diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 3fa0e65f2d4..acfdbc957c8 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -978,6 +978,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add additional event categorization for security and sysmon modules. {pull}22988[22988]
 - Add dns.question.subdomain fields for sysmon DNS events. {pull}22999[22999]
 - Add dns.question.top_level_domain fields for sysmon DNS events. {pull}23046[23046]
+- Add Audit and Authentication Polixy Change Events and related.ip information {pull}20684[20684]
 
 *Elastic Log Driver*
 
diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js
index 56cdced6b51..44d0e8eb34d 100644
--- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js
+++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js
@@ -180,6 +180,7 @@ var security = (function () {
         "4647": [["authentication"], ["end"], "logged-out"],
         "4648": [["authentication"], ["start"], "logged-in-explicit"],
         "4657": [["configuration"], ["change"], "registry-value-modified"],
+        "4670": [["iam", "configuration"],["admin", "change"],"permissions-changed"],
         "4672": [["iam"], ["admin"], "logged-in-special"],
         "4673": [["iam"], ["admin"], "privileged-service-called"],
         "4674": [["iam"], ["admin"], "privileged-operation"],
@@ -197,6 +198,8 @@ var security = (function () {
         "4714": [["configuration"], ["change"], "encrypted-data-recovery-policy-changed"],
         "4715": [["configuration"], ["change"], "object-audit-policy-changed"],
         "4716": [["configuration"], ["change"], "trusted-domain-information-changed"],
+        "4717": [["iam", "configuration"],["admin", "change"],"system-security-access-granted"],
+        "4718": [["iam", "configuration"],["admin", "deletion"],"system-security-access-removed"],
         "4719": [["iam", "configuration"], ["admin", "change"], "changed-audit-config"], // remove iam and admin
         "4720": [["iam"], ["user", "creation"], "added-user-account"],
         "4722": [["iam"], ["user", "change"], "enabled-user-account"],
@@ -252,7 +255,14 @@ var security = (function () {
         "4781": [["iam"], ["user", "change"], "renamed-user-account"],
         "4798": [["iam"], ["user", "info"], "group-membership-enumerated"], // process enumerates the local groups to which the specified user belongs
         "4799": [["iam"], ["group", "info"], "user-member-enumerated"], // a process enumerates the members of the specified local group
-        "4912": [["configuration"], ["change"], "per-user-audit-policy-changed"],
+        "4817": [["iam", "configuration"], ["admin", "change"],"object-audit-changed"],
+        "4902": [["iam", "configuration"], ["admin", "creation"],"user-audit-policy-created"],
+        "4904": [["iam", "configuration"], ["admin", "change"],"security-event-source-added"],
+        "4905": [["iam", "configuration"], ["admin", "deletion"], "security-event-source-removed"],
+        "4906": [["iam", "configuration"], ["admin", "change"], "crash-on-audit-changed"],
+        "4907": [["iam", "configuration"], ["admin", "change"], "audit-setting-changed"],
+        "4908": [["iam", "configuration"], ["admin", "change"], "special-group-table-changed"],
+        "4912": [["iam", "configuration"], ["admin", "change"], "per-user-audit-policy-changed"],
         "4950": [["configuration"], ["change"], "windows-firewall-setting-changed"],
         "4954": [["configuration"], ["change"], "windows-firewall-group-policy-changed"],
         "4964": [["iam"], ["admin", "group"], "logged-in-special"],
@@ -263,16 +273,6 @@ var security = (function () {
         "5037": [["driver"], ["end"], "windows-firewall-driver-error"],
     };
 
-
-    // Audit Policy Changes Table
-    // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719
-    var auditActions = {
-        "8448": "Success Removed",
-        "8450": "Failure Removed",
-        "8449": "Success Added",
-        "8451": "Failure Added",
-    };
-
     // Services Types
     // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697
     var serviceTypes = {
@@ -1209,7 +1209,7 @@ var security = (function () {
         "8448": "Success removed",
         "8449": "Success Added",
         "8450": "Failure removed",
-        "8451": "Failure added",
+        "8451": "Failure Added",
         "8452": "Success include removed",
         "8453": "Success include added",
         "8454": "Success exclude removed",
@@ -1351,6 +1351,250 @@ var security = (function () {
         "16903": "Publish",
     };
 
