What is an event ID?¶

An event ID may identify a category of activity or one particular recorded occurrence. Its scope and uniqueness must be established before using it to search or correlate.

The same label can describe different identifier types¶

An operating system may assign one code to every event of a type, while another product gives each row a unique value. Some use both event-type and record IDs. Values may be unique only within a log, endpoint or tenant and can reset after rollover or restart.

Preserve surrounding identifier context¶

Obtain field definition and record source, sequence number and related IDs. Do not join records across systems merely because event IDs match unless documentation defines that relationship.

In reports, state whether a number names the event type or the exact event instance so another examiner can reproduce the reference.