--- Timestamp: "%Timestamp%" Computer: "%Computer%" Channel: "%Channel%" EventID: "%EventID%" Level: "%Level%" RecordID: "%RecordID%" RuleTitle: "%RuleTitle%" Details: "%Details%"