diff --git a/STIX_external_reference/readme.md b/STIX_external_reference/readme.md
index f61fbee..4a0d3fd 100644
--- a/STIX_external_reference/readme.md
+++ b/STIX_external_reference/readme.md
@@ -59,3 +59,8 @@
   "Computer": "DC01.contoso.local"
 }
 ```
+
+references:
+
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4608
+- [Event Logging Structures](https://docs.microsoft.com/en-us/windows/win32/eventlog/event-logging-structures?redirectedfrom=MSDN)