20 lines
714 B
Plaintext
20 lines
714 B
Plaintext
alias,event_key
|
|
EventID,Event.System.EventID
|
|
Channel,Event.System.Channel
|
|
CommandLine,Event.EventData.CommandLine
|
|
ParentProcessName,Event.EventData.ParentProcessName
|
|
Signed,Event.EventData.Signed
|
|
ProcessName,Event.EventData.ProcessName
|
|
AccessMask,Event.EventData.AccessMask
|
|
TargetUserName,Event.EventData.TargetUserName
|
|
param1,Event.EventData.param1
|
|
param2,Event.EventData.param2
|
|
ServiceName,Event.EventData.ServiceName
|
|
ImagePath,Event.EventData.ImagePath
|
|
ContextInfo,Event.EventData.ContextInfo
|
|
Path,Event.EventData.Path
|
|
ScriptBlockText,Event.EventData.ScriptBlockText#Name
|
|
MemberName,Event.EventData.SubjectUserName
|
|
MemberSid,Event.EventData.SubjectUserSid
|
|
TargetSid,Event.EventData.TargetSid
|