Collect Microsoft Windows Event data

Supported in:

Google SecOps SIEM

This document describes the deployment architecture, installation steps, and required configuration that produce logs supported by the Google Security Operations parser for Windows events. This document also includes information about how the parser maps fields in the original log to Google Security Operations Unified Data Model fields. For an overview of Google Security Operations data ingestion, see Data ingestion to Google Security Operations.

To ingest Windows event logs to Google Security Operations, you can use the BindPlane Agent or Google Cloud built-in ingestion. For more information regarding built-in ingestion, see Ingest Google Cloud data to Google Security Operations.

Information in this document applies to the parser with the WINEVTLOG ingestion label. The ingestion label identifies which parser normalizes raw log data to structured UDM format.

Before you begin

Review the recommended deployment architecture

If your deployment includes a Windows server on Google Cloud, then we recommend that you use Google Cloud built-in ingestion. Otherwise, you can use the BindPlane Agent.

Google Cloud built-in ingestion architecture

If the Windows events have the Provider value Microsoft-Windows-Security-Auditing, then the WINEVTLOG parser supports Google Cloud built-in ingestion.

Configure Ops Agent to ingest Microsoft Windows Event logs into Google Security Operations

1. Deploy a Windows server in Google Cloud.
2. Configure an Ops Agent on Windows Server.
3. Install the Cloud Logging agent on Windows Server.
4. Enable the following export filter in the Google Security Operations instance: (log_id("winevt.raw") OR log_id("windows_event_log")). For more information, see Ingest Google Cloud data to Google Security Operations.

Configure the BindPlane Agent to ingest Microsoft Windows Event logs into Google Security Operations

Collect the Windows Event logs by using the BindPlane Agent. After installation, the BindPlane Agent service appears as the observerIQ service in the list of Windows services.

1. Install and configure the Windows servers. For more information about configuring the Windows servers, see Configure Windows server overview.

2. Install the BindPlane Agent on the collector that is running on a Windows server. For more information about installing the BindPlane Agent, see the BindPlane Agent installation instructions.

3. Create a configuration file for the BindPlane agent with the following contents.

   receivers:
     windowseventlog/dfsn_serv:
         channel: Microsoft-Windows-DFSN-Server/Admin
         raw: true
     windowseventlog/operational:
         channel: Microsoft-Windows-Forwarding/Operational
         raw: true
     windowseventlog/source0__application:
         channel: application
         raw: true
     windowseventlog/source0__security:
         channel: security
         raw: true
     windowseventlog/source0__system:
         channel: system
         raw: true
   processors:
     batch:
   
   exporters:
     chronicle/winevtlog:
       endpoint: https://malachiteingestion-pa.googleapis.com
       creds: '{
       "type": "service_account",
       "project_id": "malachite-projectname",
       "private_key_id": `PRIVATE_KEY_ID`,
       "private_key": `PRIVATE_KEY`,
       "client_email":"`SERVICE_ACCOUNT_NAME`@malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "client_id": `CLIENT_ID`,
       "auth_uri": "https://accounts.google.com/o/oauth2/auth",
       "token_uri": "https://oauth2.googleapis.com/token",
       "auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs",
       "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/`SERVICSERVICE_ACCOUNT_NAME`%40malachite-`PROJECT_ID`.iam.gserviceaccount.com",
       "universe_domain": "googleapis.com"
       }'
     log_type: 'WINEVTLOG'
     override_log_type: false
     raw_log_field: body
     customer_id: `CUSTOMER_ID`
   
   service:
     pipelines:
       logs/winevtlog:
         receivers:
           - windowseventlog/source0__application
           - windowseventlog/source0__security
           - windowseventlog/source0__system
           - windowseventlog/dfsn_serv
           - windowseventlog/operational
       processors: [batch]
       exporters: [chronicle/winevtlog]
   

4. Replace the PRIVATE_KEY_ID, PRIVATE_KEY SERVICSERVICE_ACCOUNT_NAME,PROJECT_ID, CLIENT_ID and CUSTOMER_ID with the respective values from the service account JSON file which you can download from Google Cloud Platform. For more information about service account keys, see Create and delete service account keys documentation.

5. To start the observerIQ agent service, select Services > Extended > observerIQ Service > start.

NXLog forwarder ingestion deployment architecture

This diagram illustrates the recommended foundational components in a deployment architecture to collect and send Microsoft Windows Event data to Google Security Operations. Compare this information with your environment to be sure these components are installed. Each customer deployment will differ from this representation and may be more complex. The following is required:

• Systems in the deployment architecture are configured with the UTC time zone.
• NXLog is installed on the collector Microsoft Windows server.
• The collector Microsoft Windows server receives logs from servers, endpoints, and domain controllers.
• Microsoft Windows systems in the deployment architecture use.
  • Source Initiated Subscriptions to collect events across multiple devices.
  • WinRM service is enabled for remote system management.
• NXLog is installed on the collector Window server to forward logs to Google Security Operations forwarder.

• Google Security Operations forwarder is installed on the collector Microsoft Windows or Linux server.

  Note: If you choose to deploy the Google Security Operations Linux forwarder, the central Linux server and collector Microsoft Windows server will be different systems. If you choose to deploy the Google Security Operations forwarder for Microsoft Windows, the central Microsoft Windows server and collector Microsoft Windows server can be the same system.

  

Review the supported devices and versions

The Google Security Operations parser supports logs from the following Microsoft Windows server versions. Microsoft Windows server is released with the following editions: Foundation, Essentials, Standard, and Datacenter. The event schema of logs generated by each edition do not differ.

• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012

Google Security Operations parser supports logs from Microsoft Windows 10 and higher client systems.

Google Security Operations parser supports logs collected by NXLog Community or Enterprise Edition.

Review the supported log types

The Google Security Operations parser supports the following log types generated by Microsoft Windows systems. For more information about these log types, see the Microsoft Windows Event Log documentation. It supports logs generated with English language text and is not supported with logs generated in non-English languages.

Log Type	Notes
Security	Security audit and event logs.
Application	Events logged by applications or programs. If the manifest isn't installed locally, application logs will have missing / hex values.
System	Events logged by Microsoft Windows system components.

Configure the Microsoft Windows servers, endpoints, and domain controllers

1. Install and configure the servers, endpoints, and domain controllers.
2. Configure all systems with the UTC time zone.
3. Configure devices to forward logs to a collector Microsoft Windows server.
4. Configure a Source Initiated Subscription on Microsoft Windows server (Collector). For information, see Setting up a Source Initiated Subscription.
5. Enable WinRM on Microsoft Windows servers and clients. For information, see Installation and configuration for Microsoft Windows Remote Management.

Configure the Microsoft Windows collector server

Set up a collector Microsoft Windows server to collect from systems.

1. Configure the system with the UTC time zone.
2. Install NXLog. Follow the NXLog documentation.

3. Create a configuration file for NXLog. Use im_msvistalog input module for Microsoft Windows server security channel logs. Replace <hostname> and <port> values with information about the central Microsoft Windows or Linux server. See the NXLog documentation for information about the om_tcp module.

     define ROOT     C:\Program Files (x86)\nxlog
     define WINEVTLOG_OUTPUT_DESTINATION_ADDRESS <hostname>
     define WINEVTLOG_OUTPUT_DESTINATION_PORT <port>
     define CERTDIR  %ROOT%\cert
     define CONFDIR  %ROOT%\conf
     define LOGDIR   %ROOT%\data
     define LOGFILE  %LOGDIR%\nxlog.log
     LogFile %LOGFILE%
     Moduledir %ROOT%\modules
     CacheDir  %ROOT%\data
     Pidfile   %ROOT%\data\nxlog.pid
     SpoolDir  %ROOT%\data
     <Extension _json>
         Module      xm_json
     </Extension>
     <Input windows_security_eventlog>
         Module  im_msvistalog
         <QueryXML>
             <QueryList>
                 <Query Id="0">
                     <Select Path="Application">*</Select>
                     <Select Path="System">*</Select>
                     <Select Path="Security">*</Select>
                 </Query>
             </QueryList>
         </QueryXML>
         ReadFromLast  False
         SavePos  False
     </Input>
     <Output out_chronicle_windevents>
         Module      om_tcp
         Host        %WINEVTLOG_OUTPUT_DESTINATION_ADDRESS%
         Port        %WINEVTLOG_OUTPUT_DESTINATION_PORT%
         Exec        $EventTime = integer($EventTime) / 1000;
         Exec        $EventReceivedTime = integer($EventReceivedTime) / 1000;
         Exec        to_json();
     </Output>
     <Route r2>
         Path    windows_security_eventlog => out_chronicle_windevents
     </Route>
   

4. Start the NXLog service.

Configure the central Microsoft Windows or Linux server

See the Installing and configuring the forwarder on Linux or Installing and configuring the forwarder on Microsoft Windows for information about installing and configuring the forwarder.

1. Configure the system with the UTC time zone.
2. Install the Google Security Operations forwarder on the central Microsoft Windows or Linux server.

3. Configure the Google Security Operations forwarder to send logs to Google Security Operations. Here is an example forwarder configuration.

     - syslog:
         common:
           enabled: true
           data_type: WINEVTLOG
           batch_n_seconds: 10
           batch_n_bytes: 1048576
         tcp_address: 0.0.0.0:10518
         connection_timeout_sec: 60
   

Field mapping reference: Common device event fields to UDM fields

Deprecated:

The following labels fields for UDM nouns are deprecated: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels, and target.labels. For existing parsers, in addition to these UDM fields, the logs fields are also mapped to key/value additional.fields UDM fields. For new parsers, the key/value settings in additional.fields UDM fields are used instead of the deprecated labels UDM fields. We recommend that you update the existing rules to use the key/value settings in the additional.fields UDM fields instead of the deprecated labels UDM fields.

The following fields are common across multiple Event IDs and are mapped the same way.

Note: The % values (e.g. %1, %2, %3, %{Category}) are variable placeholders.

NXLog field	UDM field
EventTime	metadata.event_timestamp
Hostname	principal.hostname	principal.asset.hostname
EventID	product_event_type is set to "%{EventID}" security_result.rule_name is set to "EventID: %{EventID}"
SourceName	metadata.product_name is set to "%25%7BSourceName}" metadata.vendor_name is set to "Microsoft"
Category	about.labels.key/value additional.fields.key additional.fields.value.string_value
Channel	about.labels.key/value additional.fields.key additional.fields.value.string_value
Severity	Values mapped to security_result.severity field as follows: Original value 0 (None), is set to UNKNOWN_SEVERITY Original value 1 (Critical) is set to INFORMATIONAL Original value 2 (Error) is set to ERROR Original value 3 (Warning) is set to ERROR Original value 4 (Informational) is set to INFORMATIONAL Original value 5 (Verbose) is set to INFORMATIONAL
UserID	principal.user.windows_sid
ExecutionProcessID	principal.process.pid
ProcessID	principal.process.pid
ProviderGuid	metadata.product_deployment_id
RecordNumber	metadata.product_log_id
SourceModuleName	observer.labels.key/value additional.fields.key additional.fields.value.string_value
SourceModuleType	observer.application
Opcode	about.labels.key/value additional.fields.key additional.fields.value.string_value
Keywords	additional.fields.key additional.fields.value.string_value
ActivityID	security_result.detection_fields.key/value

Field mapping reference: device event field to UDM field by EventID

The following section describes how NXlog/EventViewer fields are mapped to UDM fields. Data may be mapped differently for different Microsoft Windows Event IDs.

The section heading identifies the Event Id, plus version (e.g. version 0) and operatiing system (e.g. Microsoft Windows 10 client) if applicable. There may be more than one section for an Event ID when the map for a specific version or operating system is different.

Note: The % values (e.g. %1, %2, %3, %{Category}) are variable placeholders.

Event ID 0

Provider: Directory Synchronization

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.summary

Provider: gupdate

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: hcmon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target_resource_name set to target.resource.name

Provider: edgeupdate

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Event ID 1

Provider: Microsoft-Windows-FilterManager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

version 0 / Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

version 1 / Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Reason	Data/Reason	security_result.description
ProcessName	Data/ProcessName	principal.process.command_line
ProcessID	Data/ProcessID	principal.process.pid

Provider: Microsoft-Windows-Sysmon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = PROCESS_LAUNCH If EventLevelName contains "Information" then security_result.severity = INFORMATIONAL
EventData.Hashes		Based on Hash algorithm. MD5 set to target.process.file.md5 SHA256 set to target.process.file.sha256 SHA1 set to target.process.file.sha1
EventData.User		Domain set to principal.administrative_domain Username set to principal.user.userid
Description		metadata.description
CommandLine		target.process.command_line
Image		target.process.file.full_path
ParentCommandLine		target.process.parent_process.command_line
ParentImage		target.process.parent_process.file.full_path
ParentProcessId		target.process.parent_process.pid
ProcessId		target.process.pid
EventOriginId		target.process.product_specific_process_id set to "sysmon:%{EventOriginId}"

Provider: SecurityCenter

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
SourceName	Not available	target.application

Provider: telegraf

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data		security_result.description

Provider: WudfUsbccidDriver

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Context	Data/Context	security_result.description

Event ID 2

Provider: MEIx64

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to security_result.summary

Provider: SecurityCenter

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
SourceName	Not available	target.application

Provider: vmci

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to security_result.summary

Provider: Microsoft-Windows-WHEA-Logger

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 3

version 3 / Provider: Microsoft-Windows-Power-Troubleshooter

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_STARTUP
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
SleepTime	Data/SleepTime	target.resource.attribute.labels.key target.resource.attribute.labels.value
WakeTime	Data/WakeTime	target.resource.attribute.labels.key target.resource.attribute.labels.value
WakeSourceType	Data/WakeSourceType	target.resource.attribute.labels.key target.resource.attribute.labels.value
WakeSourceText	Data/WakeSourceText	target.resource.attribute.labels.key target.resource.attribute.labels.value

Provider: Microsoft-Windows-Security-Kerberos

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
File		target.file.full_path

Provider: Virtual Disk Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Provider: vmci

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
jobTitle		target.resource.name
processPath		target.process.file.full_path

Event ID 4

Provider: Microsoft-Windows-Security-Kerberos

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Server		target.hostname

Provider: Virtual Disk Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
name		target.resource.name
Id		target.resource.product_object_id
url		target.url
fileLength		target.file.size

Event ID 5

Provider: iScsiPrt

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to security_result.summary

Provider: McAfee Service Controller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Provider: Microsoft-Windows-Search-ProfileNotify

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_MODIFICATION
SourceName		target.application
User	Data/User	target.user.userid

Event ID 6

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode		security_result.summary Format: %{ErrorCode}-%{ErrorMsg}
ErrorMsg		security_result.summary Format: %{ErrorCode}-%{ErrorMsg}
Context		target.application

Provider: Microsoft-Windows-FilterManager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: WudfUsbccidDriver

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 7

Provider: AdmPwd

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.summary Format: "Error: %{Data}"

Provider: WudfUsbccidDriver

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 8

Provider: CylanceSvc

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Provider: WSH

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data_1		principal.labels.key/value additional.fields.key additional.fields.value.string_value
Data_2		principal.labels.key/value additional.fields.key additional.fields.value.string_value
Data_3		principal.process.command_line
Message		metadata.description

Event ID 9

Provider: volsnap

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
VolumeName		target.file.full_path

Event ID 10

Provider: WudfUsbccidDriver

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 11

Provider: Microsoft-Windows-Hyper-V-Netvsc

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
MiniportName		target.resource.name
AccountType		principal.user.attribute.roles.name

Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: WudfUsbccidDriver

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary is set to "ErrorCode: %{Error}"

Provider: Microsoft-Windows-Wininit

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 12

Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_STARTUP
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Provider: Microsoft-Windows-Sysmon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = REGISTRY_CREATION If EventLevelName =~ "Information" then security_result.severity = INFORMATIONAL
EventOriginId		target.process.product_specific_process_id set to "sysmon: %{EventOriginId}"
EventData/EventType		target.registry.registry_key
EventData/TargetObject		target.registry.registry_value_name
ProcessId		principal.process.pid

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-UserModePowerService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ProcessPath		target.process.file.full_path
NewSchemeGuid		target.resource.product_object_id

Provider: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 13

Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_SHUTDOWN

Provider: Microsoft-Windows-Sysmon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = REGISTRY_MODIFICATION If EventLevelName =~ "Information" then security_result.severity = INFORMATIONAL
ProcessId		principal.process.pid
EventOriginId		target.process.product_specific_process_id set to "sysmon: %{EventOriginId}"
EventData/EventType		target.registry.registry_key
EventData/Details		target.registry.registry_value_data

Provider: Microsoft-Windows-CertificateServicesClient-CertEnroll

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain		principal.administrative_domain
AccountName		principal.user.userid
AccountType		principal.user.attribute.roles.name
Message		metadata.description
UserID		principal.user.windows_sid
CA		about.labels.key/value additional.fields.key additional.fields.value.string_value
ErrorCode		security_result.summary Format: security_result.summary is set to %{error_code} - %{error_message}

Provider: NPS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data		target.ip

Event ID 14

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
ClientName		principal.asset.attribute.labels.key/value
Target		target.application
Account		target.hostname

Provider: Microsoft-Windows-Wininit

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Error	Data/Error	security_result.description Format: Error - %{value}

Provider:TPM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
UserID	Security/UseID	principal.user.windows_sid

Event ID 15

Provider: Disk

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_hostname set to target.hostname

Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = REGISTRY_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
NewSize	Data/NewSize	target.file.size
HiveName	Data/HiveName	target.registry.registry_key
AccountType		principal.user.attribute.roles.name

Provider: SecurityCenter

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Provider:TPM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
UserID	Security/UseID	principal.user.windows_sid

Event ID 16

Provider: Microsoft-Windows-HAL

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
ClientName		principal.asset.attribute.labels.key/value
Target		target.application
Account		target.hostname

Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = REGISTRY_MODIFICATION
Domain	System/Domain	principal.administrative_domain
ProcessID	System/ProcessID	principal.process.pid
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
HiveName	Data/HiveName	target.registry.registry_key
AccountType		principal.user.attribute.roles.name

Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to metadata.description
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

version 0 / Provider: Microsoft-Windows-HAL

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 17

Provider: Microsoft-Windows-WHEA-Logger

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Category set to security_result.category_details Message set to metadata.description
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 18

Provider: BTHUSB

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: TPM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 19

version 0 / Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Category	Data/Category	security_result.category_details

Provider: Intel-SST-OED

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
Category		security_result.summary

Provider: Microsoft-Windows-WHEA-Logger

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Event ID 20

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
updateRevisionNumber		target.resource.attribute.labels.key target.resource.attribute.labels.value
updateTitle		target.resource.name
updateGuid		target.resource.product_object_id

Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 21

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Event ID 22

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Category set to security_result.category_details Message set to metadata.description
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
updatelist		security_result.description

Provider: Microsoft-Windows-UserModePowerService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 23

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 24

Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

version 0 / Provider: Microsoft-Windows-Kernel-General

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ErrorMessage	Data/ErrorMessage	security_result.description
DomainPeer	Data/DomainPeer	target.administrative_domain

Provider:TPM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
UserID	Security/UseID	principal.user.windows_sid

Event ID 25

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 26

Provider: Application Popup

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Caption		security_result.summary

Provider: Microsoft-Windows-CertificationAuthority

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.application = "Active Directory Certificate Services"
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
DCName	Data/DCName	target.administrative_domain
CACommonName	Data/CACommonName	target.user.userid

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Target		target.hostname
Name		target.user.userid

Event ID 27

version 0 / Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}
NewLogFilePath	Data/NewLogFilePath	target.file.full_path

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to metadata.description
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 28

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to metadata.description
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 29

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Event ID 30

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 31

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Event ID 32

Provider: e1iexpress

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to security_result.summary

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 33

Provider: volsnap

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_UNCATEGORIZED
VolumeName		target.file.full_path
DeviceName		target.resource.name

Event ID 34

Provider: Oracle.xstore

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_READ
DBID		additional.fields.key/value
ProcessId		principal.process.pid
SourceName		principal.application
DATABASE_USER		principal.user.uerid
ACTION		target.process.command_line

Event ID 35

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: NPS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Message		Ip set to target.ip

Event ID 37

Provider: Microsoft-Windows-Kerberos-Key-Distribution-Center

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
ClientName		principal.asset.attribute.labels.key/value
ServerName		target.hostname

Provider: Microsoft-Windows-Kernel-Processor-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Number	Data/Number	target.resource.attribute.labels.key target.resource.attribute.labels.value
CapDurationInSeconds	Data/CapDurationInSeconds	target.resource.attribute.labels.key target.resource.attribute.labels.value

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 38

Provider: Microsoft-Windows-CertificationAuthority

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP target.application = "Active Directory Certificate Services"
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
CACommonName	Data/CACommonName	target.user.userid

Event ID 40

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Event ID 42

version 0 Windows 10 client / Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

version 2 Windows 10 client /

NXLog field	Event Viewer field	UDM field
Reason	Data/Reason	security_result.description