+    // Trust Types 
+    // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706
+    var trustTypes = {
+        "1": "TRUST_TYPE_DOWNLEVEL",
+        "2": "TRUST_TYPE_UPLEVEL",
+        "3": "TRUST_TYPE_MIT",
+        "4": "TRUST_TYPE_DCE"
+    }
+
+    // Trust Direction 
+    // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706
+    var trustDirection = {
+        "0": "TRUST_DIRECTION_DISABLED",
+        "1": "TRUST_DIRECTION_INBOUND",
+        "2": "TRUST_DIRECTION_OUTBOUND",
+        "3": "TRUST_DIRECTION_BIDIRECTIONAL"
+    }
+
+    // Trust Attributes 
+    // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4706
+    var trustAttributes = {
+        "0": "UNDEFINED",
+        "1": "TRUST_ATTRIBUTE_NON_TRANSITIVE",
+        "2": "TRUST_ATTRIBUTE_UPLEVEL_ONLY",
+        "4": "TRUST_ATTRIBUTE_QUARANTINED_DOMAIN",
+        "8": "TRUST_ATTRIBUTE_FOREST_TRANSITIVE",
+        "16": "TRUST_ATTRIBUTE_CROSS_ORGANIZATION",
+        "32": "TRUST_ATTRIBUTE_WITHIN_FOREST",
+        "64": "TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL",
+        "128": "TRUST_ATTRIBUTE_USES_RC4_ENCRYPTION",
+        "512": "TRUST_ATTRIBUTE_CROSS_ORGANIZATION_NO_TGT_DELEGATION",
+        "1024": "TRUST_ATTRIBUTE_PIM_TRUST"
+    }
+
+    // SDDL Ace Types
+    // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4715
+    // https://docs.microsoft.com/en-us/windows/win32/secauthz/ace-strings
+    // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070
+    var aceTypes = {
+        "A": "Access Allowed",
+        "D": "Access Denied",
+        "OA": "Object Access Allowed",
+        "OD": "Object Access Denied",
+        "AU": "System Audit",
+        "AL": "System Alarm",
+        "OU": "System Object Audit",
+        "OL": "System Object Alarm",
+        "ML": "System Mandatory Label",
+        "SP": "Central Policy ID"
+    }
+
+    // SDDL Permissions
+    // https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4715
+    // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070
+    var permissionDescription = {
+        "GA": "Generic All",
+        "GR": "Generic Read",
+        "GW": "Generic Write",
+        "GX": "Generic Execute",
+        "RC": "Read Permissions",
+        "SD": "Delete",
+        "WD": "Modify Permissions",
+        "WO": "Modify Owner",
+        "RP": "Read All Properties",
+        "WP": "Write All Properties",
+        "CC": "Create All Child Objects",
+        "DC": "Delete All Child Objects",
+        "LC": "List Contents",
+        "SW": "All Validated",
+        "LO": "List Object",
+        "DT": "Delete Subtree",
+        "CR": "All Extended Rights",
+        "FA": "File All Access",
+        "FR": "File Generic Read",
+        "FX": "FILE GENERIC EXECUTE",
+        "FW": "FILE GENERIC WRITE",
+        "KA": "KEY ALL ACCESS",
+        "KR": "KEY READ",
+        "KW": "KEY WRITE",
+        "KX": "KEY EXECUTE"
+    }
+
+    // Known SIDs
+    // https://support.microsoft.com/en-au/help/243330/well-known-security-identifier"S-in-window"S-operating-systems
+    // https://docs.microsoft.com/en-us/windows/win32/secauthz/sid-strings
+    var accountSIDDescription = {
+        "AO": "Account operators",
+        "RU": "Alias to allow previous Windows 2000",
+        "AN": "Anonymous logon",
+        "AU": "Authenticated users",
+        "BA": "Built-in administrators",
+        "BG": "Built-in guests",
+        "BO": "Backup operators",
+        "BU": "Built-in users",
+        "CA": "Certificate server administrators",
+        "CG": "Creator group",
+        "CO": "Creator owner",
+        "DA": "Domain administrators",
+        "DC": "Domain computers",
+        "DD": "Domain controllers",
+        "DG": "Domain guests",
+        "DU": "Domain users",
+        "EA": "Enterprise administrators",
+        "ED": "Enterprise domain controllers",
+        "WD": "Everyone",
+        "PA": "Group Policy administrators",
+        "IU": "Interactively logged-on user",
+        "LA": "Local administrator",
+        "LG": "Local guest",
+        "LS": "Local service account",
+        "SY": "Local system",
+        "NU": "Network logon user",
+        "NO": "Network configuration operators",
+        "NS": "Network service account",
+        "PO": "Printer operators",
+        "PS": "Personal self",
+        "PU": "Power users",
+        "RS": "RAS servers group",
+        "RD": "Terminal server users",
+        "RE": "Replicator",
+        "RC": "Restricted code",
+        "SA": "Schema administrators",
+        "SO": "Server operators",
+        "SU": "Service logon user",
+        "S-1-0": "Null Authority",
+        "S-1-0-0": "Nobody",
+        "S-1-1": "World Authority",
+        "S-1-1-0": "Everyone",
+        "S-1-16-0": "Untrusted Mandatory Level",
+        "S-1-16-12288": "High Mandatory Level",
+        "S-1-16-16384": "System Mandatory Level",
+        "S-1-16-20480": "Protected Process Mandatory Level",
+        "S-1-16-28672": "Secure Process Mandatory Level",
+        "S-1-16-4096": "Low Mandatory Level",
+        "S-1-16-8192": "Medium Mandatory Level",
+        "S-1-16-8448": "Medium Plus Mandatory Level",
+        "S-1-2": "Local Authority",
+        "S-1-2-0": "Local",
+        "S-1-2-1": "Console Logon",
+        "S-1-3": "Creator Authority",
