Research

Mini-guide: pivoting on the logon ID, or how one number turns a log into a session

The Security log records events. An investigation needs sessions. The logon ID is the join between them: how to follow one from the logon through every process it started to the logoff, and the three places the thread breaks.