Event ID 43

Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
updateRevisionNumber	Data/updateRevisionNumber	target.resource.attribute.labels.key target.resource.attribute.labels.value
updateTitle	Data/updateTitle	target.resource.name
updateGuid	Data/updateGuid	target.resource.product_object_id

Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 44

version 0 Windows 10 client / Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
AccountType		principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
Category	Data/Category	security_result.category_details

Event ID 45

Provider: Symantec AntiVirus

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
Data		security_result.summary

Event ID 47

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorMessage		security_result.description
ManualPeer		target.ip

Provider: Microsoft-Windows-WHEA-Logger

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 49

Provider: Microsoft-Windows-Hyper-V-Netvsc

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Status	Data/Status	security_result.summary

Event ID 50

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Ntfs

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 51

Provider: Disk

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_hostname set to target.hostname

Event ID 55

version 0 Windows 10 client / Provider: Microsoft-Windows-Kernel-Processor-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Ntfs

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name
Outcome		security_result.summary

Event ID 57

Provider: hpqilo3

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 58

Provider: partmgr

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to metadata.description

Provider: volsnap

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to metadata.description

Event ID 59

Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
name		target.resource.name
Id		target.resource.product_object_id
url		target.url
fileLength		target.file.size

Event ID 60

Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
name		target.resource.name
url		target.url
fileLength		target.file.size

Event ID 61

Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
name		target.resource.name
Id		target.resource.product_object_id
url		target.url
fileLength		target.file.size

Event ID 64

Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Context		target.application

Event ID 75

Provider: Microsoft-Windows-CertificationAuthority

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application set to "Active Directory Certificate Services"
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
ErrorMessageText		security_result.summary

Event ID 77

Provider: Microsoft-Windows-CertificationAuthority

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application set to "Active Directory Certificate Services"
WarningMessage		security_result.description
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 80

Provider: ocz10xx

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data		target.hostname

Event ID 81

Provider: hpqilo2

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-FailoverClustering-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid

Event ID 98

Provider: Microsoft-Windows-Ntfs

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  STATUS_HEARTBEAT
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
DeviceName	Data/DeviceName	principal.hostname
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 100

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_ENABLE target.resource.resource_type = TASK
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
TaskName	Data/TaskName	target.resource.name
InstanceId	Data/InstanceId	target.resource.product_object_id
UserContext		target.user.user_display_name

Provider: Microsoft-Windows-EnhancedStorage-EhStorTcgDrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 101

Provider: Application Management Group Policy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED security_result.description" set to "ErrorCode - %{error_code}"
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 102

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Message		Extract PID and map it to UDM field target.process.pid

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ProcessID	Data/ProcessID	principal.process.pid
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
AccountType	System/AccountType	principal.user.attribute.roles.description
TaskName	Data/TaskName	target.resource.name
InstanceId	Data/InstanceId	target.resource.product_object_id

Event ID 103

Provider: Application Management Group Policy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED security_result.description" set to "ErrorCode - %{error_code}"
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Message	System/Message	Extract PID and map it to UDM field target.process.pid

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Reason	Data/Reason	security_result.description

Provider: ocz10xx

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data		target.hostname

Event ID 104

Windows 10 client / Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_WIPE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
Message		metadata.description
UserID	System/UserID	principal.user.windows_sid

Windows Server 2019 /

NXLog field	Event Viewer field	UDM field
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-Forwarding

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
UserID	System/UserID	principal.user.windows_sid
SubscriptionManagerAddress	Data/SubscriptionManagerAddress	target.url

Provider: WudfUsbccidDriver

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 105

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Channel	Data/Channel	security_result.description
BackupPath	Data/BackupPath	target.file.full_path

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid

Provider: VMTools

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
SourceName	Not available	target.application

Provider: WudfUsbccidDriver

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 106

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 107

version 0 Windows 10 client / Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_ENABLE target.resource.resource_type = TASK
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
TaskName	Data/TaskName	target.resource.name
InstanceId	Data/InstanceId	target.resource.product_object_id

Event ID 108

Provider: Application Management Group Policy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED security_result.description" set to "ErrorCode - %{error_code}"
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: VMTools

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
SourceName	Not available	target.application

Event ID 109

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ProcessID	Data/ProcessID	principal.process.pid
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_SHUTDOWN
ShutdownReason	Data/ShutdownReason	security_result.description

Event ID 110

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 111

version 0/ Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

version 0/ Provider: Microsoft-Windows-AppReadiness

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Result	Data/Result	security_result.summary

Event ID 112

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 115

Provider: Directory Synchronization

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.summary

Event ID 129

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_ENABLE target.resource.resource_type = TASK
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
Priority	Data/Priority	security_result.priority_details
Path	Data/Path	target.process.file.full_path
ProcessID	Data/ProcessID	target.process.pid
TaskName	Data/TaskName	target.resource.name

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorMessage	Data/ErrorMessage	security_result.description

Event ID 130

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ErrorMessage	Data/ErrorMessage	security_result.description
DomainPeer	Data/DomainPeer	target.administrative_domain

Event ID 131

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorMessage	Data/ErrorMessage	security_result.description
DomainPeer	Data/DomainPeer	target.administrative_domain

Event ID 132

Provider: Microsoft-Windows-WinRM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain		principal.administrative_domain
AccountName		principal.user.userid
AccountType		principal.user.attribute.roles.name

Event ID 134

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorMessage	Data/ErrorMessage	security_result.description
DomainPeer	Data/DomainPeer	target.administrative_domain

Event ID 137

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Ntfs

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 138

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
DomainPeer	Data/DomainPeer	target.administrative_domain

Event ID 139

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 140

Provider: Microsoft-Windows-Ntfs

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
DeviceName		principal.hostname
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_MODIFICATION target.resource.resource_type = TASK
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
TaskName	Data/TaskName	target.resource.name
UserName	Data/UserName	target.user..user_display_name

Event ID 142

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED Message set to security_result.summary
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-WinRM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
errorCode		security_result.summary
Domain		principal.administrative_domain
AccountName		principal.user.userid
AccountType		principal.user.attribute.roles.name

Event ID 143

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 145

Provider: Microsoft-Windows-WinRM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
resourceUrl		target.url
AccountName		principal.user.userid
AccountType		principal.user.attribute.roles.name
Domain		principal.administrative_domain

Event ID 146

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED Message set to security_result.summary
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 153

Provider: Disk

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 156

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 157

Provider: disk

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 158

Provider: Disk

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary target_url set to target.url

Provider: Microsoft-Windows-Time-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
TimeProvider		target.resource.name

Event ID 159

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 160

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 161

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Event ID 163

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 164

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 165

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 167

Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 169

Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Status	Data/Status	security_result.summary

Event ID 170

Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 171

version 0 / Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Version	Data/Version/	principal.asset.software.version

Event ID 172

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Reason	Data/Reason	security_result.description
AccountType		principal.user.attribute.roles.name

Event ID 173

Provider: Microsoft-Windows-Hyper-V-Hypervisor

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Event ID 181

version 0 / Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = status_update
Status	Data/Status	security_result.summary

Event ID 185

version 0 / Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Status	Data/Status	security_result.summary

Event ID 187

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ApiCallerName		principal.process.file.full_path

Event ID 195

Provider: Microsoft-Windows-USB-USBHUB3

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 196

Provider: Microsoft-Windows-USB-USBHUB3

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 200

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_ENABLE target.resource.resource_type = TASK
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
TaskName	Data/TaskName	target.resource.name
TaskInstanceId	Data/TaskInstanceId	target.resource.product_object_id

Event ID 201

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
TaskName	Data/TaskName	target.resource.name
TaskInstanceId	Data/TaskInstanceId	target.resource.product_object_id

Event ID 202

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 203

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 204

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Security-Kerberos

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Event ID 205

version 0 Windows Server 2019 / Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

version 1 / Windows 10 client /

NXLog field	Event Viewer field	UDM field
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
DomainName	Data/DomainName	target.administrative_domain

version 2 / Windows 10 client /

NXLog field	Event Viewer field	UDM field
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
DomainName	Data/DomainName	target.administrative_domain

Event ID 216

version 1 / Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 219

Provider: Microsoft-Windows-Kernel-PnP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
DriverName		target.hostname
FailureName		target.resource.name

Event ID 218

version 0 / Provider: Microsoft-Windows-WindowsUpdateClient

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 221

version 0 / Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 225

Provider: Microsoft-Windows-Kernel-PnP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
DeviceInstance		target.hostname
ProcessName		target.process.file.full_path

version 0 / Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 233

Provider: Microsoft-Windows-Hyper-V-VmSwitch

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid

Event ID 231

version 0 / Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Code	Data/Code	security_result.summary set to "Code - %{Code}"

Event ID 234

Provider: Microsoft-Windows-Hyper-V-VmSwitch

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid

Event ID 238

Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain	System/Domain	principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

version 0 / Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

version 1 / Provider: Microsoft-Windows-Kernel-Boot

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 258

Provider: VMUpgradeHelper

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceName	Not available	target.application

Event ID 260

Provider: VMUpgradeHelper

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceName	Not available	target.application

Event ID 263

version 0 / Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 271

Provider: VMUpgradeHelper

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceName	Not available	target.application

Event ID 272

Provider: VMUpgradeHelper

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceName	Not available	target.application

Event ID 299

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 300

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. Extract PID and map it to  target.process.pid

Event ID 301

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. Extract PID and map it to  target.process.pid

Event ID 302

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. Extract PID and map it to  target.process.pid

Event ID 304

version 0 / Provider: Microsoft-Windows-Ntfs

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Status	Data/Status	security_result.summary

Event ID 313

version 0 / Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ErrorCode	Data/ErrorCode	security_result.summary is set to "ErrorCode: %{ErrorCode}"

Event ID 325

Provider: ESENT

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. Extract PID and map it target.process.pid

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
QueuedTaskInstanceId		target.resource.product_object_id
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description

Event ID 326

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. Extract PID and map it to  target.process.pid

Event ID 400

Provider: PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data_2		Extract HostName from Data_2 HostName is set to target.hostname

version 1 /Provider: PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
NewEngineState		additional.fields.key additional.fields.value.string_value
PreviousEngineState		additional.fields.key additional.fields.value.string_value
HostName		additional.fields.key additional.fields.value.string_value
HostVersion		additional.fields.key additional.fields.value.string_value
HostId		additional.fields.key additional.fields.value.string_value
HostApplication		principal.process.command_line
EngineVersion		additional.fields.key additional.fields.value.string_value
RunspaceId		additional.fields.key additional.fields.value.string_value
PipelineId		additional.fields.key additional.fields.value.string_value
CommandName		additional.fields.key additional.fields.value.string_value
CommandType		additional.fields.key additional.fields.value.string_value
ScriptName		target.file.name
CommandPath		target.process.file.full_path
NewEngineState		target.process.command_line

Event ID 403

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data_9		network.http.user_agent
Domain	System/Domain	principal.administrative_domain
Data_8		principal.ip
Data_7		principal.port
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Data_3		target.ip
Data_5		target.url

Event ID 404

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Data_3		security_description set to %{Data_3}: %{Data_4}
Data_4		security_description set to %{Data_3}: %{Data_4}

Event ID 405

Provider: ADSync

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		principal.administrative_domain
Data_1		principal.user.userid

Event ID 410

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data_4		network.http.user_agent
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Data_10		target.ip
Data_8		target.url

Event ID 412

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 424

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE client_certificate_serial set to network.tls.client.certificate.serial client_certificate_subject set to network.tls.client.certificate.subject
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 500

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 501

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 506

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.description
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid

Event ID 507

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE reason_description set to security_result.description
Domain	System/Domain	principal.administrative_domain
Reason		security_result.description
AccountName	System/AccountName	principal.user.userid

version 10 / Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Reason	Data/Reason	security_result.description

Event ID 508

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. Extract PID and map it to  target.process.pid

Event ID 510

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data_1		Data_1.Host set to target.hostname Data_1.User-Agent set to network.http.user_agent Data_1.X-MS-Endpoint-Absolute-Path set to target.url
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 517

Provider: Microsoft-Windows-DFSN-Server

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
UserID		principal.user.windows_sid
DfsNamespace		target.resource.name

Event ID 521

Provider: Security

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 529

Provider: Security

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action = BLOCK security_result.category = AUTH_VIOLATION
LogonType	Not available	extensions.auth.mechanism
Message	Not available	username set to target.user.userid domain set to target.administrative_domain target_workstation set to target.hostname

Event ID 566

Provider: Microsoft-Windows-Kernel-Power

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Reason	Data/Reason	security_result.description

Event ID 600

Provider: PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Category		metadata.description
SourceName		principal.application
HostApplication		target.file.full_path
ProviderName		target.resource.name

Event ID 601

Provider: Directory Synchronization

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. metadata.description = Attempt to install a service
SubjectUserName		principal.user.userid
Summary		security_result.summary
ServiceName		target.process.command_line
ServiceFileName		target.process.file.full_path

Event ID 642

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE. Extract PID map it to target.process.pid

Event ID 653

Provider: Directory Synchronization

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.summary

Event ID 654

Provider: Directory Synchronization

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.summary

Event ID 663

Provider: Directory Synchronization

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.summary

Event ID 700

Provider: NTDS ISAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
MessageSourceAddress		principal.ip

Event ID 701

Provider: NTDS ISAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
MessageSourceAddress		principal.ip

Event ID 719

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
Category	Data/Category	security_result.category_details

Event ID 781

Provider: Microsoft-Windows-Complus

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	target.registry.registry_key

Event ID 800

Provider: PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE metadata.description set to "Pipeline execution" security_result.summary set to "Pipeline execution details for command line"
SourceName		principal.application
UserId		principal.user.userid
HostApplication		principal.process.command_line
DetailSequence		additional.fields.key additional.fields.value.string_value
DetailTotal		additional.fields.key additional.fields.value.string_value
SequenceNumber		additional.fields.key additional.fields.value.string_value
HostName		additional.fields.key additional.fields.value.string_value
HostVersion		additional.fields.key additional.fields.value.string_value
HostId		additional.fields.key additional.fields.value.string_value
EngineVersion		additional.fields.key additional.fields.value.string_value
RunspaceId		additional.fields.key additional.fields.value.string_value
PipelineId		additional.fields.key additional.fields.value.string_value
ScriptName		target.file.full_path
CommandLine		target.process.command_line
Details		additional.fields.key additional.fields.value.string_value

Event ID 888

Provider: top_5

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 900

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = SERVICE_START target.application = "Software Protection"

Event ID 902

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = SERVICE_START target.application = "Software Protection"

Event ID 903

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = SERVICE_STOP target.application = "Software Protection"

Event ID 904

Provider: Directory Synchronization

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.summary

Event ID 1000

Provider: Microsoft-Windows-SCPNP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ReaderName	Data/ReaderName	target.resource.name
ErrorCode	Data/ErrorCode	security_result.summary is set to "ErrorCode: %{ErrorCode}"

Provider: Microsoft-Windows-LoadPerf

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AccountName		principal.user.attribute.roles.name
AccountType		principal.user.attribute.roles.description
UserID		principal.user.windows_sid

Event ID 1001

Provider: Microsoft Antimalware

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED target_resource_product_object_id set to target.resource.product_object_id

Provider: Microsoft-Windows-WER-SystemErrorReporting

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
param2		target.file.full_path

Provider: SNMP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to security_result.summary

Provider: Windows Error Reporting

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-LoadPerf

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AccountName		principal.user.attribute.roles.name
AccountType		principal.user.attribute.roles.description
UserID		principal.user.windows_sid

Event ID 1003

Provider: Microsoft-Windows-Search

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
Category	Data/Category	target.application

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1004

Provider: IPMIDRV

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data		target.hostname

Provider: Microsoft-Windows-Search

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_MODIFICATION
Reason	Data/Reason	security_result.description
Category	Data/Category	target.application

Provider: SNMP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: TdIca

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_ip set to target.ip target_port set to target_port

Event ID 1005

Provider: Microsoft-Windows-Search

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_MODIFICATION
Category	Data/Category	target.application

Event ID 1007

Provider: TdIca

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_ip set to target.ip target_port set to target_port

Event ID 1008

Provider: Microsoft-Windows-Perflib

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
EventXML.param1		target.application
EventXML.param2		target.file.full_path

Provider: Microsoft-Windows-Search

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
Reason	Data/Reason	security_result.description
Category	Data/Category	target.application

Event ID 1010

Provider: Microsoft-Windows-Search

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_MODIFICATION
Category	Data/Category	target.application

Event ID 1013

Provider: Microsoft-Windows-Search

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
Category	Data/Category	target.application

Event ID 1014

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_DNS network.ip_protocol is set to "DNS"
QueryName		network.dns.questions.name

Event ID 1016

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 1023

Provider: Microsoft-Windows-Perflib

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Library	Data/Library	target.file.full_path

Event ID 1025

Provider: Microsoft-Windows-TPM-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1026

Provider: Microsoft-Windows-TPM-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ErrorCode	Data/ErrorCode	security_result.summary is set to "ErrorCode: %{ErrorCode}

Event ID 1027

Provider: Microsoft-Windows-TPM-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1030

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription		security_result.description
ErrorCode		security_result.summary Format: ErrorCode - %{ErrorCode}
DCName		target.administrative_domain

Provider: Microsoft-Windows-Kernel-PnP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Device	Data/Device	target.hostname

Event ID 1031

Provider: Microsoft-Windows-Kernel-PnP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Device	Data/Device	target.hostname

Event ID 1033

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Extract product_name and map to target.application
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 1034

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 1037

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1040

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Extract process_id and map it to target.process.pid
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 1042

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Extract process_id and map it to target.process.pid
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 1053

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription	Data/ErrorDescription	security_result.description

Event ID 1054

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription	Data/ErrorDescription	security_result.description

Event ID 1055

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription	Data/ErrorDescription	security_result.description
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{ErrorCode}

Event ID 1056

Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE server_certificate_subject set to network.tls.server.certificate.subject

Event ID 1057

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target.resource_resource_type = DATABASE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 1058

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription	Data/ErrorDescription	security_result.description
DCName	Data/DCName	target.administrative_domain
FilePath	Data/FilePath	target.file.full_path

Event ID 1064

Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.summary

Event ID 1066

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 1067

Provider: Microsoft-Windows-TerminalServices-RemoteConnectionManager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1068

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
DCName	EventData.DCName	target.administrative_domain
SupportInfo1		additional.fields.key additional.fields.value.string_value
SupportInfo2		additional.fields.key additional.fields.value.string_value
ProcessingMode		additional.fields.key additional.fields.value.string_value
ProcessingTimeInMilliseconds		additional.fields.key additional.fields.value.string_value

Event ID 1069

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ResourceGroup		target.group.group_display_name
ResourceName		target.resource.name

Event ID 1073

Provider: User32

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_SHUTDOWN
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param1	Data/param1	target.hostname
param2	Data/param2	target.user.userid

Event ID 1074

Provider: User32

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_SHUTDOWN

Provider: USER32

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_SHUTDOWN target_process_file_full_path set to target.process.file.full_path target_hostname set to target.hostname

Provider: User32

NXLog field	Event Viewer field	UDM field
Domain		principal.administrative_domain

Provider: USER32

NXLog field	Event Viewer field	UDM field
Domain	System/Domain	principal.administrative_domain

Provider: User32

NXLog field	Event Viewer field	UDM field
param2	Data/param2	principal.hostname
param4	Data/param4	additional.fields.key additional.fields.value.string_value
param5	Data/param5	additional.fields.key additional.fields.value.string_value
param1	Data/param1	principal.process.file.full_path
AccountName		principal.user.attribute.roles.name
AccountType		principal.user.attribute.roles.name

Provider: USER32

NXLog field	Event Viewer field	UDM field
AccountName	System/AccountName	principal.user.userid

Provider: User32

NXLog field	Event Viewer field	UDM field
UserID		principal.user.windows_sid
param3	Data/param3	security_result.description
param7	Data/param7	target.user.userid

Event ID 1076

Provider: User32

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 1085

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription	Data/ErrorDescription	security_result.description
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
DCName	Data/DCName	target.administrative_domain

Event ID 1096

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode		security_result.summary Format: ErrorCode - %{ErrorCode}
ErrorDescription		security_result.description
SupportInfo1		additional.fields.key additional.fields.value.string_value
SupportInfo2		additional.fields.key additional.fields.value.string_value
ProcessingMode		additional.fields.key additional.fields.value.string_value
ProcessingTimeInMilliseconds		additional.fields.key additional.fields.value.string_value
DCName		target.administrative_domain
FilePath		principal.process.file.full_path

Event ID 1100

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP target.application = "Event Logging Service"
	Message	security_result.description

Event ID 1101

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1102

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_ip set to  target.ip target_url set to target.url client_certificate_serial set to network.tls.client.certificate.serial client_certificate_subject set to network.tls.client.certificate.subject
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: DFS Replication

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_WIPE
	SubjectDomainName	principal.administrative_domain
	SubjectUserName	principal.user.userid
	SubjectUserSid	principal.user.windows_sid

Event ID 1103

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1104

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1105

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AutoBackup.BackupPath	Data/BackupPath	target.file.full_path

Event ID 1106

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Reason	Data/Reason	security_result.description

Event ID 1107

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.application = "Event Logging Service"
ProcessID	Data/ProcessID	principal.process.pid
ErrorCode	Data/ErrorCode	security_result.summary Format: Error Code: %{value}

Event ID 1108

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 1112

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription		security_result.description
ErrorCode		security_result.summary Format: ErrorCode - %{ErrorCode}
DCName		target.administrative_domain
ExtensionName		target.resource.name
ExtensionId		target.resource.product_object_id

Event ID 1126

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Data_1		security_result.summary set to "Error: %{Data_1} - %{Data_2}"
Data_2		security_result.summary set to "Error: %{Data_1} - %{Data_2}"

Event ID 1127

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode		security_result.summary Format: ErrorCode - %{ErrorCode}
ErrorDescription		security_result.description
DCName		target.administrative_domain
SupportInfo1		additional.fields.key additional.fields.value.string_value
SupportInfo2		additional.fields.key additional.fields.value.string_value
ProcessingMode		additional.fields.key additional.fields.value.string_value
ProcessingTimeInMilliseconds		additional.fields.key additional.fields.value.string_value

Event ID 1128

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ExtensionName		target.resource.name
ExtensionId		target.resource.product_object_id

Event ID 1129

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorDescription	Data/ErrorDescription	security_result.description

Event ID 1130

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
ErrorDescription	Data/ErrorDescription	security_result.description
GPOFileSystemPath	Data/GPOFileSystemPath	target.file.full_path

Event ID 1134

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1150

Provider: Microsoft Antimalware

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED platform_version set to principal.asset.platform_software.platform_version

Event ID 1162

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1173

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1196

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
StatusString		security_result.summary
ResourceName		target.resource.name

Event ID 1200

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
Message		metadata.description
UserID		target.user.windows_sid

Event ID 1201

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
Message		metadata.description
UserID		target.user.windows_sid

Event ID 1202

Provider: SceCli

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Message		security_result.summary Format: summary is set to 0x%{error_code} - %{error_message}

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
Message		metadata.description
"SERVICE"		extensions.auth.mechanism
"SSO"		extensions.auth.typ
UserID		target.user.windows_sid

Event ID 1203

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
Message		metadata.description
"SERVICE"		extensions.auth.mechanism
"SSO"		extensions.auth.typ
UserID		target.user.windows_sid

Event ID 1204

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PASSWORD
Message		metadata.description

Event ID 1205

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ResourceGroup		target.group.group_display_name

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PASSWORD
Message		metadata.description

Event ID 1206

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGOUT
Message		metadata.description
UserID		target.user.windows_sid

Event ID 1207

Provider: AD FS Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGOUT
Message		metadata.description
UserID		target.user.windows_sid

Event ID 1213

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.

