Glossary: Logs and Data Sources for Investigations

NTLM

An older Windows sign-in protocol. Its credential checks appear on a domain controller as event 4776.