+        "S-1-3-0": "Creator Owner",
+        "S-1-3-1": "Creator Group",
+        "S-1-3-2": "Creator Owner Server",
+        "S-1-3-3": "Creator Group Server",
+        "S-1-3-4": "Owner Rights",
+        "S-1-4": "Non-unique Authority",
+        "S-1-5": "NT Authority",
+        "S-1-5-1": "Dialup",
+        "S-1-5-10": "Principal Self",
+        "S-1-5-11": "Authenticated Users",
+        "S-1-5-12": "Restricted Code",
+        "S-1-5-13": "Terminal Server Users",
+        "S-1-5-14": "Remote Interactive Logon",
+        "S-1-5-15": "This Organization",
+        "S-1-5-17": "This Organization",
+        "S-1-5-18": "Local System",
+        "S-1-5-19": "NT Authority",
+        "S-1-5-2": "Network",
+        "S-1-5-20": "NT Authority",
+        "S-1-5-3": "Batch",
+        "S-1-5-32-544": "Administrators",
+        "S-1-5-32-545": "Users",
+        "S-1-5-32-546": "Guests",
+        "S-1-5-32-547": "Power Users",
+        "S-1-5-32-548": "Account Operators",
+        "S-1-5-32-549": "Server Operators",
+        "S-1-5-32-550": "Print Operators",
+        "S-1-5-32-551": "Backup Operators",
+        "S-1-5-32-552": "Replicators",
+        "S-1-5-32-554": "Builtin\Pre-Windows 2000 Compatible Access",
+        "S-1-5-32-555": "Builtin\Remote Desktop Users",
+        "S-1-5-32-556": "Builtin\Network Configuration Operators",
+        "S-1-5-32-557": "Builtin\Incoming Forest Trust Builders",
+        "S-1-5-32-558": "Builtin\Performance Monitor Users",
+        "S-1-5-32-559": "Builtin\Performance Log Users",
+        "S-1-5-32-560": "Builtin\Windows Authorization Access Group",
+        "S-1-5-32-561": "Builtin\Terminal Server License Servers",
+        "S-1-5-32-562": "Builtin\Distributed COM Users",
+        "S-1-5-32-569": "Builtin\Cryptographic Operators",
+        "S-1-5-32-573": "Builtin\Event Log Readers",
+        "S-1-5-32-574": "Builtin\Certificate Service DCOM Access",
+        "S-1-5-32-575": "Builtin\RDS Remote Access Servers",
+        "S-1-5-32-576": "Builtin\RDS Endpoint Servers",
+        "S-1-5-32-577": "Builtin\RDS Management Servers",
+        "S-1-5-32-578": "Builtin\Hyper-V Administrators",
+        "S-1-5-32-579": "Builtin\Access Control Assistance Operators",
+        "S-1-5-32-580": "Builtin\Remote Management Users",
+        "S-1-5-32-582": "Storage Replica Administrators",
+        "S-1-5-4": "Interactive",
+        "S-1-5-5-X-Y": "Logon Session",
+        "S-1-5-6": "Service",
+        "S-1-5-64-10": "NTLM Authentication",
+        "S-1-5-64-14": "SChannel Authentication",
+        "S-1-5-64-21": "Digest Authentication",
+        "S-1-5-7": "Anonymous",
+        "S-1-5-8": "Proxy",
+        "S-1-5-80": "NT Service",
+        "S-1-5-80-0": "All Services",
+        "S-1-5-83-0": "NT Virtual Machine\Virtual Machines",
+        "S-1-5-9": "Enterprise Domain Controllers",
+        "S-1-5-90-0": "Windows Manager\Windows Manager Group"
+    }
+
+    // Domain-specific SIDs
+    // https://support.microsoft.com/en-au/help/243330/well-known-security-identifiers-in-windows-operating-systems
+    var domainSpecificSID = {
+        "498": "Enterprise Read-only Domain Controllers",
+        "500": "Administrator",
+        "501": "Guest",
+        "502": "KRBTGT",
+        "512": "Domain Admins",
+        "513": "Domain Users",
+        "514": "Domain Guests",
+        "515": "Domain Computers",
+        "516": "Domain Controllers",
+        "517": "Cert Publishers",
+        "518": "Schema Admins",
+        "519": "Enterprise Admins",
+        "520": "Group Policy Creator Owners",
+        "521": "Read-only Domain Controllers",
+        "522": "Cloneable Domain Controllers",
+        "526": "Key Admins",
+        "527": "Enterprise Key Admins",
+        "553": "RAS and IAS Servers",
+        "571": "Allowed RODC Password Replication Group",
+        "572": "Denied RODC Password Replication Group"
+    }
+
+    // Object Permission Flags
+    // https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7a53f60e-e730-4dfe-bbe9-b21b62eb790b
+    var permsFlags = [
+        [0x80000000, 'Generic Read'],
+        [0x4000000, 'Generic Write'],
+        [0x20000000, 'Generic Execute'],
+        [0x10000000, 'Generic All'],
+        [0x02000000, 'Maximun Allowed'],
+        [0x01000000, 'Access System Security'],
+        [0x00100000, 'Syncronize'],
+        [0x00080000, 'Write Owner'],
+        [0x00040000, 'Write DACL'],
+        [0x00020000, 'Read Control'],
+        [0x00010000, 'Delete']
+    ];
+
     // lookupMessageCode returns the string associated with the code. key should
     // be the name of the field in evt containing the code (e.g. %%2313).
     var lookupMessageCode = function (evt, key) {
@@ -1455,7 +1699,7 @@ var security = (function () {
         var actionResults = [];
         for (var j = 0; j < codedActions.length; j++) {
             var actionCode = codedActions[j].replace("%%", '').replace(' ', '');
-            actionResults.push(auditActions[actionCode]);
+            actionResults.push(msobjsMessageTable[actionCode]);
         }
         evt.Put("winlog.event_data.AuditPolicyChangesDescription", actionResults);
     };
@@ -1495,12 +1739,118 @@ var security = (function () {
         evt.Put("winlog.event_data.StatusDescription", kerberosTktStatusCodes[code]);
     };
 