Event ID 1216

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data_3		security_result.description
Data		security_result.summary Format:  "Error Code - %{Data}"

Event ID 1226

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1254

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ResourceGroup		target.group.group_display_name

Event ID 1257

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
DNSZone		about.labels.key/value additional.fields.key additional.fields.value.string_value
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ResourceGroup		target.group.group_display_name

Event ID 1282

Provider: Microsoft-Windows-TPM-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 1307

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1311

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1317

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.

Event ID 1500

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
DCName	Data/DCName	target.administrative_domain

Event ID 1501

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 1502

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
DCName	Data/DCName	target.administrative_domain

Event ID 1503

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
DCName	Data/DCName	target.administrative_domain

Event ID 1531

Provider: Microsoft-Windows-User Profiles Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
Domain	Not available	principal.administrative_domain
AccountName	Not available	principal.user.userid
UserID	Not available	principal.user.windows_sid
SourceName	Not available	target.application

Event ID 1532

Provider: Microsoft-Windows-User Profiles Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
Domain	Not available	principal.administrative_domain
AccountName	Not available	principal.user.userid
UserID	Not available	principal.user.windows_sid
SourceName	Not available	target.application

Event ID 1535

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Data		security_result.description

Event ID 1564

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_READ
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ShareName		target.resource.name

Event ID 1566

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1573

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 1593

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_READ target.resource_resource_type = DATABASE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
DatabaseFilePath		target.file.full_path

Event ID 1643

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1644

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1645

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1653

Provider: Microsoft-Windows-FailoverClustering

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 1699

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Data_4		security_result.summary set to "Error Code - %{Data_4}"

Event ID 1704

Provider: SceCli

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
ProcessId		principal.process.pid
Message		security_result.summary

Event ID 1865

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1925

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 1955

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2000

Provider: Microsoft Antimalware

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE current_signature_version set to target.resource.attribute.labels.key/value previous_signature_version set to target.resource.attribute.labels.key/value

Event ID 2001

Provider: Microsoft Antimalware

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data_14		security_result.summary
Data_17		target.url

Provider: NTDS ISAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
MessageSourceAddress		principal.ip

Event ID 2004

Provider: Microsoft-Windows-Resource-Exhaustion-Detector

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 2041

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.

Event ID 2042

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2053

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2065

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2085

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
MessageSourceAddress		principal.ip
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2089

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2108

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Data_3		security_result.summary set to "Error: %{Data_4} - %{Data_3}"
Data_4		security_result.summary set to "Error: %{Data_4} - %{Data_3}"

Event ID 2811

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2887

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2889

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Message		principal_ip is set to principal.ip principal_port is set to principal.port principal_user_id is set to principal.user.userid

Event ID 2896

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Data_1		security_result.summary set to "Error: %{Data_1} - %{Data_2}"
Data_2		security_result.summary set to "Error: %{Data_1} - %{Data_2}"

Event ID 2904

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2946

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 2947

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
Data_2		principal.ip
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Data_3		security_result.summary set to "Error: %{Data_3}"

Event ID 2974

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Data_2		security_result.summary set to "Error Code - %{Data_2}"

Event ID 3005

Provider: LogRhythm Agent

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		security_result.description

Event ID 3006

Provider: LogRhythm Agent

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
Message		Message is set to security_result.description ip is set to target.ip port is set to target.port

Event ID 3040

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 3041

Provider: Microsoft-Windows-ActiveDirectory_DomainService

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
AccountName		principal.user.userid
UserID		principal.user.windows_sid

Event ID 3072

Provider: Foundation Agents

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 3096

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to security_result.summary

Event ID 3260

Provider: Workstation

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 3261

Provider: Workstation

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4000

version 0 Windows 10 client / Provider: Microsoft-Windows-Diagnostics-Networking

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-WLAN-AutoConfig

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 4001

Provider: Microsoft-Windows-WLAN-AutoConfig

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 4003

Provider: Microsoft-Windows-WLAN-AutoConfig

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorCode	Data/ErrorCode	security_result.summary Format: %{ErrorCode}-%{ErrorMsg}

Event ID 4005

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ReasonForSyncProcessing	Data/ReasonForSyncProcessing	security_result.summary
PrincipalSamName	Data/PrincipalSamName	target.hostname
PolicyActivityId	Data/PolicyActivityId	target.resource.product_object_id

Event ID 4006

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
PrincipalSamName	Data/PrincipalSamName	target.hostname
PolicyActivityId	Data/PolicyActivityId	target.resource.product_object_id

Event ID 4016

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
DescriptionString	Data/DescriptionString	security_result.description
CSEExtensionName	Data/CSEExtensionName	target.resource.name
CSEExtensionId	Data/CSEExtensionId	target.resource.product_object_id

Event ID 4017

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
OperationDescription	Data/OperationDescription	security_result.description

Event ID 4096

Provider: NetJoin

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
DomainName	Data/DomainName	target.administrative_domain
ComputerName	Data/ComputerName	target.hostname

Event ID 4097

Provider: Microsoft-Windows-CAPI2

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Provider: NetJoin

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
NetStatusCode	Data/NetStatusCode	security_result.description
DomainName	Data/DomainName	target.administrative_domain
ComputerName	Data/ComputerName	target.hostname

Event ID 4100

Provider: Microsoft-Windows-Diagnostics-Networking

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4101

Provider: Display

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 4103

version 1 / Provider: Microsoft-Windows-PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = PROCESS_LAUNCH
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.description
AccountName		principal.user.userid
UserID		principal.user.windows_sid
Category		security_result.summary
CommandName		additional.fields.key additional.fields.value.string_value
ScriptName		target.file.full_path
HostApplication		target.process.command_line
HostName		additional.fields.key additional.fields.value.string_value
HostVersion		additional.fields.key additional.fields.value.string_value
HostId		additional.fields.key additional.fields.value.string_value
EngineVersion		additional.fields.key additional.fields.value.string_value
RunspaceId		additional.fields.key additional.fields.value.string_value
CommandType		additional.fields.key additional.fields.value.string_value
PipelineID		additional.fields.key additional.fields.value.string_value
Payload		additional.fields.key additional.fields.value.string_value

Event ID 4104

Provider: Microsoft-Windows-PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = PROCESS_LAUNCH metadata.description = Script block logging
Domain		principal.administrative_domain
MessageNumber		additional.fields.key additional.fields.value.string_value
MessageTotal		additional.fields.key additional.fields.value.string_value
ScriptBlockText	Data/ScriptBlockText	target.process.command_line
ScriptBlockId		principal.resource.product_object_id
UserID		principal.user.windows_sid
Category		security_result.summary
Message		security_result.description
SourceName		target.application
ScriptBlockId		principal.resource.product_object_id

Event ID 4108

Provider: Microsoft-Windows-CAPI2

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE Extract information from Message field and map it to network.tls.client.certificate

Event ID 4109

Provider: Microsoft-Windows-CAPI2

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE Extract information from Message field and map it to network.tls.client.certificate

Event ID 4111

Provider: Microsoft-Windows-MSDTC

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
SourceName	Not available	target.application

Event ID 4112

Provider: Microsoft-Windows-CAPI2

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 4113

Provider: Microsoft-Windows-CAPI2

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 4115

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 4116

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 4117

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 4124

Provider: Microsoft-Windows-BitLocker-API

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4125

Provider: Microsoft-Windows-BitLocker-API

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data	Data/Data	security_result.description Format: Error - %{value}

Event ID 4126

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 4127

Provider: Microsoft-Windows-BitLocker-API

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data	Data/Data	security_result.description

Event ID 4133

Provider: Microsoft-Windows-BitLocker-API

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4199

Provider: Tcpip

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data	Data/Data	principal.ip
Data_1	Data/Data_1	target.mac

Event ID 4200

Provider: Microsoft-Windows-Iphlpsvc

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
Interface		target_resource_product_object_id set to target.resource.product_object_id
Address		target.ip

Event ID 4202

Provider: Microsoft-Windows-MSDTC 2

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
SourceName	Not available	target.application
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	additional.fields.key additional.fields.value.string_value
param4	Data/param4	additional.fields.key additional.fields.value.string_value
param5	Data/param5	additional.fields.key additional.fields.value.string_value
param6	Data/param6	additional.fields.key additional.fields.value.string_value
param7	Data/param7	additional.fields.key additional.fields.value.string_value
param9	Data/param9	target.user.userid

Event ID 4227

Provider: Tcpip

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Message set to security_result.summary

Event ID 4230

Provider: Tcpip

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4257

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 4319

Provider: NetBT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4321

Provider: NetBT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION
Data	Data/Data	principal.hostname and principal.port
Data_1	Data/Data_1	principal.ip
Data_2	Data/Data_2	target.ip

Event ID 4326

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 4400

Provider: NPS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data_1		principal.administrative_domain

Event ID 4608

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_STARTUP

Event ID 4609

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_SHUTDOWN

Event ID 4610

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AuthenticationPackageName	Data/AuthenticationPackageName	target.resource.name

Event ID 4611

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  PROCESS_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
LogonProcessName	Data/LogonProcessName	target.process.command_line
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4612

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AuditsDiscarded		about.labels.key about.labels.value

Event ID 4614

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
NotificationPackageName	Data/NotificationPackageName	target.resource.name

Event ID 4615

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.command_line
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4616

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type set to SETTING
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

version 1 /

NXLog field	Event Viewer field	UDM field
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
NewDate	Data/NewDate	target.resource.attribute.labels.key/value
NewTime	Data/NewTime	target.resource.attribute.labels.key/value
PreviousDate	Data/PreviousDate	target.resource.attribute.labels.key/value
PreviousTime	Data/PreviousTime	target.resource.attribute.labels.key/value

Event ID 4618

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
TargetUserDomain	Data/TargetUserDomain	target.administrative_domain
ComputerName	Data/ComputerName	target.hostname
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 4621

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
CrashOnAuditFailValue	Data/CrashOnAuditFailValue	security_result.summary

Event ID 4622

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SecurityPackageName	Data/SecurityPackageName	target.resource.name

Event ID 4624

version  0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "ALLOW"
LogonType	Data/LogonType	extensions.auth.mechanism and extensions.auth.details
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value
WorkstationName	Data/WorkstationName	principal.labels.key/value principal.asset_id
ProcessName	Data/ProcessName	principal.process.command_line
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
AuthenticationPackageName	Data/AuthenticationPackageName	security_result.about.resource.name
ElevatedToken	Data/ElevatedToken	security_result.detection_fields.labels.key/value
IpAddress	Data/IpAddress	src.ip
IpPort	Data/IpPort	src.port
TargetDomainName	Data/TargetDomainName	target.administrative_domain
LogonProcessName	Data/LogonProcessName	target.process.file.full_path
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
KeyLength	Data/KeyLength	target.labels.key/value
LmPackageName	Data/LmPackageName	target.labels.key/value

version 1 /

NXLog field	Event Viewer field	UDM field
ImpersonationLevel		about.labels.key/value

version 2 /

NXLog field	Event Viewer field	UDM field
TargetOutboundUserName	Data/TargetOutboundUserName	target.user.user_display_name
RestrictedAdminMode		about.labels.key/value
TargetLinkedLogonId		about.labels.key/value

Event ID 4625

Provider: Microsoft-Windows-EventSystem

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	about.registry.registry_key

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.category = AUTH_VIOLATION security_result.action = BLOCK extensions.auth.type set to MACHINE
FailureReason		security_result.about.labels.key security_result.about.labels.value
LogonType	Data/LogonType	extensions.auth.mechanism and extensions.auth.details
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
WorkstationName	Data/WorkstationName	principal.labels.key/value principal.asset_id
ProcessName	Data/ProcessName	principal.process.command_line
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
AuthenticationPackageName	Data/AuthenticationPackageName	security_result.about.resource.name
Status	Data/Status	security_result.summary Populate description corresponding to the status codes. Format: Status(%{Status}): %{status_description}. If the value coming is 0xc000006d, then store the value 'The cause is either a bad username or authentication information (referred from doc table.'
SubStatus	Data/SubStatus	security_result.description Populate description corresponding to the substatus codes. Format: SubStatus(%{SubStatus}): %{sub_status_description} If the value coming is 0xc000006d, then store the value 'The cause is either a bad username or authentication information (referred from doc table.'
IpAddress	Data/IpAddress	src.ip
IpPort	Data/IpPort	src.port
TargetDomainName	Data/TargetDomainName	target.administrative_domain
LogonProcessName	Data/LogonProcessName	target.process.file.full_path
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid

Event ID 4626

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
LogonType	Data/LogonType	extensions.auth.mechanism and extensions.auth.details
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 4627

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_UNCATEGORIZED
LogonType	Data/LogonType	extensions.auth.mechanism and extensions.auth.details
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
GroupMembership	Data/GroupMembership	target.user.group_identifiers
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 4634

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGOUT security_result.action = ALLOW
LogonType	Data/LogonType	extensions.auth.mechanism and extensions.auth.details
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4646

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START

Event ID 4647

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGOUT
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4648

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "ALLOW" extensions.auth.mechanism set to "USERNAME_PASSWORD"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
TargetServerName		target.hostname
TargetInfo		target.labels.key target.labels.value
ProcessName	Data/ProcessName	principal.process.command_line
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
IpAddress	Data/IpAddress	src.ip
IpPort	Data/IpPort	src.port
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 4649

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
LogonProcessName	Data/LogonProcessName	principal.process.command_line
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
WorkstationName	Data/WorkstationName	principal.labels.key/value principal.asset_id
ProcessName	Data/ProcessName	target.process.command_line
ProcessId	Data/ProcessId	target.process.pid
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4650

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalMMPrincipalName	Data/LocalMMPrincipalName	principal.hostname
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
RemoteMMPrincipalName	Data/RemoteMMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4651

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalMMIssuingCA	Data/LocalMMIssuingCA	network.tls.client.certificate.issuer
RemoteMMIssuingCA	Data/RemoteMMIssuingCA	network.tls.server.certificate.issuer
LocalMMPrincipalName	Data/LocalMMPrincipalName	principal.hostname
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
RemoteMMPrincipalName	Data/RemoteMMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4652

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalMMIssuingCA	Data/LocalMMIssuingCA	network.tls.client.certificate.issuer
RemoteMMIssuingCA	Data/RemoteMMIssuingCA	network.tls.server.certificate.issuer
LocalMMPrincipalName	Data/LocalMMPrincipalName	principal.hostname
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
RemoteMMPrincipalName	Data/RemoteMMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4653

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
FailureReason	Data/FailureReason	security_result.summary
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4654

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
Protocol	Data/Protocol	network.ip_protocol
LocalAddress	Data/LocalAddress	principal.ip
LocalPort	Data/LocalPort	principal.port
FailureReason	Data/FailureReason	security_result.summary
RemoteAddress	Data/RemoteAddress	target.ip
RemotePort	Data/RemotePort	target.port

Event ID 4655

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalAddress	Data/LocalAddress	principal.ip
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4656

version  0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
HandleId		target.resource.attribute.labels.key target.resource.attribute.labels.value
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
TransactionId		target.resource.attribute.labels.key target.resource.attribute.labels.value
RestrictedSidCount		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectName	Data/ObjectName	target.file.full_path (when ObjectType = "File") target.process.command_line (when ObjectType = "Process")
AccessList	Data/AccessList	target.resource.attribute.permissions.name
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
ObjectType	Data/ObjectType	target.resource.resource_subtype
ObjectServer		target.resource.attribute.labels.key target.resource.attribute.labels.value
AccessMask	Data/AccessMask	principal.process.access_mask
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4657

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = REGISTRY_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
OperationType		target.labels.key target.labels.value
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectName	Data/ObjectName	target.registry.registry_key
OldValueType		target.labels.key target.labels.value
OldValue		target.labels.key target.labels.value
NewValueType		target.labels.key target.labels.value
NewValue	Data/NewValue	target.registry.registry_value_data
ObjectValueName	Data/ObjectValueName	target.registry.registry_value_name
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
HandleId		target.labels.key/value

Event ID 4658

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
HandleId		target.labels.key/value
SubjectUserName	Data/SubjectUserName	principal.user.userid
ObjectServer		target.labels.key target.labels.value
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4659

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectName	Data/ObjectName	target.file.full_path (when ObjectType = "File") target.process.command_line (when ObjectType = "Process")
AccessList	Data/AccessList	target.resource.attribute.permissions.name
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4660

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
HandleId		target.resource.attribute.labels.key target.resource.attribute.labels.value
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TransactionId		target.resource.attribute.labels.key target.resource.attribute.labels.value
ObjectServer		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4661

event version 1 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
AccessReason	Data/AccessReason	security_result.description
RestrictedSidCount		target.labels.key target.labels.value

version 0 /

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ObjectType		target.labels.key/value
ProcessName	Data/ProcessName	principal.process.file.full_path
HandleId		target.labels.key/value
TransactionId		target.labels.key target.labels.value
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectName	Data/ObjectName	target.group.group_display_name (when ObjectType is SAM_ALIAS, SAM_GROUP) target.user.userid (when ObjectType is SAM_USER) target.administrative_domain (when ObjectType is SAM_DOMAIN) target.hostname (when ObjectType is SAM_SERVER)
AccessList	Data/AccessList	target.resource.attribute.permissions.name
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
ObjectServer		target.labels.key target.labels.value
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4662

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
HandleId		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
ObjectType		target.resource.resource_subtype
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
AdditionalInfo	Data/AdditionalInfo	security_result.description
AdditionalInfo2		security_result.detection_fields.key/value
Properties	Data/Properties	security_result.detection_fields.key/value
AccessMask	Data/AccessMask	principal.process.access_mask principal.resource.attribute.permissions
ObjectName	Data/ObjectName	target.resource.name
ObjectServer	Data/ObjectServer	target.resource.parent

Event ID 4663

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_OPEN (ObjectType = File, SymbolicLink) REGISTRY_UNCATEGORIZED (ObjectType = Key) PROCESS_OPEN (ObjectType = Process) USER_RESOURCE_ACCESS (ObjectType = Event)
ObjectName	Data/ObjectName	Object Type              | UDM Field --------------------------+------------------------------------ File, SymbolicLink    | target.file.full_path Key                             | target.registry.registry_key Process                      | target.process.file.full_path Event                          | target.resource.name
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ObjectType		target.resource.resource_subtype
HandleId		target.resource.attribute.labels.key target.resource.attribute.labels.value
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
AccessList	Data/AccessList	target.resource.attribute.permissions.name
ObjectServer		target.resource.attribute.labels.key target.resource.attribute.labels.value
ResourceAttributes		target.resource.attribute.labels.key target.resource.attribute.labels.value
AccessMask	Data/AccessMask	principal.process.access_mask principal.resource.attribute.permissions

