Vista security events get noticed
Doriansoft noticed that there's a relationship between our pre-Vista security event IDs and our Vista-era security event IDs.
For most security events:
VistaEventId = PreVistaEventId + 4096
Why is this?
We needed to differentiate the Vista events from the pre-Vista events, because we were significantly changing the event content and didn't want to break automation. However we wanted to preserve the knowledge that security professionals already had in their heads about security events, so we wanted to make sure that there was a relationship between old and new event IDs.
We decided to offset the old IDs by some constant to get the new IDs. I wanted to offset them by a decimal number (say 6000, so 528 would become 6528, etc.). However event IDs are declared in hex in the source code and are all 3 digits long (528 = 0x210), and Raghu, my developer, wanted to conserve effort, and he won that battle so we added 0x1000 (4096) to the existing event IDs.
Anyway, that's sometimes how things go. Now you know the rest of the story.