+    var translateSID = function(sid){
+        var translatedSID = accountSIDDescription[sid];
+            if (translatedSID == undefined) {
+                if (/^S\-1\-5\-21/.test(sid)) {
+                    var uid = sid.match(/[0-9]{1,5}$/g);
+                    if (uid) {
+                        translatedSID = domainSpecificSID[uid];
+                    }
+                }
+            }
+            if (translatedSID == undefined) {
+                translatedSID = sid;
+            }
+        return translatedSID;
+    }
+
+    var translatePermissionMask = function(mask) {
+        if (!mask) {
+            return;
+        }
+        var permCode = parseInt(mask);
+        var permResult = [];
+        for (var i = 0; i < permsFlags.length; i++) {
+            if ((permCode | permsFlags[i][0]) === permCode) {
+                permResult.push(permsFlags[i][1]);
+            }
+        }
+        if (permResult) {
+            return permResult;
+        } else {
+            return mask;
+        }
+    };
+
+    var translateACL = function(dacl) {
+        var aceArray = dacl.split(";");
+        var aceResult = [];
+        var aceType = aceArray[0];
+        var acePerm = aceArray[2];
+        var aceTrustedSid = aceArray[5];
+        if (aceTrustedSid) {
+            aceResult['grantee'] = translateSID(aceTrustedSid);
+        }
+        if (aceType) {
+            aceResult['type'] = aceTypes[aceType];
+        }
+        if (acePerm) {
+            if (/^0x/.test(acePerm)) {
+                var perms = translatePermissionMask(acePerm);
+            }
+            else {
+                var perms = []
+                var permPairs = acePerm.match(/.{1,2}/g);
+                for ( var i = 0; i < permPairs.length; i ++) {
+                    perms.push(permissionDescription[permPairs[i]])
+                }
+            }
+            aceResult['perms'] = perms;
+        }
+        return aceResult;
+    };
+
+    var enrichSDDL = function(evt, sddl) {
+        var sddlStr = evt.Get(sddl);
+        if (!sddlStr) {
+            return;
+        }
+        var sdOwner = sddlStr.match(/^O\:[A-Z]{2}/g);
+        var sdGroup = sddlStr.match(/^G\:[A-Z]{2}/g);
+        var sdDacl = sddlStr.match(/(D:([A-Z]*(\(.*\))*))/g);
+        var sdSacl = sddlStr.match(/(S:([A-Z]*(\(.*\))*))?$/g);
+        if (sdOwner) {
+            evt.Put(sddl+"Owner", translateSID(sdOwner));
+        }
+        if (sdGroup) {
+            evt.Put(sddl+"Group", translateSID(sdGroup));
+        }
+        if (sdDacl) {
+            // Split each entry of the DACL
+            var daclList = (sdDacl[0]).match(/\([^*\)]*\)/g);
+            if (daclList) {
+                for (var i = 0; i < daclList.length; i++) {
+                    var newDacl = translateACL(daclList[i].replace("(", '').replace(")", ''));
+                    evt.Put(sddl+"Dacl"+i, newDacl['grantee']+" :"+newDacl['type']+" ("+newDacl['perms']+")");
+                    if ( newDacl['grantee'] === "Administrator" || newDacl['grantee'] === "Guest" || newDacl['grantee'] === "KRBTGT" ) {
+                        evt.AppendTo('related.user', newDacl['grantee']);
+                    }
+                }
+            }
+        }
+        if (sdSacl) {
+            // Split each entry of the SACL
+            var saclList = (sdSacl[0]).match(/\([^*\)]*\)/g);
+            if (saclList) {
+                for (var i = 0; i < saclList.length; i++) {
+                    var newSacl = translateACL(saclList[i].replace("(", '').replace(")", ''));
+                    evt.Put(sddl+"Sacl"+i, newSacl['grantee']+" :"+newSacl['type']+" ("+newSacl['perms']+")");
+                    if ( newSacl['grantee'] === "Administrator" || newSacl['grantee'] === "Guest" || newSacl['grantee'] === "KRBTGT" ) {
+                        evt.AppendTo('related.user', newSacl['grantee']);
+                    }
+                }
+            }
+        }
+    };
+
     var addSessionData = new processor.Chain()
         .Convert({
             fields: [
                 {from: "winlog.event_data.AccountName", to: "user.name"},
                 {from: "winlog.event_data.AccountDomain", to: "user.domain"},
                 {from: "winlog.event_data.ClientAddress", to: "source.ip", type: "ip"},
+                {from: "winlog.event_data.ClientAddress", to: "related.ip", type: "ip"},
                 {from: "winlog.event_data.ClientName", to: "source.domain"},
                 {from: "winlog.event_data.LogonID", to: "winlog.logon.id"},
             ],
@@ -1529,6 +1879,26 @@ var security = (function () {
         })
         .Build();
 