Event ID 4664

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
FileName	Data/FileName	target.file.full_path
TransactionId		target.resource.attribute.labels.key target.resource.attribute.labels.value
LinkName	Data/LinkName	target.resource.name

Event ID 4665

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_CREATION
ClientDomain	Data/ClientDomain	principal.administrative_domain
ClientName	Data/ClientName	principal.labels.key/value
AppName	Data/AppName	target.application
AppInstance	Data/AppInstance	target.resource.product_object_id

Event ID 4666

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
ClientDomain	Data/ClientDomain	principal.administrative_domain
AppInstance		target.resource.product_object_id
ClientName	Data/ClientName	principal.labels.key/value
AppName	Data/AppName	target.application
ObjectName	Data/ObjectName	target.resource.name

Event ID 4667

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_DELETION
ClientDomain	Data/ClientDomain	principal.administrative_domain
AppInstance		target.resource.product_object_id
ClientName	Data/ClientName	principal.labels.key/value
AppName	Data/AppName	target.application

Event ID 4668

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ClientDomain	Data/ClientDomain	principal.administrative_domain
ClientName	Data/ClientName	principal.labels.key/value
AppInstance		target.resource.product_object_id
AppName	Data/AppName	target.application

Event ID 4670

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_OPEN (ObjectType = File, SymbolicLink) REGISTRY_UNCATEGORIZED (ObjectType = Key) PROCESS_OPEN (ObjectType = Process) USER_RESOURCE_ACCESS (ObjectType = Event)
ObjectName	Data/ObjectName	Object Type              | UDM Field --------------------------+------------------------------------ File, SymbolicLink    | target.file.full_path Key                             | target.registry.registry_key Process                      | target.process.file.full_path Event                          | target.resource.name
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
HandleId		target.resource.attribute.labels.key target.resource.attribute.labels.value
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ObjectServer		target.resource.attribute.labels.key target.resource.attribute.labels.value
OldSd	Data/OldSd	security_result.detection_fields.key/value
NewSd	Data/NewSd	security_result.detection_fields.key/value
ObjectType		target.resource.resource_subtype

Event ID 4671

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = BLOCK
CallerDomainName	Data/CallerDomainName	principal.administrative_domain
CallerUserName	Data/CallerUserName	principal.user.userid
CallerUserSid	Data/CallerUserSid	principal.user.windows_sid

Event ID 4672

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4673

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to GENERIC_EVENT.
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
Service		target.application
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	SubjectUserSid	principal.user.windows_sid
ProcessName	Data/ProcessName	target.process.command_line If ProcessName field not in log then extract "Process ID" and "Process Name" from "Message" field.
ObjectServer		target.resource.attribute.labels.key target.resource.attribute.labels.value
ProcessId	Data/ProcessId	target.process.pid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4674

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS If the ProcessName field is absent, then set metadata.event_type to GENERIC_EVENT.
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
HandleId		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ProcessName	Data/ProcessName	target.process.command_line If ProcessName field not in log then extract "Process ID" and "Process Name" from "Message" field.
ProcessId	Data/ProcessId	target.process.pid
ObjectName	ObjectName	target.resource.name
ObjectServer		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4675

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid

Event ID 4688

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = PROCESS_LAUNCH
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
NewProcessName	Data/NewProcessName	target.process.file.full_path
NewProcessId	Data/NewProcessId	target.process.pid
ParentProcessName	Data/ParentProcessName	principal.process.file.full_path
TokenElevationType	Data/TokenElevationType	target.labels additional.fields.key additional.fields.value.string_value
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

version 1 /

NXLog field	Event Viewer field	UDM field
commandLine	Data/commandLine	principal.process.command_line

version 2 /

NXLog field	Event Viewer field	UDM field
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
MandatoryLabel	Data/MandatoryLabel	target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4689

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = PROCESS_TERMINATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ProcessName	Data/ProcessName	target.process.file.full_path principal.process.file.full_path
ProcessId	Data/ProcessId	target.process.pid principal.process.pid

Event ID 4690

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SourceProcessId	Data/SourceProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
SourceHandleId	Data/SourceHandleId	src.resource.name
TargetProcessId	Data/TargetProcessId	target.process.pid
TargetHandleId	Data/TargetHandleId	target.resource.name

Event ID 4691

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_OPEN (ObjectType = File, SymbolicLink) REGISTRY_UNCATEGORIZED (ObjectType = Key) PROCESS_OPEN (ObjectType = Process) USER_RESOURCE_ACCESS (ObjectType = Event)
ObjectName	Data/ObjectName	Object Type              | UDM Field --------------------------+------------------------------------ File, SymbolicLink    | target.file.full_path Key                             | target.registry.registry_key Process                      | target.process.file.full_path Event                          | target.resource.name
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4692

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
MasterKeyId		security_result.detection_fields.key security_result.detection_fields.value
RecoveryKeyId		security_result.detection_fields.key security_result.detection_fields.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
FailureReason	Data/FailureReason	security_result.description
RecoveryServer	Data/RecoveryServer	target.hostname

Event ID 4693

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
MasterKeyId		security_result.detection_fields.key security_result.detection_fields.value
RecoveryKeyId		security_result.detection_fields.key security_result.detection_fields.value
FailureId		security_result.detection_fields.key security_result.detection_fields.value
RecoveryServer		target.hostname
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
RecoveryReason	Data/RecoveryReason	security_result.description
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4694

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
MasterKeyId		security_result.detection_fields.key security_result.detection_fields.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
FailureReason	Data/FailureReason	security_result.description
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4695

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
SubjectUserName	Data/SubjectUserName	principal.user.userid
MasterKeyId		security_result.detection_fields.key security_result.detection_fields.value
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
FailureReason	Data/FailureReason	security_result.description

Event ID 4696

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = PROCESS_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.command_line
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetProcessName	Data/TargetProcessName	target.process.command_line
TargetProcessId	Data/TargetProcessId	target.process.pid
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4697

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ServiceType		target.labels.key target.labels.value
ServiceStartType		target.labels.key target.labels.value
ServiceAccount		target.resource.name
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ServiceName	Data/ServiceName	target.application
ServiceFileName	Data/ServiceFileName	target.process.file.full_path

version 1 / Windows 10 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
ClientProcessId	Data/ClientProcessId	principal.process.pid
ParentProcessId	Data/ParentProcessId	principal.process.parent_process.pid

Event ID 4698

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_CREATION target.resource.resource_type = TASK
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TaskName	Data/TaskName	target.resource.name
Message	Data/Message	URI set to target.file.full_path Command set to target.process.command_line

version 1 / Windows 10 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
ParentProcessId	Data/ParentProcessId	target.process.parent_process.pid
ClientProcessId	Data/ClientProcessId	target.process.pid

Event ID 4699

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_DELETION target.resource.resource_type = "TASK"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TaskName	Data/TaskName	target.resource.name

version 1 / Windows 10 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
ParentProcessId	Data/ParentProcessId	principal.process.parent_process.pid
ClientProcessId	Data/ClientProcessId	principal.process.pid

Event ID 4700

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_ENABLE target.resource.resource_type = TASK
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TaskName	Data/TaskName	target.resource.name

version 1 / Windows 10 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
ParentProcessId	Data/ParentProcessId	principal.process.parent_process.pid
ClientProcessId	Data/ClientProcessId	principal.process.pid

Event ID 4701

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_DISABLE target.resource.resource_type = TASK
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TaskName	Data/TaskName	target.resource.name
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

version 1 / Windows 10 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
ParentProcessId	Data/ParentProcessId	principal.process.parent_process.pid
ClientProcessId	Data/ClientProcessId	principal.process.pid

Event ID 4702

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_MODIFICATION target.resource.resource_type = TASK
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
FQDN		target.labels.key target.labels.value
TaskContentNew		Extract the XML data from the TaskContentNew log field and map all the extracted fields with target.labels.key/value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TaskName	Data/TaskName	target.resource.name

version 1 / Windows 10 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
ClientProcessId	Data/ClientProcessId	target.process.pid
ParentProcessId	Data/ParentProcessId	target.process.parent_process.pid

Event ID 4703

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_PERMISSIONS_CHANGE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
EnabledPrivilegeList	Data/EnabledPrivilegeList	target.user.attribute.permissions.name target.user.attribute.permissions.description
DisabledPrivilegeList	Data/DisabledPrivilegeList	target.user.attribute.permissions.name target.user.attribute.permissions.description
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4704

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  USER_CHANGE_PERMISSIONS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetSid	Data/TargetSid	target.user.windows_sid Extract userId from TargetSid and map it to target.user.userid. Extract domain from TargetSid and map it to target.administrative_domain.

Event ID 4705

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  USER_CHANGE_PERMISSIONS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4706

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DomainName	Data/DomainName	target.administrative_domain
DomainSid	Data/DomainSid	target.user.windows_sid
TdoType	Data/TdoType	security_result.detection_fields[Trust Type]
TdoDirection	Data/TdoDirection	security_result.detection_fields[Trust Direction]
TdoAttributes	Data/TdoAttributes	security_result.detection_fields[Trust Attributes]
SidFilteringEnabled	Data/SidFilteringEnabled	security_result.detection_fields[Sid Filtering]

Event ID 4707

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DomainName	Data/DomainName	target.administrative_domain
DomainSid	Data/DomainSid	target.user.windows_sid

Event ID 4709

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.application = "IPsec Policy Agent Service"
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	additional.fields.key additional.fields.value.string_value

Event ID 4710

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP target.application = "IPsec Policy Agent Service"
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2	Data/param2	additional.fields.key additional.fields.value.string_value

Event ID 4711

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
param1	Data/param1	additional.fields.key additional.fields.value.string_value

Event ID 4712

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP target.application = "IPsec Policy Agent Service"
param1	Data/param1	additional.fields.key additional.fields.value.string_value

Event ID 4713

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
KerberosPolicyChange	Data/KerberosPolicyChange	target.resource.attribute.labels.key = "FieldName_OLD_VALUE" and value="<old_value>" and target.resource.attribute.labels.key = "FieldName_NEW_VALUE" and value="<new_value>"

Event ID 4714

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
EfsPolicyChange	Data/EfsPolicyChange	target.resource.name

Event ID 4715

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
OldSd	Data/OldSd	target.resource.attribute.labels.key target.resource.attribute.labels.value
NewSd	Data/NewSd	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 4716

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DomainName	Data/DomainName	target.administrative_domain
DomainSid	Data/DomainSid	target.user.windows_sid
TdoType	Data/TdoType	security_result.detection_fields[Trust Type]
TdoDirection	Data/TdoDirection	security_result.detection_fields[Trust Direction]
TdoAttributes	Data/TdoAttributes	security_result.detection_fields[Trust Attributes]
SidFilteringEnabled	Data/SidFilteringEnabled	security_result.detection_fields[Sid Filtering]

Event ID 4717

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action = ALLOW
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
AccessGranted	Data/AccessGranted	target.user.attribute.permissions.name target.user.attribute.permissions.description
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4718

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action = BLOCK
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
AccessRemoved	Data/AccessRemoved	target.user.attribute.permissions.name target.user.attribute.permissions.description
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4719

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubcategoryGuid	Data/SubcategoryGuid	Populate security_result.category_details based on description received in output of command: auditpol /list /subcategory:* /v.
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
CategoryId	Data/CategoryId	security_result[0].category_details is set to "CategoryId" security_result[0].summary is set to "%{CategoryId}" security_result[0].description is set to "%{Category}"
SubcategoryId	Data/SubcategoryId	security_result[0].category_details is set to "SubCategoryId" security_result[0].summary is set to "%{SubCategoryId}" security_result[0].description is set to "%{SubCategory}" extract "Subcategory" description from "Message" field.
SubcategoryGuid	Data/SubcategoryGuid	security_result[2].category_details is set to "SubcategoryGuid" security_result[2].summary is set to "%{SubcategoryGuid}" security_result[2].description is set to "%{subcategory_guid_description}"
AuditPolicyChanges	Data/AuditPolicyChanges	security_result[3].category_details is set to "AuditPolicyChanges" security_result[3].summary is set to "%{AuditPolicyChanges_description}" extract "AuditPolicyChanges_description" description from "Message" field about.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4720

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
DisplayName	Data/DisplayName	target.user.user_display_name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid
SamAccountName		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserPrincipalName		target.resource.attribute.labels.key target.resource.attribute.labels.value
HomeDirectory		target.resource.attribute.labels.key target.resource.attribute.labels.value
HomePath		target.resource.attribute.labels.key target.resource.attribute.labels.value
ScriptPath		target.resource.attribute.labels.key target.resource.attribute.labels.value
ProfilePath		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserWorkstations		target.resource.attribute.labels.key target.resource.attribute.labels.value
PasswordLastSet		target.resource.attribute.labels.key target.resource.attribute.labels.value
AccountExpires		target.resource.attribute.labels.key target.resource.attribute.labels.value
PrimaryGroupId		target.resource.attribute.labels.key target.resource.attribute.labels.value
AllowedToDelegateTo		target.resource.attribute.labels.key target.resource.attribute.labels.value
OldUacValue		target.resource.attribute.labels.key target.resource.attribute.labels.value
NewUacValue		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserAccountControl		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserParameters		target.resource.attribute.labels.key target.resource.attribute.labels.value
SidHistory		target.resource.attribute.labels.key target.resource.attribute.labels.value
LogonHours		target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 4722

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS security_result.action = ALLOW
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4723

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PASSWORD
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4724

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PASSWORD
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4725

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4726

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4727

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4728

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
Message	Data/Message	Extracted OU, CN, DC fields from the Message log field and mapped it to target.user.attribute.labels
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4729

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4730

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4731

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION security_result.action set to "ALLOW"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
SamAccountName		principal.user.attribute.labels.key/value
SidHistory		principal.user.attribute.labels.key/value

Event ID 4732

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

version 1 /

NXLog field	Event Viewer field	UDM field
MembershipExpirationTime		target.user.attribute.labels.key/value

Event ID 4733

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4734

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4735

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
SamAccountName		principal.user.attribute.labels.key/value
SidHistory		principal.user.attribute.labels.key/value

Event ID 4737

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4738

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.user_display_name
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
SamAccountName	Data/SamAccountName	target.resource.attribute.labels.key target.resource.attribute.labels.value
DisplayName	Data/DisplayName	target.resource.attribute.labels.key target.resource.attribute.labels.value
UserPrincipalName	Data/UserPrincipalName	target.resource.attribute.labels.key target.resource.attribute.labels.value
HomeDirectory	Data/HomeDirectory	target.resource.attribute.labels.key target.resource.attribute.labels.value
HomePath	Data/HomePath	target.resource.attribute.labels.key target.resource.attribute.labels.value
ScriptPath	Data/ScriptPath	target.resource.attribute.labels.key target.resource.attribute.labels.value
ProfilePath	Data/ProfilePath	target.resource.attribute.labels.key target.resource.attribute.labels.value
UserWorkstations	Data/UserWorkstations	target.resource.attribute.labels.key target.resource.attribute.labels.value
PasswordLastSet	Data/PasswordLastSet	target.resource.attribute.labels.key target.resource.attribute.labels.value target.user.last_password_change_time
AccountExpires	Data/AccountExpires	target.resource.attribute.labels.key target.resource.attribute.labels.value
PrimaryGroupId	Data/PrimaryGroupId	target.resource.attribute.labels.key target.resource.attribute.labels.value
AllowedToDelegateTo	Data/AllowedToDelegateTo	target.resource.attribute.labels.key target.resource.attribute.labels.value
OldUacValue	Data/OldUacValue	target.resource.attribute.labels.key target.resource.attribute.labels.value
NewUacValue	Data/NewUacValue	target.resource.attribute.labels.key target.resource.attribute.labels.value
UserAccountControl	Data/UserAccountControl	target.resource.attribute.labels.key target.resource.attribute.labels.value
UserParameters	Data/UserParameters	target.resource.attribute.labels.key target.resource.attribute.labels.value
SidHistory	Data/SidHistory	target.resource.attribute.labels.key target.resource.attribute.labels.value
LogonHours	Data/LogonHours	target.resource.attribute.labels.key target.resource.attribute.labels.value
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4739

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = "SETTING"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DomainName	Data/DomainName	target.administrative_domain
DomainPolicyChanged	Data/DomainPolicyChanged	target.resource.name
PrivilegeList		target.user.attribute.permissions.name
MinPasswordAge		target.resource.attribute.labels.key target.resource.attribute.labels.value
MaxPasswordAge		target.resource.attribute.labels.key target.resource.attribute.labels.value
ForceLogoff		target.resource.attribute.labels.key target.resource.attribute.labels.value
LockoutThreshold		target.resource.attribute.labels.key target.resource.attribute.labels.value
LockoutObservationWindow		target.resource.attribute.labels.key target.resource.attribute.labels.value
LockoutDuration		target.resource.attribute.labels.key target.resource.attribute.labels.value
PasswordProperties		target.resource.attribute.labels.key target.resource.attribute.labels.value
MinPasswordLength		target.resource.attribute.labels.key target.resource.attribute.labels.value
PasswordHistoryLength		target.resource.attribute.labels.key target.resource.attribute.labels.value
MachineAccountQuota		target.resource.attribute.labels.key target.resource.attribute.labels.value
MixedDomainMode		target.resource.attribute.labels.key target.resource.attribute.labels.value
DomainBehaviorVersion		target.resource.attribute.labels.key target.resource.attribute.labels.value
OemInformation		target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 4740

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4741

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_CREATION target.resource.resource_type = STORAGE_OBJECT target.resource.resource_subtype = Computer Account
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.user_display_name
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid
DnsHostName	Data/DnsHostName	target.asset.hostname
SamAccountName		target.resource.attribute.labels.key target.resource.attribute.labels.value
DisplayName		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserPrincipalName		target.resource.attribute.labels.key target.resource.attribute.labels.value
HomeDirectory		target.resource.attribute.labels.key target.resource.attribute.labels.value
HomePath		target.resource.attribute.labels.key target.resource.attribute.labels.value
ScriptPath		target.resource.attribute.labels.key target.resource.attribute.labels.value
ProfilePath		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserWorkstations		target.resource.attribute.labels.key target.resource.attribute.labels.value
PasswordLastSet		target.resource.attribute.labels.key target.resource.attribute.labels.value
AccountExpires		target.resource.attribute.labels.key target.resource.attribute.labels.value
PrimaryGroupId		target.resource.attribute.labels.key target.resource.attribute.labels.value
AllowedToDelegateTo		target.resource.attribute.labels.key target.resource.attribute.labels.value
OldUacValue		target.resource.attribute.labels.key target.resource.attribute.labels.value
NewUacValue		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserAccountControl		target.resource.attribute.labels.key target.resource.attribute.labels.value
UserParameters		target.resource.attribute.labels.key target.resource.attribute.labels.value
SidHistory		target.resource.attribute.labels.key target.resource.attribute.labels.value
LogonHours		target.resource.attribute.labels.key target.resource.attribute.labels.value
ServicePrincipalNames		target.principal

Event ID 4742

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_UPDATE_CONTENT target.resource.resource_type = STORAGE_OBJECT target.resource.resource_subtype = Computer Account
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid
ServicePrincipalNames	Data/ServicePrincipalNames	target.application

Event ID 4743

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4744

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4745

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4746

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4747

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4748

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4749

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
SamAccountName		target.labels.key/value
SidHistory		target.labels.key/value

Event ID 4750

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
SamAccountName		target.labels.key/value
SidHistory		target.labels.key/value

Event ID 4751

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4752

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4753

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4754

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION security_result.action set to "ALLOW"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4755

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4756

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4757

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4758

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4759

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4760

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4761

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4762

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4763

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name

Event ID 4764

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
GroupTypeChange	Data/GroupTypeChange	security_result.summary
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
PrivilegeList		target.user.attribute.permissions.name (repeated)

Event ID 4765

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_UPDATE_CONTENT target.resource.resource_type = SETTING target.resource.resource_subtype = SID History
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.user.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4766

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_UPDATE_CONTENT
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4767

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4768

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN If LogonType field is missing then extensions.auth.mechanism = MECHANISM_UNSPECIFIED
IpAddress	Data/IpAddress	src.ip
IpPort	Data/IpPort	src.port
Status	Data/Status	security_result.description
CertIssuerName	Data/CertIssuerName	security_result.detection_fields.labels.key = cert_issuer_name and value = %{cert_issuer_name}
CertSerialNumber	Data/CertSerialNumber	security_result.detection_fields.labels.key = cert_serial_number and value = %{cert_serial_number}
CertThumbprint	Data/CertThumbprint	security_result.detection_fields.labels.key = cert_thumbprint and value = %{cert_thumbprint}
TargetDomainName	Data/TargetDomainName	target.administrative_domain
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid
ServiceSid		target.labels.key/value
TicketOptions		target.resource.name
TicketEncryptionType		target.resource.resource_subtype
PreAuthType		target.labels.key/value

