DFIRHub

Windows event log ยท OAlerts300 OAlerts 300 event

Appears to log same data as Office 16. If an actual event is located for this event, please replace the one below and remove this comment

  • Third party
  • 6 fields
  • OAlerts.evtx
  • Microsoft Office 14 AlertsMicrosoft Office 15 AlertsMicrosoft Office 16 Alerts

OAlerts 300 event

Provider Microsoft Office 14 Alerts

  • PayloadData1Program: %PayloadData1%
    • %PayloadData1% = /Event/EventData/Data
  • PayloadData2Alert: %PayloadData2%
    • %PayloadData2% = /Event/EventData/Data

OAlerts 300 event

Provider Microsoft Office 15 Alerts

  • PayloadData1Program: %PayloadData1%
    • %PayloadData1% = /Event/EventData/Data
  • PayloadData2Alert: %PayloadData2%
    • %PayloadData2% = /Event/EventData/Data

OAlerts 300 event

Provider Microsoft Office 16 Alerts

  • PayloadData1Program: %PayloadData1%
    • %PayloadData1% = /Event/EventData/Data
  • PayloadData2Alert: %PayloadData2%
    • %PayloadData2% = /Event/EventData/Data

Sample event

Microsoft Office 14 Alerts event XML

<Event>
  <System>
    <Provider Name="Microsoft Office 16 Alerts"/>
    <EventID Qualifiers="0">300</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-27 13:58:42.5609578"/>
    <EventRecordID>7</EventRecordID>
    <Channel>OAlerts</Channel>
    <Computer>FOR-LT03</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>Microsoft Excel
, Wilt u de wijzigingen in full_application_event_log.csv opslaan?
, 100216
, 16.0.4822.1000
,
,</Data>
    <Binary></Binary>
  </EventData>
</Event>

Sample event

Microsoft Office 15 Alerts event XML

<Event>
  <System>
    <Provider Name="Microsoft Office 16 Alerts"/>
    <EventID Qualifiers="0">300</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-27 13:58:42.5609578"/>
    <EventRecordID>7</EventRecordID>
    <Channel>OAlerts</Channel>
    <Computer>FOR-LT03</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>Microsoft Excel
, Wilt u de wijzigingen in full_application_event_log.csv opslaan?
, 100216
, 16.0.4822.1000
,
,</Data>
    <Binary></Binary>
  </EventData>
</Event>

Sample event

Microsoft Office 16 Alerts event XML

<Event>
  <System>
    <Provider Name="Microsoft Office 16 Alerts"/>
    <EventID Qualifiers="0">300</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-27 13:58:42.5609578"/>
    <EventRecordID>7</EventRecordID>
    <Channel>OAlerts</Channel>
    <Computer>FOR-LT03</Computer>
    <Security/>
  </System>
  <EventData>
    <Data>Microsoft Excel
, Wilt u de wijzigingen in full_application_event_log.csv opslaan?
, 100216
, 16.0.4822.1000
,
,</Data>
    <Binary></Binary>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/OAlerts_Microsoft-Office-14-Alerts_300.map(opens in new tab), evtx/Maps/OAlerts_Microsoft-Office-15-Alerts_300.map(opens in new tab), evtx/Maps/OAlerts_Microsoft-Office-16-Alerts_300.map(opens in new tab) by Lennaert Oudshoorn @lennaert89 and contributors(opens in new tab), MIT License(opens in new tab)