+    var addTrustInformation = new processor.Chain()
+        .Add(function(evt) {
+            var code = evt.Get("winlog.event_data.TdoType");
+            if (!code) {
+                return;
+            }
+            evt.Put("winlog.trustType", trustTypes[code]);
+            code = evt.Get("winlog.event_data.TdoDirection");
+            if (!code) {
+                return;
+            }
+            evt.Put("winlog.trustDirection", trustDirection[code]);
+            code = evt.Get("winlog.event_data.TdoAttributes");
+            if (!code) {
+                return;
+            }
+            evt.Put("winlog.trustAttribute", trustAttributes[code]);
+
+        })
+        .Build();
     var copyTargetUser = new processor.Chain()
         .Convert({
             fields: [
@@ -1635,6 +2005,7 @@ var security = (function () {
                 {from: "winlog.event_data.ProcessId", to: "process.pid", type: "long"},
                 {from: "winlog.event_data.ProcessName", to: "process.executable"},
                 {from: "winlog.event_data.IpAddress", to: "source.ip", type: "ip"},
+                {from: "winlog.event_data.ClientAddress", to: "related.ip", type: "ip"},
                 {from: "winlog.event_data.IpPort", to: "source.port", type: "long"},
                 {from: "winlog.event_data.WorkstationName", to: "source.domain"},
             ],
@@ -1772,10 +2143,12 @@ var security = (function () {
         .Add(addEventFields)
         .Add(function(evt) {
             var user = evt.Get("winlog.event_data.TargetUserName");
-            var res = /^-$/.test(user);
-                if (!res) {
-                    evt.AppendTo('related.user', user);
-                }
+            if (user) {
+                var res = /^-$/.test(user);
+                    if (!res) {
+                        evt.AppendTo('related.user', user);
+                    }
+            }
         })
         .Build();
 