Event ID 4769

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_UNCATEGORIZED If LogonType field is missing then extensions.auth.mechanism = MECHANISM_UNSPECIFIED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
IpAddress	Data/IpAddress	src.ip
IpPort	Data/IpPort	src.port
ServiceSid	Data/ServiceSid	target.user.windows_sid
Status	Data/Status	security_result.description
TargetDomainName	Data/TargetDomainName	target.administrative_domain
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid
TicketOptions	Data/TicketOptions	additional.fields.key and additional.fields.value.string_value
TicketEncryptionType	Data/TicketEncryptionType	additional.fields.key and additional.fields.value.string_value
LogonGuid	Data/LogonGuid	additional.fields.key and additional.fields.value.string_value
TransmittedServices	Data/TransmittedServices	additional.fields.key and additional.fields.value.string_value

Event ID 4770

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
IpAddress	Data/IpAddress	src.ip
IpPort	Data/IpPort	src.port
TicketEncryptionType	Data/TicketEncryptionType	security_result.about.resource.name
TargetDomainName	Data/TargetDomainName	target.administrative_domain
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid
ServiceSid		target.user.windows_sid
TicketOptions		security_result.about.resource.attribute.labels.key/value

Event ID 4771

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "BLOCK"
IpAddress	Data/IpAddress	src.ip
IpPort	Data/IpPort	src.port
Status	Data/Status	security_result.description
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4772

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action set to "BLOCK"
IpAddress	Data/IpAddress	principal.ip
IpPort	Data/IpPort	principal.port
TargetDomainName	Data/TargetDomainName	target.administrative_domain
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4773

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action set to "BLOCK"
IpAddress	Data/IpAddress	principal.ip
IpPort	Data/IpPort	principal.port
TargetDomainName	Data/TargetDomainName	target.administrative_domain
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4774

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ClientUserName	Data/ClientUserName	principal.user.userid
MappingBy	Data/MappingBy	about.labels.key/value additional.fields.key additional.fields.value.string_value
MappedName	Data/MappedName	about.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4775

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ClientUserName	Data/ClientUserName	principal.user.userid
MappingBy	Data/MappingBy	about.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4776

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action = BLOCK
Hostname		target.hostname
Workstation	Data/Workstation	principal.hostname principal.asset_id
Status	Data/Status	security_result.description Format: Status - Description
TargetUserName	Data/TargetUserName	target.user.userid
Version		about.labels.key/value additional.fields.key additional.fields.value.string_value
Level		about.labels.key/value additional.fields.key additional.fields.value.string_value
Task		about.labels.key/value additional.fields.key additional.fields.value.string_value
Opcode		about.labels.key/value additional.fields.key additional.fields.value.string_value
Keywords		about.labels.key/value additional.fields.key additional.fields.value.string_value
ThreadID	Data/ThreadID	about.labels.key/value additional.fields.key additional.fields.value.string_value
PackageName	Data/PackageName	security_result.about.resource.name

Event ID 4777

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.category = "AUTH_VIOLATION"
Status	Data/Status	security_result.summary
Workstation	Data/Workstation	principal.labels.key/value principal.asset_id
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4778

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED security_result.action set to "ALLOW"
SessionName	Data/SessionName	network.session_id
AccountDomain	Data/AccountDomain	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
AccountName	Data/AccountName	principal.user.userid
ClientName	Data/ClientName	principal.hostname principal.asset.hostname
ClientAddress	Data/ClientAddress	principal.ip
Hostname	Computer	target.asset.hostname target.hostname

Event ID 4779

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SessionName	Data/SessionName	network.session_id
AccountDomain	Data/AccountDomain	principal.administrative_domain
AccountName	Data/AccountName	principal.user.userid
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value
ClientAddress	Data/ClientAddress	target.ip
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4780

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4781

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_UNCATEGORIZED
OldTargetUserName	Data/OldTargetUserName	target.labels.key/value additional.fields.key additional.fields.value.string_value
PrivilegeList		target.user.attribute.permissions.name (repeated)
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
NewTargetUserName	Data/NewTargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4782

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4783

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4784

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4785

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4786

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4787

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4788

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid
MemberName	Data/MemberName	target.user.user_display_name
MemberSid	Data/MemberSid	target.user.windows_sid

Event ID 4789

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4790

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4791

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4792

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
PrivilegeList	Data/PrivilegeList	target.group.attribute.permissions.name
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4793

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
Status	Data/Status	security_result.summary
Workstation	Data/Workstation	principal.labels.key/value principal.asset_id
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4794

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_UPDATE_CONTENT target.resource.resource_type = SETTING target.resource.name = "Directory Services Restore Mode administrator password"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
Workstation	Data/Workstation	principal.asset.attribute.labels.key/value principal.asset_id
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
Status	Data/Status	security_result.description Format: Status - Description

Event ID 4797

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
Workstation	Data/Workstation	principal.labels.key/value principal.asset_id
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4798

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
CallerProcessName	Data/CallerProcessName	principal.process.file.full_path
CallerProcessId	Data/CallerProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.userid

Event ID 4799

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
CallerProcessName	Data/CallerProcessName	principal.process.file.full_path
CallerProcessId	Data/CallerProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4800

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
TargetDomainName	Data/TargetDomainName	principal.administrative_domain
TargetUserName	Data/TargetUserName	principal.user.userid
SessionID		about.labels.key about.labels.value
TargetUserSid	Data/TargetUserSid	principal.user.windows_sid
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4801

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
TargetDomainName	Data/TargetDomainName	principal.administrative_domain
TargetUserName	Data/TargetUserName	principal.user.userid
SessionID		about.labels.key about.labels.value
TargetUserSid	Data/TargetUserSid	principal.user.windows_sid
TargetLogonId	Data/TargetLogonId	target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 4816

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
PeerName	Data/PeerName	target.ip
ProtocolSequence	Data/ProtocolSequence	additional.fields.key additional.fields.value.string_value
SecurityError	Data/SecurityError	security_result.detection_fields.key/value
param1		additional.additional.fields.key additional.fields.value.string_value
param2		additional.additional.fields.key additional.fields.value.string_value
param3		additional.additional.fields.key additional.fields.value.string_value

Event ID 4817

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION   target.resource.resource_type = "SETTING"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
OldSd	Data/OldSd	target.resource.attribute.labels.key target.resource.attribute.labels.value
NewSd	Data/NewSd	target.resource.attribute.labels.key target.resource.attribute.labels.value
ObjectName	Data/ObjectName	target.resource.name

Event ID 4818

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
AccessReason	Data/AccessReason	security_result.description
ObjectName	Data/ObjectName	target.resource.name

Event ID 4819

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4820

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
DeviceName	Data/DeviceName	principal.hostname
IpAddress	Data/IpAddress	principal.ip
IpPort	Data/IpPort	principal.port
TargetDomainName	Data/TargetDomainName	target.administrative_domain
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4821

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "BLOCK"
DeviceName	Data/DeviceName	principal.hostname
IpAddress	Data/IpAddress	principal.ip
IpPort	Data/IpPort	principal.port
TargetDomainName	Data/TargetDomainName	target.administrative_domain
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.user.userid

Event ID 4822

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_UNCATEGORIZED security_result.category = AUTH_VIOLATION
DeviceName	Data/DeviceName	principal.hostname
AccountName	Data/AccountName	principal.user.userid

Event ID 4823

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_UNCATEGORIZED security_result.category = AUTH_VIOLATION
DeviceName	Data/DeviceName	principal.hostname
AccountName	Data/AccountName	principal.user.userid

Event ID 4824

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_UNCATEGORIZED security_result.category = AUTH_VIOLATION
IpAddress	Data/IpAddress	principal.ip
IpPort	Data/IpPort	principal.port
ServiceName	Data/ServiceName	target.application
TargetUserName	Data/TargetUserName	target.group.group_display_name
TargetSid	Data/TargetSid	target.group.windows_sid

Event ID 4825

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action set to "BLOCK"
AccountDomain	Data/AccountDomain	principal.administrative_domain
ClientAddress	Data/ClientAddress	principal.ip
AccountName	Data/AccountName	principal.user.userid

Event ID 4826

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
LoadOptions		principal.labels.key/value
AdvancedOptions		principal.labels.key/value
ConfigAccessPolicy		principal.labels.key/value
RemoteEventLogging		principal.labels.key/value
KernelDebug		principal.labels.key/value
VsmLaunchType		principal.labels.key/value
TestSigning		principal.labels.key/value
FlightSigning		principal.labels.key/value
DisableIntegrityChecks		principal.labels.key/value
HypervisorLoadOptions		principal.labels.key/value
HypervisorLaunchType		principal.labels.key/value
HypervisorDebug		principal.labels.key/value

Event ID 4830

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetSid	Data/TargetSid	target.user.windows_sid

Event ID 4864

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4865

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ForestRoot	Data/ForestRoot	target.resource.name
ForestRootSid	Data/ForestRootSid	target.resource.product_object_id
OperationId	Data/OperationId	target.resource.attribute.labels[Operation ID]
EntryType	Data/EntryType	target.resource.attribute.labels[Entry Type]
Flags	Data/Flags	target.resource.attribute.labels[Flags]
TopLevelName	Data/TopLevelName	target.resource.attribute.labels[Top Level Name]
DnsName	Data/DnsName	target.hostname
NetbiosName	Data/NetbiosName	target.resource.attribute.labels[NetBIOS Name]
DomainSid	Data/DomainSid	target.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels[SubjectLogonId]

Event ID 4866

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ForestRoot	Data/ForestRoot	target.resource.name
ForestRootSid	Data/ForestRootSid	target.resource.product_object_id
OperationId	Data/OperationId	target.resource.attribute.labels[Operation ID]
EntryType	Data/EntryType	target.resource.attribute.labels[Entry Type]
Flags	Data/Flags	target.resource.attribute.labels[Flags]
TopLevelName	Data/TopLevelName	target.resource.attribute.labels[Top Level Name]
DnsName	Data/DnsName	target.hostname
NetbiosName	Data/NetbiosName	target.resource.attribute.labels[NetBIOS Name]
DomainSid	Data/DomainSid	target.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels[SubjectLogonId]

Event ID 4867

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ForestRoot	Data/ForestRoot	target.resource.name
ForestRootSid	Data/ForestRootSid	target.resource.product_object_id
OperationId	Data/OperationId	target.resource.attribute.labels[Operation ID]
EntryType	Data/EntryType	target.resource.attribute.labels[Entry Type]
Flags	Data/Flags	target.resource.attribute.labels[Flags]
TopLevelName	Data/TopLevelName	target.resource.attribute.labels[Top Level Name]
DnsName	Data/DnsName	target.hostname
NetbiosName	Data/NetbiosName	target.resource.attribute.labels[NetBIOS Name]
DomainSid	Data/DomainSid	target.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels[SubjectLogonId]

Event ID 4868

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = BLOCK
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4869

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4870

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
RevocationReason	Data/RevocationReason	security_result.description

Event ID 4871

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4872

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
PublishURLs	Data/PublishURLs	target.file.full_path

Event ID 4873

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ExtensionName		target.resource.name

Event ID 4874

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4875

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4876

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4877

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4878

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4879

Provider: Microsoft-Windows-MSDTC Client 2

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
param1	Data/param1	security_result.summary Format: Error Code: %{value}
SourceName	Not available	target.application
param2	Data/param2	target.hostname

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4880

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4881

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4882

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_PERMISSIONS_CHANGE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4883

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4884

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4885

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4886

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RequestId	Data/RequestId	additional.fields.key additional.fields.value.string_value
Requester	Data/Requester	additional.fields.key additional.fields.value.string_value
Attributes	Data/Attributes	additional.fields.key additional.fields.value.string_value

Event ID 4887

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RequestId	Data/RequestId	additional.fields.key additional.fields.value.string_value
Requester	Data/Requester	additional.fields.key additional.fields.value.string_value
Attributes	Data/Attributes	additional.fields.key additional.fields.value.string_value
Disposition	Data/Disposition	additional.fields.key additional.fields.value.string_value
SubjectKeyIdentifier	Data/SubjectKeyIdentifier	additional.fields.key additional.fields.value.string_value
Subject	Data/Subject	additional.fields.key additional.fields.value.string_value

Event ID 4888

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = BLOCK

Event ID 4889

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4890

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4891

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4892

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
PropertyName	Data/PropertyName	target.resource.name

Event ID 4893

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4894

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4895

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4896

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 4897

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
RoleSeparationEnabled	Data/RoleSeparationEnabled	target.resource.name = "Role separation enabled:  %{RoleSeparationEnabled}"

Event ID 4898

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
TemplateInternalName	Data/TemplateInternalName	target.resource.name

Event ID 4899

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
TemplateInternalName	Data/TemplateInternalName	target.resource.name
TemplateOID		target.resource.product_object_id

Event ID 4900

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
TemplateInternalName	Data/TemplateInternalName	target.resource.name
TemplateOID		target.resource.product_object_id

Event ID 4902

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_CREATION target.resource.resource_type = SETTING
PuaCount		target.resource.attribute.labels.key target.resource.attribute.labels.value
PuaPolicyId	Data/PuaPolicyId	target.resource.product_object_id

Event ID 4904

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
AuditSourceName		target.application
EventSourceId		target.labels.key target.labels.value
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4905

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
AuditSourceName		target.application
EventSourceId		target.labels.key target.labels.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 4906

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4907

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_MODIFICATION (ObjectType = File, SymbolicLink) REGISTRY_MODIFICATION (ObjectType = Key) PROCESS_UNCATEGORIZED (ObjectType = Process) USER_RESOURCE_UPDATE_PERMISSIONS (ObjectType = all other)
ObjectName	Data/ObjectName	Object Type              | UDM Field --------------------------+------------------------------------ File, SymbolicLink    | target.file.full_path Key                             | target.registry.registry_key Process                      | target.process.file.full_path Event                          | target.resource.name
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectType		target.resource.resource_subtype
ProcessName	Data/ProcessName	target.process.command_line
ObjectServer		target.labels.key target.labels.value
ProcessId	Data/ProcessId	target.process.pid
NewSd	Data/NewSd	target.resource.attribute.labels.key = "NewSd" value in target.resource.attribute.labels.value
OldSd	Data/OldSd	target.resource.attribute.labels.key = "OldSd" value in target.resource.attribute.labels.value
HandleId		target.labels.key/value

Event ID 4908

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION

Event ID 4909

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
OldBlockedOrdinals	Data/OldBlockedOrdinals	target.resource.attribute.labels.key target.resource.attribute.labels.value
NewBlockedOrdinals	Data/NewBlockedOrdinals	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 4910

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
OldIgnoreDefaultSettings	Data/OldIgnoreDefaultSettings	target.resource.attribute.labels.key target.resource.attribute.labels.value
NewIgnoreDefaultSettings	Data/NewIgnoreDefaultSettings	target.resource.attribute.labels.key target.resource.attribute.labels.value
OldIgnoreLocalSettings	Data/OldIgnoreLocalSettings	target.resource.attribute.labels.key target.resource.attribute.labels.value
NewIgnoreLocalSettings	Data/NewIgnoreLocalSettings	target.resource.attribute.labels.key target.resource.attribute.labels.value
OldBlockedOrdinals	Data/OldBlockedOrdinals	target.resource.attribute.labels.key target.resource.attribute.labels.value
NewBlockedOrdinals	Data/NewBlockedOrdinals	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 4911

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
HandleId		target.labels.key/value
ObjectType		target.resource.resource_subtype
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ObjectServer		target.labels.key target.labels.value
OldSd		target.resource.attribute.labels.key target.resource.attribute.labels.value
NewSd		target.resource.attribute.labels.key target.resource.attribute.labels.value
ObjectName	Data/ObjectName	target.resource.name

Event ID 4912

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid

Event ID 4913

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectName	Data/ObjectName	target.resource.name

Event ID 4928

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceAddr	Data/SourceAddr	target.ip or target.hostname If SourceAddr field value not in IP form then it map to target.hostname
StatusCode	Data/StatusCode	security_result.summary is set to StatusCode: %{StatusCode}

Event ID 4929

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceAddr	Data/SourceAddr	target.ip or target.hostname If SourceAddr field value not in IP form then map to target.hostname
StatusCode	Data/StatusCode	security_result.summary is set to StatusCode: %{StatusCode}

Event ID 4930

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceAddr	Data/SourceAddr	target.ip or target.hostname If SourceAddr field value not in IP form then it map to target.hostname
StatusCode	Data/StatusCode	security_result.summary is set to StatusCode: %{StatusCode}

Event ID 4931

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SourceAddr	Data/SourceAddr	target.ip or target.hostname If SourceAddr field value not in IP form then it map to target.hostname
StatusCode	Data/StatusCode	security_result.summary is set to StatusCode: %{StatusCode}

Event ID 4932

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4933

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
StatusCode	Data/StatusCode	security_result.summary is set to StatusCode: %{StatusCode}

Event ID 4934

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
NewValue		target.registry.registry_value_data

Event ID 4935

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4936

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4937

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
StatusCode	Data/StatusCode	security_result.summary is set to StatusCode: %{StatusCode}

Event ID 4944

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
GroupPolicyApplied		about.labels.key/value
Profile		about.labels.key/value
OperationMode		about.labels.key/value
RemoteAdminEnabled		about.labels.key/value
MulticastFlowsEnabled		about.labels.key/value
LogDroppedPacketsEnabled		about.labels.key/value
LogSuccessfulConnectionsEnabled		about.labels.key/value

Event ID 4945

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target.resource.resource_type = "FIREWALL_RULE"
ProfileUsed		target.resource.attribute.labels.key target.resource.attribute.labels.value
RuleId	Data/RuleId	target.resource.product_object_id
RuleName	Data/RuleName	target.resource.name

Event ID 4946

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
ProfileChanged		target.resource.attribute.labels.key target.resource.attribute.labels.value
RuleName	Data/RuleName	target.resource.name
RuleId	Data/RuleId	target.resource.product_object_id

Event ID 4947

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
ProfileUsed		target.resource.attribute.labels.key target.resource.attribute.labels.value
RuleId	Data/RuleId	target.resource.product_object_id
RuleName	Data/RuleName	target.resource.name

Event ID 4948

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_DELETION target.resource.resource_type = SETTING
ProfileChanged		target.resource.attribute.labels.key target.resource.attribute.labels.value
RuleId	Data/RuleId	target.resource.product_object_id
RuleName	Data/RuleName	target.resource.name

Event ID 4949

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4950

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
ProfileChanged		target.resource.attribute.labels.key target.resource.attribute.labels.value
SettingValue		target.resource.attribute.labels.key target.resource.attribute.labels.value
SettingType	Data/SettingType	target.resource.name

Event ID 4951

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId	Data/RuleId	security_result.rule_id
RuleName	Data/RuleName	security_result.rule_name

Event ID 4952

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId	Data/RuleId	security_result.rule_id
RuleName	Data/RuleName	security_result.rule_name

Event ID 4953

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ReasonForRejection	Data/ReasonForRejection	security_result.description
RuleId	Data/RuleId	security_result.rule_id
RuleName	Data/RuleName	security_result.rule_name

Event ID 4954

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 4956

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ActiveProfile		target.labels.key target.labels.value

Event ID 4957

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId	Data/RuleId	security_result.rule_id
RuleName	Data/RuleName	security_result.rule_name
RuleAttr	Data/RuleAttr	security_result.summary

Event ID 4958

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Reason	Data/Reason	security_result.description
RuleId	Data/RuleId	security_result.rule_id
RuleName	Data/RuleName	security_result.rule_name

Event ID 4960

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4961

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4962

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4963

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4964

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetDomainName	Data/TargetDomainName	target.administrative_domain
TargetUserName	Data/TargetUserName	target.user.userid
TargetUserSid	Data/TargetUserSid	target.user.windows_sid
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 4965

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4976

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
LocalAddress	Data/LocalAddress	principal.ip
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4977

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
LocalAddress	Data/LocalAddress	principal.ip
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4978

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
LocalAddress	Data/LocalAddress	principal.ip
RemoteAddress	Data/RemoteAddress	target.ip

Event ID 4979

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalMMPrincipalName	Data/LocalMMPrincipalName	principal.hostname
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
RemoteMMPrincipalName	Data/RemoteMMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4980

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalMMPrincipalName	Data/LocalMMPrincipalName	principal.hostname
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
RemoteMMPrincipalName	Data/RemoteMMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4981

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalMMPrincipalName	Data/LocalMMPrincipalName	principal.hostname
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
RemoteMMPrincipalName	Data/RemoteMMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4982

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalMMPrincipalName	Data/LocalMMPrincipalName	principal.hostname
LocalKeyModPort	Data/LocalKeyModPort	principal.port
RemoteMMPrincipalName	Data/RemoteMMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4983

