| Security | 5140 | Info | Network share accessed |
| Security | 5142 | Medium | Network share object added |
| Security | 5143 | High | Network share object modified |
| Security | 5144 | High | Network share deleted |
| Security | 4656 | Info | Handle to an object requested |
| Security | 4663 | High | File or folder accessed |
| Security | 4670 | High | Permissions on object changed |
| Security | 4697 | High | Service installed on system |
| Security | 5145 | Info | Detailed file share access |
| Microsoft-Windows-SMBServer/Security | 1006 | High | SMB authentication failure |
| Microsoft-Windows-SMBServer/Security | 1020 | Medium | Client disconnected unexpectedly |
| Security | 4719 | Critical | System audit policy changed |
| Security | 5140 | Medium | Network share accessed |
| Security | 5142 | High | Network share created |
| Security | 5143 | High | Network share deleted |
| Security | 560 | Medium | Object access attempted |
| System | 7036 | Info | Service started or stopped |
| DFS Replication | 1502 | Medium | Replication state changed |
| System | 2004 | High | Low disk space warning |
| System | 55 | Critical | File system corruption detected |
| System | 140 | Critical | NTFS metadata corruption |
| Microsoft-Windows-Storage-Storport/Operational | 246 | High | Disk error detected |
| Microsoft-Windows-Disk/Operational | 153 | Medium | IO operation retried |
| Microsoft-Windows-StorageSpaces-Driver/Operational | 312 | High | Storage pool degraded |
| Microsoft-Windows-StorageSpaces-Driver/Operational | 315 | Info | Virtual disk repair started |
| Microsoft-Windows-Ntfs/Operational | 98 | Info | Volume mounted successfully |
| System | 7036 | Info | File Server Resource Manager service status changed |
| Security | 4719 | Critical | Audit policy changed |
| Security | 4732 | High | User added to local group |
| Security | 4733 | Medium | User removed from local group |
| Security | 4735 | High | Group policy object modified |
| Microsoft-Windows-FSRM/Operational | 8215 | High | Quota threshold reached |
| Microsoft-Windows-FSRM/Operational | 8213 | High | File screen violation |
| Microsoft-Windows-FSRM/Operational | 12305 | Medium | FSRM service configuration changed |
| Security | 4657 | Medium | Registry value changed |
| Security | 4663 | High | Object access attempt (file/folder) |
| Security | 4670 | High | Permissions changed on file/folder |
| System | 55 | Critical | NTFS file system corruption detected |
| System | 57 | High | NTFS write failure |
| System | 50 | High | Delayed write failed |
| Security | 5140 | Medium | Network share accessed |
| Security | 5142 | Medium | Network share created |
| Security | 5143 | Medium | Network share deleted |
| DFS Replication | 13508 | High | DFS replication communication error |
| DFS Replication | 13509 | Medium | DFS replication recovered from error |
| DFS Replication | 2213 | Critical | DFS replication stopped due to dirty shutdown |
| DFS Replication | 5002 | Medium | DFS backlog threshold exceeded |
| DFS Replication | 5004 | Critical | DFS replication service not started |