@@ -1831,7 +2204,6 @@ var security = (function () {
             }
             evt.AppendTo("related.user", member.split(',')[0].replace('CN=', '').replace('cn=', ''));
         })
-
         .Build();
 
     var auditLogCleared = new processor.Chain()
@@ -1890,8 +2262,11 @@ var security = (function () {
         .Add(addEventFields)
         .Add(function(evt) {
             var ip = evt.Get("source.ip");
-            if (/::ffff:/.test(ip)) {
-                evt.Put("source.ip", ip.replace("::ffff:", ""));
+            if (ip) {
+               if (/::ffff:/.test(ip)) {
+                   evt.Put("source.ip", ip.replace("::ffff:", ""));
+                   evt.Put("related.ip", ip.replace("::ffff:", ""));
+               }
             }
         })
         .Build();
@@ -1939,6 +2314,67 @@ var security = (function () {
         })
         .Build();
 
+    var trustDomainMgmtEvts = new processor.Chain()
+        .Add(copySubjectUser)
+        .Add(copySubjectUserLogonId)
+        .Add(addEventFields)
+        .Add(addTrustInformation)
+        .Build();
+
+    var policyChange = new processor.Chain()
+        .Add(copySubjectUser)
+        .Add(copySubjectUserLogonId)
+        .Add(addEventFields)
+        .Build();
+
+    var objectPolicyChange = new processor.Chain()
+        .Add(copySubjectUser)
+        .Add(copySubjectUserLogonId)
+        .Add(renameCommonAuthFields)
+        .Add(addEventFields)
+        .Add(function(evt) {
+            var oldSd = evt.Get("winlog.event_data.OldSd");
+            var newSd = evt.Get("winlog.event_data.NewSd");
+            if (oldSd) {
+                enrichSDDL(evt, "winlog.event_data.OldSd");
+            }
+            if (newSd) {
+                enrichSDDL(evt, "winlog.event_data.NewSd");
+            }
+        })
+        .Build();
+
+    var genericAuditChange = new processor.Chain()
+        .Add(addEventFields)
+        .Build();
+
+    var event4908 = new processor.Chain()
+        .Add(addEventFields)
+        .Add(function(evt) {
+            var sids = evt.Get("winlog.event_data.SidList");
+            if (!sids) {
+                return;
+            }
+            var sidList = sids.split(/\s+/);
+            evt.Put("winlog.event_data.SidList", sids.split(/\s+/));
+            var sidListDesc = [];
+            for (var i = 0; i < sidList.length; i++) {
+                var sidTemp = sidList[i].replace("%", "").replace("{", "").replace("}", "").replace(" ","");
+                if (sidTemp) {
+                    sidListDesc.push(translateSID(sidTemp));
+                }
+            }
+            evt.Put("winlog.event_data.SidListDesc", sidListDesc);
+        })
+        .Build();
+
+    var securityEventSource = new processor.Chain()
+        .Add(copySubjectUser)
+        .Add(copySubjectUserLogonId)
+        .Add(renameCommonAuthFields)
+        .Add(addEventFields)
+        .Build();
+
     return {
 
         // 1100 - The event logging service has shut down.
@@ -1971,6 +2407,9 @@ var security = (function () {
         // 4648 - A logon was attempted using explicit credentials.
         4648: event4648.Run,
 
+        // 4670 - Permissions on an object were changed.
+        4670: objectPolicyChange.Run,
+
         // 4672 - Special privileges assigned to new logon.
         4672: event4672.Run,
 
@@ -2004,6 +2443,24 @@ var security = (function () {
         // 4702 - A scheduled task was updated.
         4702: scheduledTask.Run,
 
+        // 4706 - A new trust was created to a domain.
+        4706: trustDomainMgmtEvts.Run,
+
+        // 4707 - A trust to a domain was removed.
+        4707: trustDomainMgmtEvts.Run,
+
+        // 4713 - Kerberos policy was changed.
+        4713: policyChange.Run,
+
+        // 4716 - Trusted domain information was modified.
+        4716: trustDomainMgmtEvts.Run,
+
+        // 4717 - System security access was granted to an account.
+        4717: policyChange.Run,
+
+        // 4718 - System security access was removed from an account.
+        4718: policyChange.Run,
+
         // 4719 -  System audit policy was changed.
         4719: auditChanged.Run,
 
@@ -2055,6 +2512,9 @@ var security = (function () {
         // 4737 - A security-enabled global group was changed.
         4737: groupMgmtEvts.Run,
 
+        // 4739 - A security-enabled global group was changed.
+        4739: policyChange.Run,
+
         // 4738 - An user account was changed.
         4738: userMgmtEvts.Run,
 
@@ -2166,6 +2626,30 @@ var security = (function () {
         // 4799 - A security-enabled local group membership was enumerated.
         4799: groupMgmtEvts.Run,
 
+        // 4817 - Auditing settings on object were changed.
+        4817: objectPolicyChange.Run,
+
+        // 4902 - The Per-user audit policy table was created.
+        4902: genericAuditChange.Run,
+
+        // 4904 - An attempt was made to register a security event source.
+        4904: securityEventSource.Run,
+
+        // 4905 - An attempt was made to unregister a security event source.
+        4905: securityEventSource.Run,
+
+        // 4906 - The CrashOnAuditFail value has changed.
+        4906: genericAuditChange.Run,
+
+        // 4907 - Auditing settings on object were changed.
+        4907: objectPolicyChange.Run,
+
+        // 4908 - Special Groups Logon table modified.
+        4908: event4908.Run,
+
+        // 4912 -   Per User Audit Policy was changed.
+        4912: auditChanged.Run,
+
         // 4964 - Special groups have been assigned to a new logon.
         4964: event4964.Run,
 