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalEMPrincipalName	Data/LocalEMPrincipalName	principal.hostname
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
FailureReason	Data/FailureReason	security_result.description
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
RemoteEMPrincipalName	Data/RemoteEMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4984

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
LocalEMPrincipalName	Data/LocalEMPrincipalName	principal.hostname
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
LocalAddress	Data/LocalAddress	principal.ip
LocalKeyModPort	Data/LocalKeyModPort	principal.port
FailureReason	Data/FailureReason	security_result.description
RemoteEMPrincipalName	Data/RemoteEMPrincipalName	target.hostname
RemoteAddress	Data/RemoteAddress	target.ip
RemoteKeyModPort	Data/RemoteKeyModPort	target.port

Event ID 4985

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ProcessName	Data/ProcessName	principal.process.file.full_path
NewState		target.labels.key target.labels.value
ResourceManager		target.labels.key target.labels.value
TransactionId		target.labels.key target.labels.value
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5002

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 5005

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 5007

Provider: Microsoft Antimalware

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5009

Provider: Microsoft-Windows-WAS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
AppPoolID		target.resource.name

Event ID 5016

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
CSEExtensionName	Data/CSEExtensionName	target.resource.name
CSEExtensionId	Data/CSEExtensionId	target.resource.product_object_id

Event ID 5017

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
OperationDescription	Data/OperationDescription	security_result.description
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
OperationElapsedTimeInMilliSeconds	Data/OperationElapsedTimeInMilliSeconds	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5024

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5025

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5027

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 5028

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 5029

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 5030

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 5031

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
		metadata.event_type = STATUS_UPDATE and security_result.action=BLOCK
Profiles		target.labels.key target.labels.value
Application	Data/Application	target.application

Event ID 5032

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE and security_result.action=BLOCK
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 5033

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5034

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5035

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 5037

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 5038

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_UNCATEGORIZED
param1	Data/param1	target.file.full_path

Event ID 5039

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = REGISTRY_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ProcessName	Data/ProcessName	principal.process.command_line
ProcessId	Data/ProcessId	principal.process.pid
ObjectPath	Data/ObjectPath	principal.registry.registry_key
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectVirtualPath	Data/ObjectVirtualPath	target.registry.registry_key

Event ID 5040

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
AuthenticationSetName	Data/AuthenticationSetName	target.resource.name
AuthenticationSetId	Data/AuthenticationSetId	target.resource.product_object_id

Event ID 5041

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
AuthenticationSetName	Data/AuthenticationSetName	target.resource.name
AuthenticationSetId	Data/AuthenticationSetId	target.resource.product_object_id

Event ID 5042

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
AuthenticationSetName	Data/AuthenticationSetName	target.resource.name
AuthenticationSetId	Data/AuthenticationSetId	target.resource.product_object_id

Event ID 5043

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
ConnectionSecurityRuleId	Data/ConnectionSecurityRuleId	security_result.rule_id
ConnectionSecurityRuleName	Data/ConnectionSecurityRuleName	security_result.rule_name

Event ID 5044

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
ConnectionSecurityRuleId	Data/ConnectionSecurityRuleId	security_result.rule_id
ConnectionSecurityRuleName	Data/ConnectionSecurityRuleName	security_result.rule_name

Event ID 5045

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
AuthenticationSetName	Data/AuthenticationSetName	target.resource.name
AuthenticationSetId	Data/AuthenticationSetId	target.resource.product_object_id

Event ID 5046

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
CryptographicSetName	Data/CryptographicSetName	target.resource.name
CryptographicSetId	Data/CryptographicSetId	target.resource.product_object_id

Event ID 5047

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
CryptographicSetName	Data/CryptographicSetName	target.resource.name
CryptographicSetId	Data/CryptographicSetId	target.resource.product_object_id

Event ID 5048

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
CryptographicSetName	Data/CryptographicSetName	target.resource.name
CryptographicSetId	Data/CryptographicSetId	target.resource.product_object_id

Event ID 5049

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_DELETION
IpSecSecurityAssociationName	Data/IpSecSecurityAssociationName	target.resource.name
IpSecSecurityAssociationId	Data/IpSecSecurityAssociationId	target.resource.product_object_id

Event ID 5050

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP target.application = "Windows Firewall"
CallerProcessName	Data/CallerProcessName	principal.process.command_line
ProcessId	Data/ProcessId	principal.process.pid

Event ID 5051

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
FileName	Data/FileName	principal.file.full_path
ProcessName	Data/ProcessName	principal.process.file.full_path
ProcessId	Data/ProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
VirtualFileName	Data/VirtualFileName	target.file.full_path

Event ID 5056

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
Module	Data/Module	target.resource.name

Event ID 5057

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
Reason	Data/Reason	security_result.description

Event ID 5058

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
KeyUserPath	Data/KeyFilePath	target.file.full_path and security_result.about.file.full_path
KeyName	Data/KeyName	target.resource.name
ProviderName	Data/ProviderName	target.resource.attribute.labels.key/value
AlgorithmName	Data/AlgorithmName	target.resource.attribute.labels.key/value
KeyType	Data/KeyType	target.resource.attribute.labels.key/value
ReturnCode	Data/ReturnCode	target.labels.key/value
Operation	Data/Operation	target.resource.attribute.labels.key/value

version 1 /

NXLog field	Event Viewer field	UDM field
ClientProcessId	Data/ClientProcessId	principal.process.pid
ClientCreationTime	Data/ClientCreationTime	principal.labels.key/value

Event ID 5059

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ReturnCode	Data/ReturnCode	security_result.summary Format: Error Code - %{value}
KeyName	Data/KeyName	target.resource.name

version 1 /

NXLog field	Event Viewer field	UDM field
ClientProcessId	Data/ClientProcessId	target.process.pid

Event ID 5060

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
Reason	Data/Reason	security_result.description

Event ID 5061

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
Operation	Data/Operation	security_result.description
ReturnCode	Data/ReturnCode	security_result.summary Format: Return Code - %{value}
KeyName	Data/KeyName	target.resource.name
AlgorithmName		target.resource.attribute.labels.key target.resource.attribute.labels.value
KeyName		target.resource.name
KeyType		target.resource.resource_subtype

Event ID 5062

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5063

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ModuleName	Data/ModuleName	target.resource.name

Event ID 5064

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5065

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5066

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5067

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5068

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5069

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5070

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5071

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED security_result.action = BLOCK
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5074

Provider: Microsoft-Windows-WAS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_process_pid set to target.process.pid
AppPoolID		target.resource.name

Event ID 5077

Provider: Microsoft-Windows-WAS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_process_pid set to target.process.pid
AppPoolID		target.resource.name

Event ID 5116

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 5117

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 5120

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5121

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5122

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5123

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
PropertyName	Data/PropertyName	target.resource.name

Event ID 5124

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5125

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5126

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED

Event ID 5127

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED

Event ID 5136

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_MODIFICATION (ObjectClass="group") metadata.event_type = USER_RESOURCE_UPDATE_CONTENT (other ObjectClass)
ObjectGUID	Data/ObjectGUID	based on type of object class. target.group.product_object_id (ObjectClass="group") target.resource.product_object_id (other ObjectClass)
AttributeValue	Data/AttributeValue	If AttributeLDAPDisplayName is "member" then attribute_value set to target.user.user_display_name, else attribute_value set to target.resource.name
ObjectDN	Data/ObjectDN	If ObjectClass is "group" then object_name set to target.group.group_display_name
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
OperationType		about.labels.key about.labels.value
DSName		target.administrative_domain
OpCorrelationID		about.labels.key/value
AppCorrelationID		about.labels.key/value
DSType		target.labels.key/value
ObjectClass		target.labels.key/value
AttributeLDAPDisplayName		about.labels.key/value
AttributeSyntaxOID		about.labels.key/value

Event ID 5137

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  SETTING_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectGUID	Data/ObjectGUID	target.resource.product_object_id
DSName	Data/DSName	target.administrative_domain
DSType	Data/DSType	target.application
OpCorrelationID		about.labels.key/value
AppCorrelationID		about.labels.key/value
ObjectDN		target.labels.key/value additional.fields.key additional.fields.value.string_value
ObjectClass		target.labels.key/value

Event ID 5138

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  SETTING_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectGUID	Data/ObjectGUID	target.resource.product_object_id

Event ID 5139

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  SETTING_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectGUID	Data/ObjectGUID	target.resource.product_object_id
OldObjectDN	Data/OldObjectDN	target.labels.key/value additional.fields.key additional.fields.value.string_value
NewObjectDN	Data/NewObjectDN	additional.fields.key additional.fields.value.string_value If ObjectClass = "computer", object_name is set to target.hostname If ObjectClass = "user", object_name is set to target.user.user_display_name. If ObjectClass = "group", object_name is set to target.group.group_display_name.
ObjectClass	Data/ObjectClass	additional.fields.key additional.fields.value.string_value

Provider: Microsoft-Windows-WAS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_process_pid set to target.process.pid
ProtocolID		network.application_protocol
AppPoolID		target.resource.name

Event ID 5140

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
IpAddress	Data/IpAddress	principal.ip
IpPort	Data/IpPort	principal.port
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ShareName	Data/ShareName	target.resource.name

version 1 /

NXLog field	Event Viewer field	UDM field
ShareLocalPath	Data/ShareLocalPath	target.file.full_path
AccessList	Data/AccessList	target.resource.attribute.permissions.name

Event ID 5141

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value additional.fields.key additional.fields.value.string_value
ObjectGUID	Data/ObjectGUID	target.resource.product_object_id
ObjectClass	Data/ObjectClass	target.labels.key/value additional.fields.key additional.fields.value.string_value
ObjectDN	Data/ObjectDN	If ObjectClass == "group" then object_name is set to target.group.group_display_name If ObjectClass = "computer", then object_name is set to target.hostname If ObjectClass = "user", then object_name is set to target.user.user_display_name else ObjectDN is set to target.labels.key/value ObjectClass is set to target.labels.key/value ObjectDN is set to additional.fields.key and additional.fields.value.string_value ObjectClass is set to additional.fields.key and additional.fields.value.string_value
ObjectDN	Data/ObjectDN	additional.fields.key additional.fields.value.string_value
DSName	Data/DSName	target.administrative_domain
DSType	Data/DSType	target.application
OpCorrelationID		about.labels.key/value
AppCorrelationID		about.labels.key/value

Event ID 5142

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  USER_RESOURCE_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ShareName	Data/ShareName	target.resource.name

Event ID 5143

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  USER_RESOURCE_UPDATE_CONTENT
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ShareLocalPath	Data/ShareLocalPath	target.file.full_path
ShareName	Data/ShareName	target.resource.name
OldRemark		target.resource.attribute.labels.key target.resource.attribute.labels.value
NewRemark		target.resource.attribute.labels.key target.resource.attribute.labels.value
OldMaxUsers		target.resource.attribute.labels.key target.resource.attribute.labels.value
NewMaxUsers		target.resource.attribute.labels.key target.resource.attribute.labels.value
OldShareFlags		target.resource.attribute.labels.key target.resource.attribute.labels.value
NewShareFlags		target.resource.attribute.labels.key target.resource.attribute.labels.value
OldSD		target.resource.attribute.labels.key target.resource.attribute.labels.value
NewSD		target.resource.attribute.labels.key target.resource.attribute.labels.value
ObjectType		target.resource.resource_subtype

Event ID 5144

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type =  USER_RESOURCE_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ShareLocalPath	Data/ShareLocalPath	target.file.full_path
ShareName	Data/ShareName	target.resource.name

Event ID 5145

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
IpAddress	Data/IpAddress	principal.ip
IpPort	Data/IpPort	principal.port
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
AccessReason	Data/AccessReason	security_result.description
ShareLocalPath	Data/ShareLocalPath	target.file.full_path
AccessList	Data/AccessList	target.resource.attribute.permissions.name
ShareName	Data/ShareName	target.resource.name
RelativeTargetName	Data/RelativeTargetName	target.file.names

Event ID 5146

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED security_result.action = BLOCK
Direction	Data/Direction	network.direction
EtherType	Data/EtherType	network.ip_protocol
SourceAddress	Data/SourceAddress	principal.ip
SourcevSwitchPort	Data/SourcevSwitchPort	principal.port
DestAddress	Data/DestAddress	target.ip
DestinationvSwitchPort	Data/DestinationvSwitchPort	target.port

Event ID 5147

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED security_result.action = BLOCK
Direction	Data/Direction	network.direction
EtherType	Data/EtherType	network.ip_protocol
SourceAddress	Data/SourceAddress	principal.ip
DestAddress	Data/DestAddress	target.ip

Event ID 5148

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.category=NETWORK_DENIAL_OF_SERVICE security_result.action = BLOCK

Event ID 5149

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = ALLOW

Event ID 5150

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED security_result.action = BLOCK
Direction	Data/Direction	network.direction
EtherType	Data/EtherType	network.ip_protocol
SourceAddress	Data/SourceAddress	principal.ip
DestAddress	Data/DestAddress	target.ip

Event ID 5151

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED security_result.action = BLOCK
Direction	Data/Direction	network.direction
EtherType	Data/EtherType	network.ip_protocol
SourceAddress	Data/SourceAddress	principal.ip
DestAddress	Data/DestAddress	target.ip

Event ID 5152

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED security_result.action = BLOCK
Direction	Data/Direction	network.direction
Protocol	Data/Protocol	network.ip_protocol
Application	Data/Application	principal.application
SourceAddress	Data/SourceAddress	principal.ip
SourcePort	Data/SourcePort	principal.port
ProcessId	Data/ProcessId	principal.process.pid
FilterRTID	Data/FilterRTID	security_result.detection_fields.key/value
LayerName	Data/LayerName	security_result.detection_fields.key/value
LayerRTID	Data/LayerRTID	security_result.detection_fields.key/value
DestAddress	Data/DestAddress	target.ip
DestPort	Data/DestPort	target.port

version 1 / Windows 11 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
FilterOrigin	Data/FilterOrigin	security_result.detection_fields.key/value

Event ID 5153

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION security_result.action = BLOCK
Direction	Data/Direction	network.direction
Protocol	Data/Protocol	network.ip_protocol
SourceAddress	Data/SourceAddress	principal.ip
SourcePort	Data/SourcePort	principal.port
ProcessId	Data/ProcessId	principal.process.pid
Application	Data/Application	target.application
FilterRTID	Data/FilterRTID	security_result.detection_fields.key/value
LayerName	Data/LayerName	security_result.detection_fields.key/value
LayerRTID	Data/LayerRTID	security_result.detection_fields.key/value
DestAddress	Data/DestAddress	target.ip
DestPort	Data/DestPort	target.port

version 1 / Windows 11 and Windows Server 2022/

NXLog field	Event Viewer field	UDM field
FilterOrigin	Data/FilterOrigin	security_result.detection_fields.key/value

Event ID 5154

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = ALLOW
Protocol	Data/Protocol	network.ip_protocol
FilterRTID		security_result.detection_fields.key security_result.detection_fields.value
LayerName		security_result.detection_fields.key security_result.detection_fields.value
LayerRTID		security_result.detection_fields.key security_result.detection_fields.value
Application	Data/Application	target.application
SourceAddress	Data/SourceAddress	target.ip
SourcePort	Data/SourcePort	target.port
ProcessId	Data/ProcessId	target.process.pid

Event ID 5155

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = BLOCK
Protocol	Data/Protocol	network.ip_protocol
SourceAddress	Data/SourceAddress	principal.ip
SourcePort	Data/SourcePort	principal.port
ProcessId	Data/ProcessId	principal.process.pid
Application	Data/Application	target.application

Event ID 5156

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION security_result.action = ALLOW
Direction	Data/Direction	network.direction
Protocol	Data/Protocol	network.ip_protocol
Application	Data/Application	principal.application
SourceAddress	Data/SourceAddress	principal.ip
SourcePort	Data/SourcePort	principal.port
ProcessId	Data/ProcessId	principal.process.pid
FilterRTID	Data/FilterRTID	security_result.detection_fields.key/value
LayerName	Data/LayerName	security_result.detection_fields.key/value
LayerRTID	Data/LayerRTID	security_result.detection_fields.key/value
DestAddress	Data/DestAddress	target.ip
DestPort	Data/DestPort	target.port

version 1 /

NXLog field	Event Viewer field	UDM field
RemoteUserID	Data/RemoteUserID	target.user.userid
RemoteMachineID	Data/RemoteMachineID	target.user.windows_sid

Event ID 5157

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION security_result.action = BLOCK
Direction	Data/Direction	network.direction
Protocol	Data/Protocol	network.ip_protocol
Application	Data/Application	principal.application
SourceAddress	Data/SourceAddress	principal.ip
SourcePort	Data/SourcePort	principal.port
ProcessId	Data/ProcessId	principal.process.pid
DestAddress	Data/DestAddress	target.ip
DestPort	Data/DestPort	target.port
FilterRTID	Data/FilterRTID	security_result.detection_fields.key/value
LayerName	Data/LayerName	security_result.detection_fields.key/value
LayerRTID	Data/LayerRTID	security_result.detection_fields.key/value

version 1 /

NXLog field	Event Viewer field	UDM field
FilterOrigin	Data/FilterOrigin	security_result.detection_fields.key/value
RemoteUserID	Data/RemoteUserID	target.user.userid
RemoteMachineID	Data/RemoteMachineID	target.user.windows_sid

Event ID 5158

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = ALLOW
Protocol	Data/Protocol	network.ip_protocol
FilterRTID		security_result.detection_fields.key security_result.detection_fields.value
LayerName		security_result.detection_fields.key security_result.detection_fields.value
LayerRTID		security_result.detection_fields.key security_result.detection_fields.value
Application	Data/Application	target.application
SourceAddress	Data/SourceAddress	target.ip
SourcePort	Data/SourcePort	target.port
ProcessId	Data/ProcessId	target.process.pid

Event ID 5159

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE security_result.action = BLOCK
Protocol	Data/Protocol	network.ip_protocol
Application	Data/Application	target.application
SourceAddress	Data/SourceAddress	target.ip
SourcePort	Data/SourcePort	target.port
ProcessId	Data/ProcessId	target.process.pid

Event ID 5168

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
IpAddresses	Data/IpAddresses	target.ip
ErrorCode		target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5169

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
DSName	Data/DSName	target.application
ObjectGUID	Data/ObjectGUID	target.resource.product_object_id

Event ID 5170

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_MODIFICATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
DSName	Data/DSName	target.application
ObjectGUID	Data/ObjectGUID	target.resource.product_object_id

Event ID 5186

Provider: Microsoft-Windows-WAS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Event ID 5257

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 5308

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
DCName	Data/DCName	target.administrative_domain
DCIPAddress	Data/DCIPAddress	target.ip

Event ID 5309

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
MachineRole	Data/MachineRole	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5310

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
PrincipalCNName	Data/PrincipalCNName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
DCDomainName	Data/DCDomainName	target.administrative_domain
DCName	Data/DCName	target.hostname

Event ID 5311

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
PolicyProcessingMode	Data/PolicyProcessingMode	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5312

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
DescriptionString	Data/DescriptionString	security_result.description

Event ID 5313

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
DescriptionString	Data/DescriptionString	security_result.description
GPOInfoList	Data/GPOInfoList	target.resource.name

Event ID 5314

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
LinkDescription	Data/LinkDescription	security_result.description
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
PolicyApplicationMode	Data/PolicyApplicationMode	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5315

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
PrincipalSamName	Data/PrincipalSamName	target.hostname

Event ID 5320

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
InfoDescription	Data/InfoDescription	security_result.description

Event ID 5321

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
InfoDescription	Data/InfoDescription	security_result.description
OperationParameter1	Data/OperationParameter1	target.resource.product_object_id

Event ID 5324

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SessionId	Data/SessionId	network.session_id
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 5326

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
DCDiscoveryTimeInMilliSeconds	Data/DCDiscoveryTimeInMilliSeconds	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5327

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
NetworkBandwidthInKbps	Data/NetworkBandwidthInKbps	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5340

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
PolicyApplicationMode	Data/PolicyApplicationMode	target.resource.attribute.labels.key target.resource.attribute.labels.value

Event ID 5351

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid

Event ID 5376

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
BackupFileName	Data/BackupFileName	target.file.full_path
ClientProcessId	Data/ClientProcessId	target.process.pid

Event ID 5377

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
BackupFileName	Data/BackupFileName	target.file.full_path
ClientProcessId	Data/ClientProcessId	target.process.pid

Event ID 5378

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED and security_result.category=POLICY_VIOLATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
TargetServer	Data/TargetServer	target.hostname
UserUPN	Data/UserUPN	target.user.userid

Event ID 5379

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = RESOURCE_READ target.resource.name = Credential Manager credentials
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClientProcessId	Data/ClientProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5380

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClientProcessId	Data/ClientProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5381

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClientProcessId	Data/ClientProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid

