JSA states that Windows events have identity properties, but not all Windows events contain information that can be used for Asset identity.

Windows events do not contain asset identity information.

When examining the " Logon Type " within the Windows event payload, the following values do not generate Asset information. Logon Type's 3, 4, 5, 7, 8, 9, and 10 will not generate Identity.

These Logon Types correlate to:

3: Network
4: Batch
5: Service
7: Unlock
8: Network clear text
9: New credentials based
10: Remote Interactive

To be considered for Identity, an event must have certain eventID and Computer= and OriginatingComputer= must be null.

Windows Event IDs 528, 540, 672, 4624, 4768, 4776, 18453, 18454, 18455, 20158 are considered for identity provided all preconditions are met: Meaning Computer= and OriginatingComputer= must be null and the Logon Type does not match 3, 4, 5, 7, 8, 9, and 10.