--- Timestamp: "%Timestamp%" Computer: "%Computer%" Channel: "%Channel%" Level: "%Level%" EventID: "%EventID%" MitreAttack: "%MitreTactics%" MitreTechnique: "%MitreTechniques%" Tags: "%OtherTags%" RecordID: "%RecordID%" RuleTitle: "%RuleTitle%" Details: "%Details%" RecordInformation: "%RecordInformation%" RuleFile: "%RuleFile%" EvtxFile: "%EvtxFile%"