Event ID 5382

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClientProcessId	Data/ClientProcessId	principal.process.pid
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
Resource	Data/Resource	target.resource.name

Event ID 5440

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5441

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5442

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5443

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5444

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5446

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessId	Data/ProcessId	principal.process.pid
UserName	Data/UserName	principal.user.userid
UserSid	Data/UserSid	principal.user.windows_sid

Event ID 5447

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type set to SETTING
ProviderKey	Data/ProviderKey	about.resource.attribute.labels.key / value
ProviderName	Data/ProviderName	about.resource.attribute.labels.key / value
ChangeType	Data/ChangeType	about.resource.attribute.labels.key / value
FilterKey	Data/FilterKey	about.resource.attribute.labels.key / value
FilterType	Data/FilterType	about.resource.attribute.labels.key / value
LayerKey	Data/LayerKey	about.resource.attribute.labels.key / value
LayerName	Data/LayerName	about.resource.attribute.labels.key / value
LayerId	Data/LayerId	about.resource.attribute.labels.key / value
Weight	Data/Weight	about.resource.attribute.labels.key / value
Conditions	Data/Conditions	about.resource.attribute.labels.key / value
Action	Data/Action	about.resource.attribute.labels.key / value
CalloutKey	Data/CalloutKey	about.resource.attribute.labels.key / value
CalloutName	Data/CalloutName	about.resource.attribute.labels.key / value
	Data/ProcessId	principal.process.pid
UserName	Data/UserName	principal.user.userid
UserSid	Data/UserSid	principal.user.windows_sid
FilterName	Data/FilterName	target.resource.name
FilterId	Data/FilterId	target.resource.product_object_id

Event ID 5448

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessId	Data/ProcessId	principal.process.pid
UserName	Data/UserName	principal.user.userid
UserSid	Data/UserSid	principal.user.windows_sid

Event ID 5449

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessId	Data/ProcessId	principal.process.pid
UserName	Data/UserName	principal.user.userid
UserSid	Data/UserSid	principal.user.windows_sid

Event ID 5450

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessId	Data/ProcessId	principal.process.pid
UserName	Data/UserName	principal.user.userid
UserSid	Data/UserSid	principal.user.windows_sid

Event ID 5451

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
IpProtocol	Data/IpProtocol	network.ip_protocol
LocalAddress	Data/LocalAddress	principal.ip
LocalPort	Data/LocalPort	principal.port
RemoteAddress	Data/RemoteAddress	target.ip
RemotePort	Data/RemotePort	target.port

Event ID 5452

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
IpProtocol	Data/IpProtocol	network.ip_protocol
LocalAddress	Data/LocalAddress	principal.ip
LocalPort	Data/LocalPort	principal.port
RemoteAddress	Data/RemoteAddress	target.ip
RemotePort	Data/RemotePort	target.port

Event ID 5453

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5456

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Policy	Data/Policy	target.resource.name

Event ID 5457

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Policy	Data/Policy	target.resource.name

Event ID 5458

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Policy	Data/Policy	target.resource.name

Event ID 5459

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary Format - Error Code: %{value}
Policy	Data/Policy	target.resource.name

Event ID 5460

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Policy	Data/Policy	target.resource.name

Event ID 5461

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary Format - Error Code: %{value}
Policy	Data/Policy	target.resource.name

Event ID 5462

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary Format - Error Code: %{value}
Policy	Data/Policy	target.resource.name

Event ID 5463

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5464

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5465

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5466

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5467

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5468

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5471

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Policy	Data/Policy	target.resource.name

Event ID 5472

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary Format - Error Code: %{value}
Policy	Data/Policy	target.resource.name

Event ID 5473

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Policy	Data/Policy	target.resource.name

Event ID 5474

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary Format - Error Code: %{value}
Policy	Data/Policy	target.resource.name

Event ID 5477

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5478

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.application = "IPsec Policy Agent service"

Event ID 5479

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP target.application = "IPsec Policy Agent service"

Event ID 5480

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5483

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary Format - Error Code: %{value}

Event ID 5484

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Error	Data/Error	security_result.summary Format - Error Code: %{value}

Event ID 5485

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5615

Provider: Microsoft-Windows-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.application = "Windows Management Instrumentation"
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 5617

Provider: Microsoft-Windows-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.application = "Windows Management Instrumentation"
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 5632

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
LocalMac	Data/LocalMac	principal.mac
SubjectUserName	Data/SubjectUserName	principal.user.userid
ReasonText	Data/ReasonText	security_result.description
PeerMac	Data/PeerMac	target.mac

Event ID 5633

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_CONNECTION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
ReasonText	Data/ReasonText	security_result.description

Event ID 5712

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessName	Data/ProcessName	principal.process.file.full_path
SubjectUserSid		principal.user.windows_sid
SubjectUserName		principal.user.userid
SubjectDomainName		principal.administrative_domain
ProcessId	Data/ProcessId	principal.process.pid
RemoteIpAddress	Data/RemoteIpAddress	target.ip
RemotePort	Data/RemotePort	target.port

Event ID 5719

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5721

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5722

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data_2		security_result.summary Format: %{Data_2} - %{Extract description from Message}
Data		target.hostname

Event ID 5723

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data		target.hostname

Event ID 5774

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5775

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5781

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5782

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5802

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5805

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data		target.hostname

Event ID 5807

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5823

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 5827

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Data		target.hostname

Event ID 5830

Provider: NETLOGON

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target_hostname set to target.hostname

Event ID 5857

Provider: Microsoft-Windows-WMI-Activity

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessID	Data/ProcessID	target.process.pid
Code	Data/Code	security_result.summary is set to "Code - %{Code}"
HostProcess	Data/HostProcess	target.process.file.full_path
ProviderPath	Data/ProviderPath	target.file.full_path

Event ID 5858

Provider: Microsoft-Windows-WMI-Activity

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ClientMachine	Data/ClientMachine	principal.hostname
User	Data/User	principal.user.windows_sid
ClientProcessId	Data/ClientProcessId	principal.process.pid
PossibleCause	Data/PossibleCause	security_result.description

Event ID 5859

Provider: Microsoft-Windows-WMI-Activity

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
NamespaceName	Data/NamespaceName	target.file.full_path
User	Data/User	principal.user.windows_sid
ProcessID	Data/ProcessID	target.process.pid
PossibleCause	Data/PossibleCause	security_result.description

Event ID 5860

Provider: Microsoft-Windows-WMI-Activity

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
NamespaceName	Data/NamespaceName	target.file.full_path
User	Data/User	principal.user.windows_sid
Processid	Data/User	target.process.pid
ClientMachine	Data/ClientMachine	principal.hostname
PossibleCause	Data/PossibleCause	security_result.description

Event ID 5861

Provider: Microsoft-Windows-WMI-Activity

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.application" set to "%{SourceName}" security_result.summary" set to "%{Channel}"
Message	System/Message	Namespace set to target.file.full_path
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
PossibleCause	Data/PossibleCause	security_result.description

Event ID 5888

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_UPDATE_CONTENT
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ObjectCollectionName	Data/ObjectCollectionName	target.resource.name
ModifiedObjectProperties	Data/ModifiedObjectProperties	We can use target.resource.attribute.labels.key/value UDM mappings as follows (check whether it is possible by using kv in conf): target.resource.attribute.labels.key = "<Property_Name>_OLD_VALUE" target.resource.attribute.labels.value= "<OLD_VALUE>" target.resource.attribute.labels.key = "<Property_Name>_NEW_VALUE" target.resource.attribute.labels.value= "<NEW_VALUE>"

Event ID 5889

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_DELETION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
ObjectCollectionName		target.resource.name

Event ID 5890

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_CREATION
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ObjectCollectionName	Data/ObjectCollectionName	target.resource.name
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value

Event ID 6000

Windows 10 client / Provider: Microsoft-Windows-Winlogon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target.application = "winlogon notification subscriber"

Provider: Microsoft-Windows-Eventlog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Channel	Data/Channel	target.file.full_path

Event ID 6001

Windows 10 client / Provider: Microsoft-Windows-Winlogon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target.application = "winlogon notification subscriber"

Event ID 6003

Windows 10 client / Provider: Microsoft-Windows-Winlogon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target.application = "winlogon notification subscriber"

Event ID 6005

Windows Server 2019 / Provider: Microsoft-Windows-Winlogon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target.application = "winlogon notification subscriber"

Provider: EventLog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
		metadata.event_type = SERVICE_START target.application = "%{SourceName}"
SourceName		target.application

Event ID 6006

Windows 10 client / Provider: EventLog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
SourceName		target.application
		metadata.event_type = SERVICE_STOP target.application = "%{SourceName}"

Provider: Microsoft-Windows-W3LOGSVC

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
Message		security_result.summary
SourceName		target.application
ProcessId		target.process.pid

Event ID 6008

Provider: EventLog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP target.application = "%{SourceName}"

Event ID 6009

Provider: EventLog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6011

Provider: EventLog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		Extract hostnames and map old value with principal.hostname and new modified value to target.hostname

Event ID 6013

Provider: EventLog

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6038

Provider: LsaSrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6062

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 6100

Provider: Microsoft-Windows-Diagnostics-Networking

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 6144

Provider: LsaSrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode		security_result.detection_fields.key security_result.detection_fields.value

Event ID 6145

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6148

Provider: LsaSrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCAN_UNCATEGORIZED

Event ID 6149

Provider: LsaSrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCAN_UNCATEGORIZED

Event ID 6272

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action = ALLOW
SubjectMachineName	Data/SubjectMachineName	principal.user.userid
SubjectMachineSID	Data/SubjectMachineSID	principal.user.windows_sid
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value

Event ID 6273

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action = BLOCK
SubjectMachineName	Data/SubjectMachineName	principal.user.userid
SubjectMachineSID	Data/SubjectMachineSID	principal.user.windows_sid
Reason	Data/Reason	security_result.summary
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value

Event ID 6274

version 1 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action = BLOCK
SubjectMachineName	Data/SubjectMachineName	principal.user.userid
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value
SubjectMachineSID	Data/SubjectMachineSID	principal.user.windows_sid
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid

Event ID 6275

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS security_result.action = BLOCK
SubjectMachineName	Data/SubjectMachineName	principal.user.userid
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value
SubjectMachineSID	Data/SubjectMachineSID	principal.user.windows_sid
Reason	Data/Reason	security_result.summary
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid

Event ID 6276

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS security_result.action = QUARANTINE
MachineInventory	Data/MachineInventory	principal.asset.platform_software.platform_version
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value
SubjectMachineName	Data/SubjectMachineName	principal.user.userid
SubjectMachineSID	Data/SubjectMachineSID	principal.user.windows_sid
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid

Event ID 6277

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS security_result.action = ALLOW_WITH_MODIFICATION
CalledStationID	Data/CalledStationID	principal.asset.platform_software.platform_version
FullyQualifiedSubjectMachineName	Data/FullyQualifiedSubjectMachineName	principal.user.userid
SubjectMachineName	Data/SubjectMachineName	principal.user.windows_sid
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value

Event ID 6278

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS security_result.action = ALLOW
MachineInventory	Data/MachineInventory	principal.asset.platform_software.platform_version
SubjectMachineName	Data/SubjectMachineName	principal.user.userid
SubjectMachineSID	Data/SubjectMachineSID	principal.user.windows_sid
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid

Event ID 6279

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS security_result.action = BLOCK
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid
ClientName	Data/ClientName	principal.asset.attribute.labels.key/value

Event ID 6280

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_CHANGE_PERMISSIONS security_result.action = ALLOW
SubjectDomainName	Data/SubjectDomainName	target.administrative_domain
SubjectUserName	Data/SubjectUserName	target.user.userid
SubjectUserSid	Data/SubjectUserSid	target.user.windows_sid

Event ID 6281

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_UNCATEGORIZED
param1	Data/param1	target.file.full_path

Event ID 6313

Provider: ADSync

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		principal.administrative_domain

Event ID 6400

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ClientIPAddress	Data/ClientIPAddress	principal.ip

Event ID 6401

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ClientIPAddress	Data/ClientIPAddress	principal.ip

Event ID 6402

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ClientIPAddress	Data/ClientIPAddress	principal.ip

Event ID 6403

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6404

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.description set to Error Code - %{ErrorCode}

Event ID 6405

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6406

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6407

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6408

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6409

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 6410

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = FILE_UNCATEGORIZED
param1	Data/param1	target.file.full_path

Event ID 6416

version 0 / Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED resource.resource_type set to "DEVICE"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
ClassId	Data/ClassId	target.resource.attribute.labels.key target.resource.attribute.labels.value
VendorIds	Data/VendorIds	target.resource.attribute.labels.key target.resource.attribute.labels.value
CompatibleIds	Data/CompatibleIds	target.resource.attribute.labels.key target.resource.attribute.labels.value
LocationInformation	Data/LocationInformation	target.resource.attribute.labels.key target.resource.attribute.labels.value

version 1 /

NXLog field	Event Viewer field	UDM field
DeviceDescription	Data/DeviceDescription	target.resource.attribute.labels.key target.resource.attribute.labels.value
ClassName	Data/ClassName	target.resource.attribute.labels.key target.resource.attribute.labels.value
DeviceId	Data/DeviceId	target.resource.product_object_id

Event ID 6417

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessId	Data/ProcessId	principal.process.pid
ProcessName		principal.process.command_line

Event ID 6418

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ProcessId	Data/ProcessId	principal.process.pid
ProcessName		principal.process.command_line

Event ID 6419

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClassName		target.resource.attribute.labels.key target.resource.attribute.labels.value
ClassId		target.resource.attribute.labels.key target.resource.attribute.labels.value
CompatibleIds		target.resource.attribute.labels.key target.resource.attribute.labels.value
LocationInformation		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DeviceId	Data/DeviceId	target.resource.id
DeviceDescription	Data/DeviceDescription	target.resource.name

Event ID 6420

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS Set security_result.action="BLOCK"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClassName		target.resource.attribute.labels.key target.resource.attribute.labels.value
ClassId		target.resource.attribute.labels.key target.resource.attribute.labels.value
CompatibleIds		target.resource.attribute.labels.key target.resource.attribute.labels.value
LocationInformation		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DeviceId	Data/DeviceId	target.resource.id
DeviceDescription	Data/DeviceDescription	target.resource.name

Event ID 6421

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClassName		target.resource.attribute.labels.key target.resource.attribute.labels.value
ClassId		target.resource.attribute.labels.key target.resource.attribute.labels.value
CompatibleIds		target.resource.attribute.labels.key target.resource.attribute.labels.value
LocationInformation		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DeviceId	Data/DeviceId	target.resource.id
DeviceDescription	Data/DeviceDescription	target.resource.name

Event ID 6422

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS Set security_result.action="ALLOW"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
ClassName		target.resource.attribute.labels.key target.resource.attribute.labels.value
ClassId		target.resource.attribute.labels.key target.resource.attribute.labels.value
CompatibleIds		target.resource.attribute.labels.key target.resource.attribute.labels.value
LocationInformation		target.resource.attribute.labels.key target.resource.attribute.labels.value
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
SubjectLogonId	Data/SubjectLogonId	principal.labels.key/value
DeviceId	Data/DeviceId	target.resource.id
DeviceDescription	Data/DeviceDescription	target.resource.name

Event ID 6423

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS Set security_result.action="BLOCK"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
DeviceId	Data/DeviceId	target.resource.id
DeviceDescription	Data/DeviceDescription	target.resource.name

Event ID 6424

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_RESOURCE_ACCESS Set security_result.action="ALLOW"
SubjectDomainName	Data/SubjectDomainName	principal.administrative_domain
SubjectUserName	Data/SubjectUserName	principal.user.userid
SubjectUserSid	Data/SubjectUserSid	principal.user.windows_sid
DeviceId	Data/DeviceId	target.resource.id
DeviceDescription	Data/DeviceDescription	target.resource.name

Event ID 6946

Provider: ADSync

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.description

Event ID 6952

Provider: ADSync

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED If required fields for above mentioned metadata.event_type are not present, then set metadata.event_type to STATUS_UPDATE.
Data		security_result.description

Event ID 7000

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED Extract error and map it to security_result.summary
param1	Data/param1	target.application

Event ID 7001

Provider: Microsoft-Windows-Winlogon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
UserSid	Data/UserSid	principal.user.windows_sid

Event ID 7002

Provider: Microsoft-Windows-Winlogon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserSid	Data/UserSid	principal.user.windows_sid

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7003

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7005

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7009

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2	Data/param2	target.application

Event ID 7010

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7011

Windows Server 2019 / Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
param1	Data/param1	target.application
param2	Data/param2	additional.fields.key additional.fields.value.string_value

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7012

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7017

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7021

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary
		metadata.event_type = STATUS_UNCATEGORIZED
Data		target.hostname
Data_1		target.resource.name

Event ID 7022

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
param1	Not available	target.application

Event ID 7023

Windows 10 client / Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP Extract error and map it to security_result.summary
param1	Data/param1	target.application
param2	Data/param2	additional.fields.key additional.fields.value.string_value
		metadata.event_type = SERVICE_STOP
param2	Not available	security_result.description Format: Error Code - %{value}
param1	Not available	target.application

Event ID 7024

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
param2	Not available	security_result.description Format: Error Code - %{value}
param1	Not available	target.application

Event ID 7025

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Event ID 7026

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.resource.resource_type = DEVICE target.resource.resource_subtype = "boot-start or system-start driver"
param1	Not available	target.application

Event ID 7031

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
param1	Not available	target.application

Event ID 7032

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
param2	Not available	security_result.action_details
param4	Not available	security_result.description Error Code: %{value}
param3	Not available	target.application

Event ID 7034

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP security_result.action = BLOCK
param1	Not available	target.application

Event ID 7036

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		If the param2 log field value is equal to stopped, then the metadata.event_type UDM field is set to SERVICE_STOP. Else, if the param2 log field value is equal to start, then the metadata.event_type UDM field is set to SERVICE_START. Else, if the param2 log field value is equal to running, then the metadata.event_type UDM field is set to SERVICE_UNSPECIFIED.
param1	Not available	target.application
param2	Not available	security_result.action_details If the param2 log field value is equal to stopped, then the security_result.action UDM field is set to ALLOW.

