6405 BranchCache: multiple instances of an event occurred
An aggregation event that reports, in summary, when many instances of the same BranchCache event occur in a short time.
Overview
The subcategory is Audit Other System Events. When the same event ID occurs many times in BranchCache, instead of emitting each one, it records a summary of the form “event ID X occurred N times.”
How it is triggered
- When a specific BranchCache event (6400-6404, etc.) occurs in volume in a short time and is aggregated.
Security review points
- The aggregation event itself has low security value. Check the underlying event ID and count, and if needed evaluate it from the perspective of the individual events (6400 to 6404).
Notes for log review
- It only carries meaning in BranchCache environments. Use it to understand high-volume trends.
Key fields
| Field | Meaning |
|---|---|
| Aggregated event ID / count | What occurred how many times |