3	Microsoft-Windows-Bits-Client/Operational	jobId,jobOwner,processPath,processId
4	Microsoft-Windows-Bits-Client/Operational	User,jobId,jobOwner,fileCount,bytesTransferred,bytesTransferredFromPeer
21	Microsoft-Windows-TerminalServices-LocalSessionManager	User,SessionID,Address
22	Microsoft-Windows-TerminalServices-LocalSessionManager	User,SessionID,Address
23	Microsoft-Windows-TerminalServices-LocalSessionManager	User,SessionID
24	Microsoft-Windows-TerminalServices-LocalSessionManager	User,SessionID,Address
25	Microsoft-Windows-TerminalServices-LocalSessionManager	User,SessionID,Address
39	Microsoft-Windows-TerminalServices-LocalSessionManager	TargetSession,Source
40	Microsoft-Windows-TerminalServices-LocalSessionManager	Session,Reason
59	Microsoft-Windows-Bits-Client/Operational	name,url,fileLength,bytesTotal,bytesTransferred
60	Microsoft-Windows-Bits-Client/Operational	name,url,fileLength,bytesTotal,bytesTransferred
131		ConnType,ClientIP
200	Microsoft-Windows-TaskScheduler	TaskName,ActionName
400	Microsoft-Windows-PowerShell/Operational	Data,Data
600	Microsoft-Windows-PowerShell/Operational	Data,Data
1102		SubjectUserName,SubjectDomainName
1149		Param1,Param2,Param3
2004		Name
4100		ContextInfo,Payload
4103		ContextInfo,Payload
4104		ScriptBlockText,Path
4616		Previous Time,New Time
4624		SubjectUserName,SubjectDomainName,TargetUserName,TargetDomainName,LogonType,LogonProcessName,ProcessName,IpAddress
4625		SubjectUserName,SubjectDomainName,TargetUserName,TargetDomainName,LogonType,LogonProcessName,ProcessName,IpAddress
4634		TargetUserName,TargetDomainName,LogonType
4647		TargetUserName,TargetDomainName
4648		SubjectUserName,SubjectDomainName,TargetUserName,TargetDomainName,ProcessName,IpAddress
4656		SubjectUserName,SubjectDomainName,ObjectServer,ObjectName,ProcessName
4658		SubjectUserName,SubjectDomainName,ObjectServer,ProcessName
4660		SubjectUserName,SubjectDomainName,ObjectServer,ProcessName
4661		SubjectUserName,SubjectDomainName,ObjectServer,ObjectType,ObjectName,OperationType,AccessList,AccessMask
4662		SubjectUserName,SubjectDomainName,ObjectServer,ObjectType,ObjectName,OperationType,AccessList,AccessMask
4663		SubjectUserName,SubjectDomainName,ObjectServer,ObjectName,ProcessName
4670		SubjectUserName,SubjectDomainName,ObjectServer,ObjectName,ProcessName
4673		SubjectUserName,SubjectDomainName,ObjectServer,Service,ProcessName
4674		SubjectUserName,SubjectDomainName,ObjectServer,Service,ProcessName
4688		SubjectUserName,SubjectDomainName,NewProcessName,TokenElevationType,CommandLine,TargetUserName,TargetDomainName,ParentProcessName
4689		SubjectUserName,SubjectDomainName,ProcessName
4696		SubjectUserName,SubjectDomainName,TargetUserName,TargetDomainName,TargetProcessName,ProcessName
4698		SubjectUserName,SubjectDomainName,TaskName,TaskContent
4699		SubjectUserName,SubjectDomainName,TaskName,TaskContent
4720		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName,SamAccountName,PrimaryGroupId
4722		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4723		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4724		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4725		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4726		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4731		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName,PrivilegeList,SamAccountName
4732		MemberName,TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4733		MemberName,TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4738		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName,PrivilegeList
4740		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4741		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName,PrivilegeList,SamAccountName,PasswordLastSet
4742		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName,PrivilegeList,SamAccountName,PasswordLastSet
4743		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4767		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName
4768		TargetUserName,TargetDomainName,ServiceName,TicketOptions,Status,IpAddress,IpPort,CertIssuerName
4769		TargetUserName,TargetDomainName,ServiceName,TicketOptions,Status,IpAddress,IpPort
4703		SubjectUserName,SubjectDomainName,TargetUserName,TargetDomainName,ProcessName,EnabledPrivilegeList,DisabledPrivilegeList
4770		TargetUserName,TargetDomainName,ServiceName,TicketOptions,Status,IpAddress,IpPort
4771		TargetUserName,ServiceName,TicketOptions,Status,IpAddress,IpPort,CertIssuerName
4778		AccountName,AccountDomain,SessionName,ClientName,ClientAddress
4779		AccountName,AccountDomain,SessionName,ClientName,ClientAddress
4781		OldTargetUserName,NewTargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName,PrivilegeList
4794		SubjectUserName,SubjectDomainName,Workstation
4798		TargetUserName,TargetDomainName,SubjectUserName,SubjectDomainName,CallerProcessName
4798		CallerProcessName
4800		TargetUserName,TargetDomainName,SessionId
4801		TargetUserName,TargetDomainName,SessionId
5031		Application
5136		OpCorrelationID,SubjectUserName,SubjectDomainName,DSName
5137		OpCorrelationID,SubjectUserName,SubjectDomainName,DSName
5138		OpCorrelationID,SubjectUserName,SubjectDomainName,DSName
5139		OpCorrelationID,SubjectUserName,SubjectDomainName,DSName
5140		SubjectUserName,SubjectDomainName,IpAddress,IpPort,ShareName,ShareLocalPath
5141		OpCorrelationID,SubjectUserName,SubjectDomainName,DSName
5142		SubjectUserName,SubjectDomainName,ShareName,ShareLocalPath
5145		SubjectUserName,SubjectDomainName,IpAddress,IpPort,ShareName,ShareLocalPath,RelativeTargetName
5152		Application,SourceAddress,SourcePort,DestAddress,DestPort,Protocol
5154		Application,SourceAddress,SourcePort,Protocol
5155		Application,SourceAddress,SourcePort,Protocol
5156		Application,SourceAddress,SourcePort,DestAddress,DestPort,Protocol
5157		Application,SourceAddress,SourcePort,DestAddress,DestPort,Protocol
5158		Application,SourceAddress,SourcePort,Protocol
5159		Application,SourceAddress,SourcePort,Protocol
5376		SubjectUserName,SubjectDomainName
5378		SubjectUserName,SubjectDomainName,Package,UserUPN,TargetServer
5632		SSID,Identity,SubjectUserName,SubjectDomainName,ErrorCode
5633		InterfaceName,SubjectUserName,SubjectDomainName,ErrorCode
6416		SubjectUserName,SubjectDomainName,DeviceId,DeviceDescription
7031		param1,param5
7040		param1,param2,param3,param4
7045		ServiceName,ImagePath,ServiceType,StartType,AccountName
11005		SSID
11010		SSID,Auth
16403		User,jobId,jobOwner,fileCount,RemoteName,LocalName,processId
28115		Name,AppID
28117		Name,AppID