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..30c2adc8426
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..0666a8b5ac8
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4670_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,80 @@
+[
+  {
+    "@timestamp": "2020-07-28T13:22:18.7993488Z",
+    "event": {
+      "action": "permissions-changed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4670,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "process": {
+      "executable": "C:\\Windows\\System32\\services.exe",
+      "name": "services.exe",
+      "pid": 764
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "HandleId": "0x56c",
+        "NewSd": "D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)",
+        "NewSdDacl0": "Local system :Access Allowed (Generic All)",
+        "NewSdDacl1": "OW :Access Allowed (Read Permissions)",
+        "NewSdDacl2": "S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628 :Access Allowed (Generic All)",
+        "ObjectName": "-",
+        "ObjectServer": "Security",
+        "ObjectType": "Token",
+        "OldSd": "D:(A;;GA;;;SY)(A;;GA;;;NS)",
+        "OldSdDacl0": "Local system :Access Allowed (Generic All)",
+        "OldSdDacl1": "Network service account :Access Allowed (Generic All)",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18"
+      },
+      "event_id": 4670,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 4,
+        "thread": {
+          "id": 4604
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 31932,
+      "task": "Authorization Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..e87e18d5441
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..7cdf639ce48
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4706_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,72 @@
+[
+  {
+    "@timestamp": "2020-07-27T09:42:48.3690009Z",
+    "event": {
+      "action": "domain-trust-added",
+      "category": [
+        "configuration"
+      ],
+      "code": 4706,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "creation"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "Administrator"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-21-2024912787-2692429404-2351956786-500",
+      "name": "Administrator"
+    },
+    "winlog": {
+      "activity_id": "{be129571-63f8-0000-a795-12bef863d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "DomainName": "192.168.230.153",
+        "DomainSid": "S-1-0-0",
+        "SidFilteringEnabled": "%%1796",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x6a868",
+        "SubjectUserName": "Administrator",
+        "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500",
+        "TdoAttributes": "1",
+        "TdoDirection": "3",
+        "TdoType": "3"
+      },
+      "event_id": 4706,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x6a868"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 3056
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 6017,
+      "task": "Authentication Policy Change",
+      "trustAttribute": "TRUST_ATTRIBUTE_NON_TRANSITIVE",
+      "trustDirection": "TRUST_DIRECTION_BIDIRECTIONAL",
+      "trustType": "TRUST_TYPE_MIT"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..3f9f51c4f98
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..d16ff334435
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4707_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,64 @@
+[
+  {
+    "@timestamp": "2020-07-28T06:18:04.600444Z",
+    "event": {
+      "action": "domain-trust-removed",
+      "category": [
+        "configuration"
+      ],
+      "code": 4707,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "deletion"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "Administrator"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-21-2024912787-2692429404-2351956786-500",
+      "name": "Administrator"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "DomainName": "192.168.230.153",
+        "DomainSid": "S-1-0-0",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x6a868",
+        "SubjectUserName": "Administrator",
+        "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500"
+      },
+      "event_id": 4707,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x6a868"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 2012
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 13679,
+      "task": "Authentication Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..5d4bb4d159a
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..9dcfe4ddb59
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4713_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,64 @@
+[
+  {
+    "@timestamp": "2020-07-28T10:15:43.4951882Z",
+    "event": {
+      "action": "kerberos-policy-changed",
+      "category": [
+        "configuration"
+      ],
+      "code": 4713,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "activity_id": "{be129571-63f8-0000-a795-12bef863d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "KerberosPolicyChange": "KerMinT: 0x53d1ac1000 (0x53ade8ca00);  KerMaxR: 0x649534e0000 (0x58028e44000);  KerProxy: 0xd693a400 (0xb2d05e00);  ",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18"
+      },
+      "event_id": 4713,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 2012
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 21265,
+      "task": "Authentication Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..39053c8797e
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..6e43b04c6f3
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4716_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,72 @@
+[
+  {
+    "@timestamp": "2020-07-28T08:17:00.4706442Z",
+    "event": {
+      "action": "trusted-domain-information-changed",
+      "category": [
+        "configuration"
+      ],
+      "code": 4716,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "Administrator"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-21-2024912787-2692429404-2351956786-500",
+      "name": "Administrator"
+    },
+    "winlog": {
+      "activity_id": "{be129571-63f8-0000-a795-12bef863d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "DomainName": "-",
+        "DomainSid": "S-1-0-0",
+        "SidFilteringEnabled": "-",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x6a868",
+        "SubjectUserName": "Administrator",
+        "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500",
+        "TdoAttributes": "1",
+        "TdoDirection": "3",
+        "TdoType": "3"
+      },
+      "event_id": 4716,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x6a868"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 3776
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 14929,
+      "task": "Authentication Policy Change",
+      "trustAttribute": "TRUST_ATTRIBUTE_NON_TRANSITIVE",
+      "trustDirection": "TRUST_DIRECTION_BIDIRECTIONAL",
+      "trustType": "TRUST_TYPE_MIT"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..f27db52c536
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..fe3d49133e0
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4717_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,67 @@
+[
+  {
+    "@timestamp": "2020-07-27T09:30:41.9034803Z",
+    "event": {
+      "action": "system-security-access-granted",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4717,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "WORKGROUP",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "activity_id": "{b69bb9ff-63f5-0000-35ba-9bb6f563d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6",
+      "event_data": {
+        "AccessGranted": "SeNetworkLogonRight",
+        "SubjectDomainName": "WORKGROUP",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18",
+        "TargetSid": "S-1-5-9"
+      },
+      "event_id": 4717,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 820
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 1571,
+      "task": "Authentication Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..43ef6f5a787
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..6e5fc0f6d54
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4718_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,67 @@
+[
+  {
+    "@timestamp": "2020-07-27T09:30:41.8778082Z",
+    "event": {
+      "action": "system-security-access-removed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4718,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "deletion"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "WORKGROUP",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "activity_id": "{b69bb9ff-63f5-0000-35ba-9bb6f563d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6",
+      "event_data": {
+        "AccessRemoved": "SeNetworkLogonRight",
+        "SubjectDomainName": "WORKGROUP",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18",
+        "TargetSid": "S-1-5-32-545"
+      },
+      "event_id": 4718,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 820
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 1565,
+      "task": "Authentication Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..c30822f456f
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..4bc9323ce3f
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4719_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,74 @@
+[
+  {
+    "@timestamp": "2020-08-18T13:45:57.4803543Z",
+    "event": {
+      "action": "changed-audit-config",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4719,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "Administrator"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-21-2024912787-2692429404-2351956786-500",
+      "name": "Administrator"
+    },
+    "winlog": {
+      "activity_id": "{65461d39-753f-0000-731d-46653f75d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "AuditPolicyChanges": "%%8448",
+        "AuditPolicyChangesDescription": [
+          "Success removed"
+        ],
+        "Category": "Object Access",
+        "CategoryId": "%%8274",
+        "SubCategory": "Other Object Access Events",
+        "SubcategoryGuid": "{0cce9227-69ae-11d9-bed3-505054503030}",
+        "SubcategoryId": "%%12804",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x44d7d",
+        "SubjectUserName": "Administrator",
+        "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500"
+      },
+      "event_id": 4719,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x44d7d"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 780,
+        "thread": {
+          "id": 2764
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 123879,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..60063744d4c
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..4035618ea1d
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4739_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,71 @@
+[
+  {
+    "@timestamp": "2020-07-27T09:34:50.1578005Z",
+    "event": {
+      "action": "domain-policy-changed",
+      "category": [
+        "configuration"
+      ],
+      "code": 4739,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "DomainBehaviorVersion": "-",
+        "DomainName": "TEST",
+        "DomainPolicyChanged": "Password Policy",
+        "DomainSid": "S-1-5-21-2024912787-2692429404-2351956786",
+        "MachineAccountQuota": "-",
+        "MixedDomainMode": "-",
+        "OemInformation": "-",
+        "PasswordHistoryLength": "-",
+        "PrivilegeList": "-",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18"
+      },
+      "event_id": 4739,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 812
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 3532,
+      "task": "Authentication Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..7dda9113651
