Accesses,Event.EventData.Accesses
AccessList,Event.EventData.AccessList
AccessMask,Event.EventData.AccessMask
AccountDomain,Event.EventData.AccountDomain
AccountName,Event.EventData.AccountName
Account_Name,Event.EventData.Account_Name
Action,Event.EventData.Action
AllowedToDelegateTo,Event.EventData.AllowedToDelegateTo
ApplicationPath,Event.EventData.ApplicationPath
AttributeLDAPDisplayName,Event.EventData.AttributeLDAPDisplayName
AttributeValue,Event.EventData.AttributeValue
AuditPolicyChanges,Event.EventData.AuditPolicyChanges
AuditSourceName,Event.EventData.AuditSourceName
AuthenticationPackageName,Event.EventData.AuthenticationPackageName
CallerProcessName,Event.EventData.CallerProcessName
Caller_Process_Name,Event.EventData.Caller_Process_Name
CallingProcessName,Event.EventData.CallingProcessName
CallTrace,Event.EventData.CallTrace
CategoryName,Event.EventData.Category Name
CertThumbprint,Event.EventData.CertThumbprint
Channel,Event.System.Channel
ClassName,Event.EventData.ClassName
ClientAddress,Event.EventData.ClientAddress
ClientName,Event.EventData.ClientName
Client_Address,Event.EventData.Client_Address
CommandLine,Event.EventData.CommandLine
Company,Event.EventData.Company
Computer,Event.System.Computer
ComputerName,Event.System.Computer
ContextInfo,Event.EventData.ContextInfo
CurrentDirectory,Event.EventData.CurrentDirectory
Description,Event.EventData.Description
DestAddress,Event.EventData.DestAddress
Destination,Event.EventData.Destination
DestinationAddress,Event.EventData.DestinationAddress
DestinationHostname,Event.EventData.DestinationHostname
DestinationIp,Event.EventData.DestinationIp
DestinationIsIpv6,Event.EventData.DestinationIsIpv6
DestinationPort,Event.EventData.DestinationPort
DestPort,Event.EventData.DestPort
Details,Event.EventData.Details
DetectionSource,Event.EventData.DetectionSource
DetectionUser,Event.EventData.Detection User
Device,Event.EventData.Device
DeviceClassName,Event.EventData.DeviceClassName
DeviceDescription,Event.EventData.DeviceDescription
DeviceInstanceID,Event.UserData.InstallDeviceID.DeviceInstanceID
DeviceName,Event.EventData.DeviceName
DomainName,Event.EventData.SubjectDomainName
DriverDescription,Event.UserData.InstallDeviceID.DriverDescription
DriverProvider,Event.UserData.InstallDeviceID.DriverProvider
DvrFmwk2003InstanceId,Event.UserData.UMDFHostDeviceArrivalBegin.InstanceId
DvrFmwkInstanceId,Event.UserData.UMDFHostDeviceRequest.InstanceId
EngineVersion,Event.EventData.EngineVersion
ErrorCode,Event.EventData.ErrorCode
EventID,Event.System.EventID
EventType,Event.EventData.EventType
ExecutionProcessID,Event.System.Execution_attributes.ProcessID
FailureCode,Event.EventData.FailureCode
Filename,Event.EventData.Filename
FilePath,Event.EventData.FilePath
FileVersion,Event.EventData.FileVersion
GrantedAccess,Event.EventData.GrantedAccess
GroupName,Event.EventData.GroupName
GroupSid,Event.EventData.GroupSid
Hashes,Event.EventData.Hashes
HiveName,Event.EventData.HiveName
HostApplication,Event.EventData.HostApplication
HostName,Event.EventData.HostName
HostVersion,Event.EventData.HostVersion
Image,Event.EventData.Image
image,Event.EventData.Image
ImageLoaded,Event.EventData.ImageLoaded
ImagePath,Event.EventData.ImagePath
Imphash,Event.EventData.Hashes
Initiated,Event.EventData.Initiated
InstallStatus,Event.UserData.InstallDeviceID.InstallStatus
InstanceID,Event.UserData.UMDFHostDeviceArrivalBegin.InstanceId
IntegrityLevel,Event.EventData.IntegrityLevel
IpAddress,Event.EventData.IpAddress
IpPort,Event.EventData.IpPort
JobTitle,Event.EventData.name
KeyLength,Event.EventData.KeyLength
Keywords,Event.System.Keywords
LayerRTID,Event.EventData.LayerRTID
LDAPDisplayName,Event.EventData.LDAPDisplayName
Level,Event.System.Level
LogFileClearedChannel,Event.UserData.LogFileCleared.Channel
LogFileClearedSubjectUserName,Event.UserData.LogFileCleared.SubjectUserName
LogonID,Event.EventData.LogonID
LogonId,Event.EventData.LogonId
LogonProcessName,Event.EventData.LogonProcessName
LogonType,Event.EventData.LogonType
Logon_Account,Event.EventData.Logon_Account
MachineName,Event.EventData.MachineName
MemberName,Event.EventData.MemberName
MemberSid,Event.EventData.MemberSid
Message,Event.EventData
ModifyingApplication,Event.EventData.ModifyingApplication
NewName,Event.EventData.NewName
NewProcessId,Event.EventData.NewProcessId
NewProcessName,Event.EventData.NewProcessName
NewTemplateContent, Event.EventData.NewTemplateContent
NewUacValue,Event.EventData.NewUacValue
