Windows Mobile Device Activities

Wireless devices are ubiquitious and the need to record an enterprise’s wireless device activities may be critical. A wireless device could become compromised while traveling between different networks, regardless of the protocol used for communication (e.g., 802.11 or Bluetooth). Therefore, the tracking of which networks mobile devices are entering and exiting is useful to prevent further compromises. The creation frequency of the following events depend on how often the device disconnects and reconnects to a wireless network. Each event below provides mostly similar information with the exception that additional fields have been added to certain events.

Sections on this page

SIEM Events

Network Connection And Disconnection Status (Wired And Wireless)

Event Source - Microsoft-Windows-NetworkProfile - Event Log - Microsoft-Windows-NetworkProfile/Operational

Starting A Wireless Connection

Event Source - Microsoft-Windows-WLAN-AutoConfig - Event Log - Microsoft-Windows-WLAN-AutoConfig/Operational

Successfully Connected To A Wireless Connection

Event Source - Microsoft-Windows-WLAN-AutoConfig - Event Log - Microsoft-Windows-WLAN-AutoConfig/Operational

Disconnect From Wireless Connection

Event Source - Microsoft-Windows-WLAN-AutoConfig - Event Log - Microsoft-Windows-WLAN-AutoConfig/Operational

Wireless Association Status

Event Source - Microsoft-Windows-WLAN-AutoConfig - Event Log - Microsoft-Windows-WLAN-AutoConfig/Operational

Wireless Security Started, Stopped, Successful, Or Failed

Event Source - Microsoft-Windows-WLAN-AutoConfig - Event Log - Microsoft-Windows-WLAN-AutoConfig/Operational

Wireless Authentication Started And Failed

Event Source - Microsoft-Windows-WLAN-AutoConfig - Event Log - Microsoft-Windows-WLAN-AutoConfig/Operational

AIS Managed SIEM

Last modified March 24, 2021