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..71607b7242c
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4817_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,74 @@
+[
+  {
+    "@timestamp": "2020-08-17T12:49:09.4942066Z",
+    "event": {
+      "action": "object-audit-changed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4817,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": [
+        "WIN-BVM4LI1L1Q6$",
+        "Administrator"
+      ]
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "activity_id": "{dfcd2c2a-7481-0000-682c-cddf8174d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "NewSd": "S:(AU;SA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-2024912787-2692429404-2351956786-500)(AU;SA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-2024912787-2692429404-2351956786-1000)",
+        "NewSdSacl0": "Administrator :System Audit (Create All Child Objects,Delete All Child Objects,List Contents,All Validated,Read All Properties,Write All Properties,Delete Subtree,List Object,All Extended Rights,Delete,Read Permissions,Modify Permissions,Modify Owner)",
+        "NewSdSacl1": "S-1-5-21-2024912787-2692429404-2351956786-1000 :System Audit (Create All Child Objects,Delete All Child Objects,List Contents,All Validated,Read All Properties,Write All Properties,Delete Subtree,List Object,All Extended Rights,Delete,Read Permissions,Modify Permissions,Modify Owner)",
+        "ObjectName": "File",
+        "ObjectServer": "LSA",
+        "ObjectType": "Global SACL",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18"
+      },
+      "event_id": 4817,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 776,
+        "thread": {
+          "id": 3052
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 114278,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..695eae2bb3b
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..0c21de310ab
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4902_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,51 @@
+[
+  {
+    "@timestamp": "2020-08-19T06:07:08.801981Z",
+    "event": {
+      "action": "user-audit-policy-created",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4902,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "creation"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "PuaCount": "0",
+        "PuaPolicyId": "0x9fd2"
+      },
+      "event_id": 4902,
+      "keywords": [
+        "Audit Success"
+      ],
+      "opcode": "Info",
+      "process": {
+        "pid": 784,
+        "thread": {
+          "id": 832
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 140273,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..0fde0144e53
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..cb92cffa1b2
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4904_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,72 @@
+[
+  {
+    "@timestamp": "2020-08-19T07:56:52.019802Z",
+    "event": {
+      "action": "security-event-source-added",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4904,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "process": {
+      "executable": "C:\\Windows\\System32\\inetsrv\\inetinfo.exe",
+      "name": "inetinfo.exe",
+      "pid": 3608
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "activity_id": "{dab46f85-75ee-0000-c36f-b4daee75d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "AuditSourceName": "IIS-METABASE",
+        "EventSourceId": "0x460422",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18"
+      },
+      "event_id": 4904,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 784,
+        "thread": {
+          "id": 824
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 146939,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..7e43d61f913
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..7b5c2e7c0c7
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4905_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,72 @@
+[
+  {
+    "@timestamp": "2020-08-19T07:56:51.5792901Z",
+    "event": {
+      "action": "security-event-source-removed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4905,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "deletion"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "process": {
+      "executable": "-",
+      "name": "-",
+      "pid": 4964
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "activity_id": "{dab46f85-75ee-0000-c36f-b4daee75d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "AuditSourceName": "IIS-METABASE",
+        "EventSourceId": "0x457b22",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18"
+      },
+      "event_id": 4905,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 784,
+        "thread": {
+          "id": 824
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 146938,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..43a47a29d32
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..9711989c89e
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4906_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,50 @@
+[
+  {
+    "@timestamp": "2020-08-18T09:19:00.2372249Z",
+    "event": {
+      "action": "crash-on-audit-changed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4906,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "CrashOnAuditFailValue": "1"
+      },
+      "event_id": 4906,
+      "keywords": [
+        "Audit Success"
+      ],
+      "opcode": "Info",
+      "process": {
+        "pid": 780,
+        "thread": {
+          "id": 804
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 123786,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..6a9530c298e
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..32dd648fc2a
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4907_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,75 @@
+[
+  {
+    "@timestamp": "2020-08-19T07:56:17.1121901Z",
+    "event": {
+      "action": "audit-setting-changed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4907,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "process": {
+      "executable": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1883_none_7ed84bd822106081\\TiWorker.exe",
+      "name": "TiWorker.exe",
+      "pid": 4300
+    },
+    "related": {
+      "user": "WIN-BVM4LI1L1Q6$"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-18",
+      "name": "WIN-BVM4LI1L1Q6$"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "HandleId": "0x93c",
+        "NewSd": "S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)",
+        "NewSdSacl0": "Everyone :System Audit (Delete All Child Objects,List Contents,Read All Properties,All Extended Rights,Delete,Modify Permissions,Modify Owner)",
+        "ObjectName": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\RemoteAccess\\RemoteAccess.psd1",
+        "ObjectServer": "Security",
+        "ObjectType": "File",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x3e7",
+        "SubjectUserName": "WIN-BVM4LI1L1Q6$",
+        "SubjectUserSid": "S-1-5-18"
+      },
+      "event_id": 4907,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x3e7"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 4,
+        "thread": {
+          "id": 408
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 146933,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..e319bcf9a0b
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..fcbdbce1d3d
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4908_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,58 @@
+[
+  {
+    "@timestamp": "2020-08-19T06:07:25.0461779Z",
+    "event": {
+      "action": "special-group-table-changed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4908,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "SidList": [
+          "",
+          "%{S-1-5-32-544}",
+          "%{S-1-5-32-123-54-65}"
+        ],
+        "SidListDesc": [
+          "Administrators",
+          "S-1-5-32-123-54-65"
+        ]
+      },
+      "event_id": 4908,
+      "keywords": [
+        "Audit Success"
+      ],
+      "opcode": "Info",
+      "process": {
+        "pid": 784,
+        "thread": {
+          "id": 808
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 140274,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx
new file mode 100644
index 00000000000..15a93a947a2
Binary files /dev/null and b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx differ
diff --git a/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json
new file mode 100644
index 00000000000..5e9a933c7bb
--- /dev/null
+++ b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json
@@ -0,0 +1,70 @@
+[
+  {
+    "@timestamp": "2020-08-18T14:36:41.2936839Z",
+    "event": {
+      "action": "per-user-audit-policy-changed",
+      "category": [
+        "iam",
+        "configuration"
+      ],
+      "code": 4912,
+      "kind": "event",
+      "module": "security",
+      "outcome": "success",
+      "provider": "Microsoft-Windows-Security-Auditing",
+      "type": [
+        "admin",
+        "change"
+      ]
+    },
+    "host": {
+      "name": "WIN-BVM4LI1L1Q6.TEST.local"
+    },
+    "log": {
+      "level": "information"
+    },
+    "related": {
+      "user": "Administrator"
+    },
+    "user": {
+      "domain": "TEST",
+      "id": "S-1-5-21-2024912787-2692429404-2351956786-500",
+      "name": "Administrator"
+    },
+    "winlog": {
+      "activity_id": "{65461d39-753f-0000-731d-46653f75d601}",
+      "api": "wineventlog",
+      "channel": "Security",
+      "computer_name": "WIN-BVM4LI1L1Q6.TEST.local",
+      "event_data": {
+        "AuditPolicyChanges": "%%8452",
+        "CategoryId": "%%8276",
+        "SubcategoryGuid": "{0cce924a-69ae-11d9-bed3-505054503030}",
+        "SubcategoryId": "%%13317",
+        "SubjectDomainName": "TEST",
+        "SubjectLogonId": "0x44d7d",
+        "SubjectUserName": "Administrator",
+        "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500",
+        "TargetUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500"
+      },
+      "event_id": 4912,
+      "keywords": [
+        "Audit Success"
+      ],
+      "logon": {
+        "id": "0x44d7d"
+      },
+      "opcode": "Info",
+      "process": {
+        "pid": 780,
+        "thread": {
+          "id": 3300
+        }
+      },
+      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
+      "provider_name": "Microsoft-Windows-Security-Auditing",
+      "record_id": 123917,
+      "task": "Audit Policy Change"
+    }
+  }
+]
\ No newline at end of file
diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json
index 6519408002c..977ea0fe116 100644
--- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json
+++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json
@@ -22,6 +22,7 @@
       "level": "information"
     },
     "related": {
+      "ip": "192.168.5.44",
       "user": "MPUIG"
     },
     "source": {
diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json
index 649db8b0e23..f7944a0c686 100644
--- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json
+++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4778.evtx.golden.json
@@ -22,6 +22,7 @@
       "level": "information"
     },
     "related": {
+      "ip": "10.100.150.9",
       "user": "at_adm"
     },
     "source": {
diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json
index 12c23f0a09d..93f89a592a6 100644
--- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json
+++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.evtx.golden.json
@@ -22,6 +22,7 @@
       "level": "information"
     },
     "related": {
+      "ip": "10.100.150.17",
       "user": "at_adm"
     },
     "source": {