usually into a search engine because nothing good is open in a tab. Not exhaustive on purpose: a list of every Windows event ID is a list nobody reads.

the column that matters

Each entry carries what a bare description leaves out: what it does not tell you, and whether it is on by default. 5 of the 14 here are off until somebody turns them on, which means an empty result is frequently a configuration finding rather than an absence of activity.

Check what your estate actually records before concluding anything from a gap. That sentence has saved more investigations than any single event on this page.

ID	What it is	What it does not tell you
`4624`Security	Successful logonAn account authenticated. The Logon Type is the field that matters: 2 interactive at the keyboard, 3 network such as a share, 10 RemoteInteractive which is RDP.	It shows authentication, never who was at the keyboard. The source IP may itself be a pivot rather than the origin.
`4625`Security	Failed logonAuthentication failed, with a status code giving the reason: bad password, disabled account, outside logon hours.	Failures against one host from one source, across several accounts, is spraying. A burst against a single account is more often a stale service credential than an attack.
`4688`Securityoff by default	Process creationA process started, with its parent. With command-line auditing enabled it also carries the full command line, which turns this into the most valuable event in the log.	Command-line capture is a SEPARATE policy setting and is off by default. Without it you get names and no arguments, which is the difference between seeing powershell.exe and seeing what it ran.
`4104`PowerShell/Operationaloff by default	Script block loggingThe literal text of a PowerShell block, after deobfuscation. Base64 and compressed payloads appear decoded.	Off by default. An empty log is a configuration finding rather than an absence of activity, and a PowerShell 2.0 downgrade avoids it entirely.
`1102`Security	Audit log clearedSomebody cleared the Security log, and it records who.	One of the few events that is a finding on its own. It is also the last thing in the log, so treat the gap before it as the window of interest.

Turn these on

All free, all a policy change, and between them they cover most of what an investigation needs.

4688 with command line. Process creation without arguments is a name and nothing else.
4104. PowerShell script block logging, the highest-value log on a Windows estate.
TaskScheduler operational. Otherwise a scheduled task proves configuration, not execution.

Then raise the log size

The Security log defaults to 20MB, which on a domain controller can be under four hours. Enabling more events without raising the size buys you richer records that roll faster. Read it against your own detection time.

By what you are chasing

Authentication 4624, 4625, 4648, 4672, 1149
Execution 4688, 4104, 106 / 200 / 201
Lateral movement 4624, 4648, 7045, 5140 / 5145, 1149
Persistence 7045, 106 / 200 / 201, 4720 / 4732 / 4728, 4698
Evasion 4104, 1102, 104