Details
| ID | MicrosoftWindowsEvents |
|---|---|
| From Version | 8.15.0 |
Schema
microsoft_windows_raw
| Field | Type | Array? |
|---|---|---|
activity_id |
string | — |
channel |
string | — |
computer_name |
string | — |
detection_source |
string | — |
event_action |
string | — |
event_data |
string | — |
event_fwlink |
string | — |
event_id |
string | — |
event_result |
string | — |
host_name |
string | — |
log_level |
string | — |
message |
string | — |
opcode |
string | — |
os_subtype |
string | — |
process_cmd |
string | — |
process_md5 |
string | — |
process_name |
string | — |
process_path |
string | — |
process_pid |
string | — |
process_sha256 |
string | — |
process_thread_id |
string | — |
provider_guid |
string | — |
provider_name |
string | — |
record_id |
string | — |
task |
int | — |
threat_category |
string | — |
user |
string | — |
user_data |
string | — |