Event ID 7038

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
param2		principal.hostname
param3		security_result.description Format: %{param3} - %{Extract description from Message}
param1		target.application

Event ID 7040

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_MODIFICATION
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param1	Data/param1	target.application
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	additional.fields.key additional.fields.value.string_value
param4	Data/param4	additional.fields.key additional.fields.value.string_value

Event ID 7042

Windows Server 2019 / Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param1	Data/param1	target.application
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	additional.fields.key additional.fields.value.string_value
param4	Data/param4	additional.fields.key additional.fields.value.string_value
param5	Data/param5	additional.fields.key additional.fields.value.string_value

Event ID 7045

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_CREATION
ServiceName	Data/ServiceName	target.application
ImagePath	Data/ImagePath	target.process.file.full_path
UserID	System/UserID	target.user.windows_sid
ServiceType		additional.fields.key additional.fields.value.string_value
StartType		additional.fields.key additional.fields.value.string_value

Event ID 8000

Provider: Netwtw10

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Status		security_result.summary

Event ID 8003

Provider: bowser

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Data_1		target.hostname
Data_2		target.resource.product_object_id

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId		security_result.rule_id
TargetUser		target.user.userid
TargetProcessId		target.process.pid
FullFilePath		target.process.file.full_path
FilePath		target.file.full_path
FileHash		target.file.sha256
Fqbn		target.group.group_display_name
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 8004

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId		security_result.rule_id
TargetUser		target.user.userid
TargetProcessId		target.process.pid
FullFilePath		target.process.file.full_path
FilePath		target.file.full_path
FileHash		target.file.sha256
Fqbn		target.group.group_display_name
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 8005

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.description
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
PrincipalSamName	Data/PrincipalSamName	target.hostname
TargetLogonId	Data/TargetLogonId	additional.fields.key additional.fields.value.string_value

Event ID 8006

Provider: Microsoft-Windows-GroupPolicy

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.attribute.roles.name
UserID	System/UserID	principal.user.windows_sid
ErrorCode	Data/ErrorCode	security_result.summary Format: ErrorCode - %{value}
PrincipalSamName	Data/PrincipalSamName	target.hostname

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId		security_result.rule_id
TargetUser		target.user.userid
TargetProcessId		target.process.pid
FullFilePath		target.process.file.full_path
FilePath		target.file.full_path
FileHash		target.file.sha256
Fqbn		target.group.group_display_name

Event ID 8007

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId		security_result.rule_id
TargetUser		target.user.userid
TargetProcessId		target.process.pid
FullFilePath		target.process.file.full_path
FilePath		target.file.full_path
FileHash		target.file.sha256
Fqbn		target.group.group_display_name

Event ID 8008

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 8009

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ErrorCode	Data/ErrorCode	security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8010

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8015

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8017

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8018

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8019

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8020

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8021

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: BROWSER

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId		security_result.rule_id
TargetUser		target.user.userid
TargetProcessId		target.process.pid
Fqbn		target.group.group_display_name

Event ID 8022

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId		security_result.rule_id
TargetUser		target.user.userid
TargetProcessId		target.process.pid
Fqbn		target.group.group_display_name

Event ID 8025

Provider: Microsoft-Windows-AppLocker

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
RuleId		security_result.rule_id
TargetUser		target.user.userid
TargetProcessId		target.process.pid
Fqbn		target.group.group_display_name

Event ID 8027

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8030

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 8033

Provider: Microsoft-Windows-DNS-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
DnsServerList		intermediary.ip
Ipaddress		target.ip
ErrorCode	Data/ErrorCode	security_result.summary security_result.summary set to ErrorCode - %{ErrorCode}

Event ID 8191

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 8193

Provider: VSS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target.application = %{SourceName}

Event ID 8198

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 8222

Provider: VSSAudit

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain		principal.administrative_domain
AccountType		principal.user.attribute.roles.name
Data_3		target.process.file.full_path
Data_8		target.resource.attribute.labels.key target.resource.attribute.labels.value
Data_9		target.resource.name

Event ID 8223

Provider: VSSAudit

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
Data_7		target.resource.attribute.labels.key target.resource.attribute.labels.value
Data_8		target.resource.name

Event ID 8224

Provider: VSS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
SourceName	Not available	target.application

Event ID 8225

Provider: VSS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
SourceName	Not available	target.application

Event ID 8230

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 9007

Provider: nhi

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 9008

Provider: nhi

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 9027

Provider: Desktop Window Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED

Event ID 10000

Windows Server 2019 / Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param1	Data/param1	target.process.command_line
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	additional.fields.key additional.fields.value.string_value

Provider: Microsoft-Windows-DriverFrameworks-UserMode

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
		target.resource.id

Event ID 10001

Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param1	Data/param1	target.process.command_line
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	target.application
param4	Data/param4	additional.fields.key additional.fields.value.string_value
param5	Data/param5	additional.fields.key additional.fields.value.string_value

Provider: Microsoft-Windows-WLAN-AutoConfig

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ExtensibleModulePath	Data/ExtensibleModulePath	target.process.file.full_path

Provider: Microsoft-Windows-DriverFrameworks-UserMode

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
ServiceName		target.application
CLSID		target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 10002

Provider: Microsoft-Windows-WLAN-AutoConfig

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ExtensibleModulePath	Data/ExtensibleModulePath	target.process.file.full_path

Provider: Microsoft-Windows-DriverFrameworks-UserMode

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
ServiceName		target.application
CLSID		target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 10004

Provider: Microsoft-Windows-WLAN-AutoConfig

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
ExtensibleModulePath		target.process.file.full_path

Event ID 10005

Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2	Data/param2	target.application
param3	Data/param3	additional.fields.key additional.fields.value.string_value
param3	Data/param3	additional.fields.key additional.fields.value.string_value

Event ID 10010

Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
param1	Data/param1	additional.fields.key additional.fields.value.string_value
UserID	System/UserID	principal.user.windows_sid

Event ID 10016

Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type set to SETTING
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param7	Data/param7	target.administrative_domain
param10	Data/param10	target.application
param1	Data/param1	target.resource.attribute.permissions.name
param2	Data/param2	additional.fields.key additional.fields.value.string_value
param3	Data/param3	additional.fields.key additional.fields.value.string_value
param4	Data/param4	additional.fields.key additional.fields.value.string_value
param5	Data/param5	target.resource.product_object_id
param6	Data/param6	target.user.userid
param8	Data/param8	target.user.windows_sid

Event ID 10100

Provider: Microsoft-Windows-DriverFrameworks-UserMode

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 10111

Provider: Microsoft-Windows-DriverFrameworks-UserMode

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
InstanceId		target.resource.id

Event ID 10118

Provider: Microsoft-Windows-DriverFrameworks-UserMode

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_AUDIT_LOG_UNCATEGORIZED

Event ID 10020

Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
param1	Data/param1	additional.fields.key additional.fields.value.string_value
param2		security_result.summary

Event ID 10028

Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = NETWORK_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
param3	Data/param3	principal.process.file.full_path
param2	Data/param2	principal.process.pid
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
param1	Data/param1	target.ip

Event ID 10036

Provider: Microsoft-Windows-DistributedCOM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Domain Name	Data/Domain Name	target.administrative_domain
Client IP Address	Data/Client IP Address	target.ip
User Name	Data/User Name	target.user.user_display_name
SID	Data/SID	target.user.windows_sid

Event ID 10110

Provider: Microsoft-Windows-DriverFrameworks-UserMode

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Status		security_result.summary

Event ID 10148

Windows 10 client / Provider: Microsoft-Windows-WinRM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 10149

Windows 10 client / Provider: Microsoft-Windows-WinRM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 10154

Windows 10 client / Provider: Microsoft-Windows-WinRM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 10317

Provider: Microsoft-Windows-NDIS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AdapterName		target.resource.name
UserID		principal.user.windows_sid

Event ID 10400

Provider: Microsoft-Windows-NDIS

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
AdapterName		target.resource.name

Event ID 11707

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Message		target.application Extract product_name from Message field and map it to target.application
AccountType		principal.user.attribute.roles.name

Event ID 12294

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
UserName		target.user.userid

Event ID 14204

Provider: Microsoft-Windows-WMPNSS-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
ServiceName		target.application

Event ID 14205

Provider: Microsoft-Windows-WMPNSS-Service

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_STOP
ServiceName		target.application

Event ID 14531

Provider: Microsoft-Windows-DfsSvc

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 14533

Provider: Microsoft-Windows-DfsSvc

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 14554

Provider: Microsoft-Windows-DfsSvc

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 15007

Provider: Microsoft-Windows-HttpEvent

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Url	Data/Url	target.url

Event ID 15008

Provider: Microsoft-Windows-HttpEvent

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Url	Data/Url	target.url

Event ID 15021

Provider: Microsoft-Windows-HttpEvent

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Endpoint		target.ip and target.port
DeviceObject		target.resource.name

Event ID 15301

Provider: Microsoft-Windows-HttpEvent

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_CREATION
Endpoint	Data/Endpoint	target.ip and target.port

Event ID 16384

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = SERVICE_START target.application = "Software Protection"

version 0 / Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Title	Data/Title	security_result.summary
User	Data/User	target.user.userid

Event ID 16385

version 0 / Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Id	Data/Id	target.resource.product_object_id
Title	Data/Title	target.resource.name
User	Data/User	target.user.userid
FileList	Data/FileList	target.file.full_path

Event ID 16388

version 0 / Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Title	Data/Title	security_result.summary
User	Data/User	target.user.userid

Event ID 16392

version 0 / Provider: Microsoft-Windows-Bits-Client

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
ErrorCode	Data/ErrorCode	security_result.summary is set to "ErrorCode: %{ErrorCode}"

Event ID 16394

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
	Not available	metadata.event_type = STATUS_UPDATE

Event ID 16401

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorMessage	Data/ErrorMessage	security_result.description
GroupName	Data/GroupName	target.group.group_display_name

Event ID 16413

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = GROUP_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
ErrorString	Data/ErrorString	security_result.description
GroupName	Data/GroupName	target.group.group_display_name

Event ID 16647

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 16648

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 16962

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 16963

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Registry SD String	Data/Registry SD String	target.registry.registry_value_name

Event ID 16966

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
UserID	System/UserID	principal.user.windows_sid

Event ID 16969

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 16977

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

version 0 / Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING

Event ID 16978

version 0 / Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING
AccountName	Data/AccountName	target.user.userid

Event ID 16979

version 0 / Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type = SETTING

Event ID 16982

version 0 / Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED

Event ID 16983

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

version 0 / Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 16984

Provider: Microsoft-Windows-Directory-Services-SAM

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 18452

Provider: MSSQL$ENTERPRISE191

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN, If complete_username or database_name is not empty, otherwise metadata.event_type = USER_UNCATEGORIZED security_result.category = AUTH_VIOLATION
Message	System/Message	client_ip set to principal.ip database_name set to target.hostname
SourceName	System/SourceName	principal.application

Event ID 18456

Provider: MSSQL$ENTERPRISE100

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN, if complete_username or database_name is not empty, otherwise metadata.event_type = USER_UNCATEGORIZED security_result.category = AUTH_VIOLATION
Message	System/Message	client_ip set to principal.ip database_name set to target.hostname complete_username set to target.user.userid (if UserID is empty)
SourceName	System/SourceName	principal.application

Provider: MSSQLSERVER

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN, if complete_username or database_name is not empty, otherwise metadata.event_type = USER_UNCATEGORIZED security_result.category = AUTH_VIOLATION
Message	System/Message	client_ip set to principal.ip database_name set to target.hostname complete_username set to target.user.userid (if UserID is empty)
SourceName	System/SourceName	principal.application

Event ID 20001

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE target_resource_name set to target.resource.name
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid

Event ID 20003

Provider: Microsoft-Windows-UserPnp

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE Category set to security_result.category_details Message set to metadata.description target_resource_name set to target.resource.name
		metadata.event_type = STATUS_UPDATE target_resource_name set to target.resource.name

Event ID 20063

Provider: RemoteAccess

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 20171

Provider: RemoteAccess

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 20192

Provider: RemoteAccess

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 28680

Provider: PRIVMAN

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 28701

Provider: PRIVMAN

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_HEARTBEAT target_hostname set to target.hostname target_ip set to target.ip
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 33205

Provider: MSSQL$LABX2010$AUDIT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: MSSQL$SQL16$AUDIT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED target_resource_name set to target.resource.name
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: MSSQL$SYNEL$AUDIT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Provider: MSSQLSERVER$AUDIT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36867

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36868

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
CSPName		target.resource.name
KeyName		target.resource.product_object_id

Event ID 36870

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36871

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36874

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36877

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36880

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36881

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36882

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary
		metadata.event_type = STATUS_UNCATEGORIZED Message set to security_result.summary
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36886

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36887

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 36888

Provider: Schannel

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountType	System/AccountType	principal.user.attribute.roles.name
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid

Event ID 40960

Provider: LsaSrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SYSTEM_AUDIT_LOG_UNCATEGORIZED
Domain	System/Domain	principal.administrative_domain
AccountName	System/AccountName	principal.user.userid
UserID	System/UserID	principal.user.windows_sid
Error		security_result.summary
Target		target.hostname

Event ID 40970

Provider: LsaSrv

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Target	Data/Target	network.application_protocol/target.hostname/target.administrative_domain
Error	Data/Error	security_result.summary

Event ID 2147487656

version 0 / Provider: Microsoft-Windows-Winlogon

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE

Event ID 3221228478

Provider: Microsoft-Windows-Wininit

NXLog field	Event Viewer field	UDM field
		metadata.event_type = metadata.event_type = STATUS_SHUTDOWN security_result.description" set to "ErrorCode - %{error_code}"

Event ID 5447

Provider: Microsoft Corporation

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SETTING_MODIFICATION target.resource.resource_type set to SETTING
ProviderKey	Data/ProviderKey	about.resource.attribute.labels.key/value
ProviderName	Data/ProviderName	about.resource.attribute.labels.key/value
ChangeType	Data/ChangeType	about.resource.attribute.labels.key/value
FilterKey	Data/FilterKey	about.resource.attribute.labels.key/value
FilterType	Data/FilterType	about.resource.attribute.labels.key/value
LayerKey	Data/LayerKey	about.resource.attribute.labels.key/value
LayerName	Data/LayerName	about.resource.attribute.labels.key/value
LayerId	Data/LayerId	about.resource.attribute.labels.key/value
Weight	Data/Weight	about.resource.attribute.labels.key/value
Conditions	Data/Conditions	about.resource.attribute.labels.key/value
Action	Data/Action	about.resource.attribute.labels.key/value
	Data/ProcessId	principal.process.pid
UserName	Data/UserName	principal.user.userid
UserSid	Data/UserSid	principal.user.windows_sid
FilterName	Data/FilterName	target.resource.name
FilterId	Data/FilterId	target.resource.product_object_id

Event ID 403

Provider: PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description NewEngineState is set to target.labels.key/value PreviousEngineState is set to target.labels.key/value HostName is set to additional.fields.key/value.string_value HostVersion is set to target.labels.key/value HostId is set to target.labels.key/value HostApplication is set to principal.process.command_line EngineVersion is set to target.labels.key/value RunspaceId is set to target.labels.key/value PipelineId is set to target.labels.key/value CommandName is set to target.labels.key/value CommandType is set to target.labels.key/value ScriptName is set to target.file.names CommandPath is set to target.process.file.full_path CommandLine is set to target.process.command_line NewEngineState is set to additional.fields.key and additional.fields.value.string_value PreviousEngineState is set to additional.fields.key and additional.fields.value.string_value HostVersion is set to additional.fields.key and additional.fields.value.string_value HostId is set to additional.fields.key and additional.fields.value.string_value EngineVersion is set to additional.fields.key and additional.fields.value.string_value RunspaceId is set to additional.fields.key and additional.fields.value.string_value PipelineId is set to additional.fields.key and additional.fields.value.string_value CommandName is set to additional.fields.key and additional.fields.value.string_value CommandType is set to additional.fields.key and additional.fields.value.string_value

Event ID 4105

Provider: Microsoft-Windows-PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
UserID		principal.user.windows_sid
Domain		principal.administrative_domain
ScriptBlockId		principal.resource.product_object_id
SourceName		target.application
Category		security_result.summary
Message		security_result.description
ProcessID		principal.process.pid
AccountType		principal.user.userid
RunspaceId		target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 105

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description pid is set to target.process.pid additional_data is set to about.labels.key/value additional_data is set to additional.fields.key and additional.fields.value.string_value

Event ID 4440

Provider: Microsoft-Windows-Complus

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description
param1		target.labels.key/value additional.fields.key additional.fields.value.string_value

Event ID 8200

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		security_result.description

Event ID 1004

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		security_result.description

Event ID 1014

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		security_result.description

Event ID 8197

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		security_result.description RuleId is set to security_result.rule_id Action is set to security_result.action_details app_name is set to target.application AppId is set to target.labels.key/value SkuId is set to target.labels.key/value NotificationInterval is set to target.labels.key/value Trigger is set to target.labels.key/value AppId is set to additional.fields.key and additional.fields.value.string_value SkuId is set to additional.fields.key and additional.fields.value.string_value NotificationInterval is set to additional.fields.key and additional.fields.value.string_value Trigger is set to additional.fields.key and additional.fields.value.string_value

Event ID 20482

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 1033

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		security_result.description DirectiveName is set to target.labels.key/value AppId is set to target.labels.key/value SkuId is set to target.labels.key/value DirectiveName is set to additional.fields.key and additional.fields.value.string_value AppId is set to additional.fields.key and additional.fields.value.string_value SkuId is set to additional.fields.key and additional.fields.value.string_value

Event ID 1013

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message	metadata.description SkuId is set to target.labels.key/value SkuId is set to additional.fields.key and additional.fields.value.string_value

Event ID 1067

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 12304

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 1036

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 20489

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 20481

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 1025

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description product_name is set to target.application ProcessPath is set to target.process.file.full_path ProcessName is set to target.process.command_line ProcessId is set to target.process.pid
Domain		principal.administrative_domain
AccountName		principal.user.userid
UserID		principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 12305

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 12311

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 20488

Provider: Microsoft-Windows-Security-SPP

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 1281

Provider: Microsoft-Windows-TPM-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description
Domain		principal.administrative_domain
AccountName		principal.user.userid
UserID		principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 63

Provider: Microsoft-Windows-WMI

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 1025

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description product_name is set to target.application ProcessPath is set to target.process.file.full_path ProcessName is set to target.process.command_line ProcessId is set to target.process.pid
Domain		principal.administrative_domain
AccountName		principal.user.userid
UserID		principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 11724

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
Message		metadata.description Product is set to target.application

Event ID 1005

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description
Domain		principal.administrative_domain
AccountName		principal.user.userid
UserID		principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 1038

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description
Domain		principal.administrative_domain
AccountName		principal.user.userid
UserID		principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 1029

Provider: MsiInstaller

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description
Domain		principal.administrative_domain
AccountName		principal.user.userid
UserID		principal.user.windows_sid
AccountType		principal.user.attribute.roles.name

Event ID 7030

Provider: Service Control Manager

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED target.appliaction is set to Printer Extensions and Notifications service
Message		metadata.description

Event ID 202

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
ActionName		security_result.action_details
TaskInstanceId		target.resource.product_object_id
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description

Event ID 103

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
TaskInstanceId		target.resource.product_object_id
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description

Event ID 119

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
InstanceId		target.resource.product_object_id
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
UserName		target.user.user_display_name

Event ID 141

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_DELETION target.resource.resource_type = TASK
TaskName		target.resource.name
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
UserName		principal.user.user_display_name

Event ID 106

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
UserContext		target.user.user_display_name

Event ID 108

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
InstanceId		target.resource.product_object_id

Event ID 110

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
InstanceId		target.resource.product_object_id
UserContext		principal.user.user_display_name

Event ID 118

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_UNCATEGORIZED target.resource.resource_type = TASK
TaskName		target.resource.name
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
InstanceId		target.resource.product_object_id

Event ID 142

Provider: Microsoft-Windows-TaskScheduler

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCHEDULED_TASK_DISABLE target.resource.resource_type = TASK
TaskName		target.resource.name
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
UserName		principal.user.user_display_name

Event ID 2006

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Message		metadata.description Extract PID and map it to UDM field target.process.pid

Event ID 2001

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Message		metadata.description Extract PID and map it to UDM field target.process.pid

Event ID 216

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Message		metadata.description Extract PID and map it to UDM field target.process.pid

Event ID 2003

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Message		metadata.description Extract PID and map it to UDM field target.process.pid

Event ID 2005

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Message		metadata.description Extract PID and map it to UDM field target.process.pid

Event ID 637

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Message		metadata.description Extract PID and map it to UDM field target.process.pid

Event ID 327

Provider: ESENT

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_UNSPECIFIED
Message		metadata.description Extract PID and map it to UDM field target.process.pid Extract src_path and map it to UDM field src.file.full_path Extract target_path and map it to UDM field target.file.full_path

Event ID 17063

Provider: MSSQLSERVER

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		security_result.description

Event ID 17137

Provider: MSSQLSERVER

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
Message		metadata.description Extract database_name and map it to UDM field target.application

Event ID 49930

Provider: MSSQLSERVER

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 852

Provider: MSSQLSERVER

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Message		metadata.description

Event ID 53504

Provider: Microsoft-Windows-PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START target.application = IPC
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
Message		metadata.description
param2		target.domain.name

Event ID 40962

Provider: Microsoft-Windows-PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = STATUS_UPDATE
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
Message		metadata.description

Event ID 40961

Provider: Microsoft-Windows-PowerShell

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SERVICE_START
Domain		principal.administrative_domain
AccountName		principal.user.attribute.roles.name
UserID		principal.user.windows_sid
AccountType		principal.user.roles.description
Message		metadata.description

Event ID 530

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 531

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 532

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 533

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 534

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 535

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 536

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 537

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 539

Provider: Microsoft-Windows-Security-Auditing

NXLog field	Event Viewer field	UDM field
		metadata.event_type = USER_LOGIN security_result.action set to "FAIL"

Event ID 1116

Provider: Microsoft-Windows-Windows Defender

NXLog field	Event Viewer field	UDM field
		metadata.event_type = SCAN_UNCATEGORIZED
FWLink		additional.fields.key additional.fields.value.string_value
ThreatName		security_result.threat_name
ThreatID		security_result.threat_id
SeverityName		security_result.detection_fields.key/value
CategoryName		security_result.category = SOFTWARE_PUA security_result.category_details
Path		target.file.full_path
DetectionOrigin		security_result.detection_fields.key/value
DetectionType		security_result.detection_fields.key/value
DetectionSource		security_result.detection_fields.key/value
DetectionUser		target.user.userid
ProcessName		target.process.file.full_path
SecurityintelligenceVersion		security_result.detection_fields.key/value
EngineVersion		security_result.detection_fields.key/value
Product Name		additional.fields.key additional.fields.value.string_value
Product Version		additional.fields.key additional.fields.value.string_value
Detection ID		security_result.detection_fields.key/value
Detection Time		security_result.first_discovered_time
Severity ID		security_result.detection_fields.key/value
Category ID		security_result.detection_fields.key/value
Status Code		security_result.detection_fields.key/value
State		security_result.detection_fields.key/value
Source ID		security_result.detection_fields.key/value
Origin ID		security_result.detection_fields.key/value
Execution ID		security_result.detection_fields.key/value
Execution Name		security_result.detection_fields.key/value
Type ID		security_result.detection_fields.key/value
Pre Execution Status		security_result.detection_fields.key/value
Action ID		security_result.detection_fields.key/value
Action Name		security_result.action_details
Error Code		security_result.detection_fields.key/value
Error Description		security_result.description
Post Clean Status		security_result.detection_fields.key/value
Additional Actions ID		security_result.detection_fields.key/value
Additional Actions String		security_result.detection_fields.key/value