NewValue,Event.EventData.NewValue
New_Value,Event.EventData.New Value
ObjectClass,Event.EventData.ObjectClass
ObjectName,Event.EventData.ObjectName
ObjectServer,Event.EventData.ObjectServer
ObjectType,Event.EventData.ObjectType
ObjectValueName,Event.EventData.ObjectValueName
OldUacValue,Event.EventData.OldUacValue
OperationEssStartedNamespaceName,Event.UserData.Operation_EssStarted.NamespaceName
OperationEssStartedPossibleCause,Event.UserData.Operation_EssStarted.PossibleCause
OperationEssStartedProcessid,Event.UserData.Operation_EssStarted.Processid
OperationEssStartedProvider,Event.UserData.Operation_EssStarted.Provider
OperationEssStartedQuery,Event.UserData.Operation_EssStarted.Query
OperationEssStartedUser,Event.UserData.Operation_EssStarted.User
Origin,Event.EventData.Origin
OriginalFileName,Event.EventData.OriginalFileName
OriginalFilename,Event.EventData.OriginalFileName
param1,Event.EventData.param1
param2,Event.EventData.param2
param3,Event.EventData.param3
param4,Event.EventData.param4
param5,Event.EventData.param5
ParentCommandLine,Event.EventData.ParentCommandLine
ParentImage,Event.EventData.ParentImage
ParentIntegrityLevel,Event.EventData.ParentIntegrityLevel
ParentProcessName,Event.EventData.ParentProcessName
ParentUser,Event.EventData.ParentUser
PasswordLastSet,Event.EventData.PasswordLastSet
Path,Event.EventData.Path
Payload,Event.EventData.Payload
PipeName,Event.EventData.PipeName
PossibleCause,Event.UserData.PossibleCause
PreAuthType,Event.EventData.PreAuthType
PrivilegeList,Event.EventData.PrivilegeList
ProcessCommandLine,Event.EventData.ProcessCommandLine
ProcessGuid,Event.EventData.ProcessGuid
ProcessId,Event.EventData.ProcessId
ProcessName,Event.EventData.ProcessName
Product,Event.EventData.Product
Properties,Event.EventData.Properties
Provider,Event.UserData.Provider
ProviderName,Event.System.Provider_attributes.Name
Provider_Name,Event.System.Provider_attributes.Name
QNAME,Event.EventData.QNAME
query,Event.EventData.Query
Query,Event.UserData.Query
QueryName,Event.EventData.QueryName
QueryResults,Event.EventData.QueryResults
QueryStatus,Event.EventData.QueryStatus
RdsGtwErrorCode,Event.UserData.EventInfo.ErrorCode
RdsGtwUsername,Event.UserData.EventInfo.Username
RdsGtwIpAddress,Event.UserData.EventInfo.IpAddress
RdsGtwAuthType,Event.UserData.EventInfo.AuthType
RdsGtwResource,Event.UserData.EventInfo.Resource
RdsGtwConnectionProtocol,Event.UserData.EventInfo.ConnectionProtocol
RdsGtwBytesReceived,Event.UserData.EventInfo.BytesReceived
RdsGtwBytesTransfered,Event.UserData.EventInfo.BytesTransfered
RdsGtwSessionDuration,Event.UserData.EventInfo.SessionDuration
RelativeTargetName,Event.EventData.RelativeTargetName
RuleName,Event.EventData.RuleName
SAMAccountName,Event.EventData.SamAccountName
ScriptBlockText,Event.EventData.ScriptBlockText
SearchFilter,Event.System.SearchFilter
SecurityUserID,Event.System.Security_attributes.UserID
ServerName,Event.System.ServerName
Service,Event.EventData.Service
service,Event.EventData.Service
ServiceFileName,Event.EventData.ServiceFileName
ServiceName,Event.EventData.ServiceName
ServicePrincipalNames,Event.EventData.ServicePrincipalNames
ServiceStartType,Event.EventData.ServiceStartType
ServiceType,Event.EventData.ServiceType
SeverityID,Event.EventData.Severity ID
SeverityName,Event.EventData.Severity Name
sha1,Event.EventData.Hashes_sha1
ShareLocalPath,Event.EventData.ShareLocalPath
ShareName,Event.EventData.ShareName
SidHistory,Event.EventData.SidHistory
Signature,Event.EventData.Signature
SignatureStatus,Event.EventData.SignatureStatus
Signed,Event.EventData.Signed
Source,Event.System.Provider_Name
SourceAddress,Event.EventData.SourceAddress
SourceImage,Event.EventData.SourceImage
SourceNetworkAddress,Event.EventData.SourceNetworkAddress
SourcePort,Event.EventData.SourcePort
Source_Name,Event.EventData.Source Name
Source_Network_Address,Event.EventData.Source_Network_Address
Source_WorkStation,Event.EventData.Source_WorkStation
StartAddress,Event.EventData.StartAddress
StartFunction,Event.EventData.StartFunction
StartModule,Event.EventData.StartModule
StartType,Event.EventData.StartType
State,Event.EventData.State
Status,Event.EventData.Status
SubjectDomainName,Event.EventData.SubjectDomainName
SubjectLogonId,Event.EventData.SubjectLogonId
SubjectUserName,Event.EventData.SubjectUserName
SubjectUserSid,Event.EventData.SubjectUserSid
SubStatus,Event.EventData.SubStatus
SysmonVersion,Event.EventData.SysmonVersion
TargetDomainName,Event.EventData.TargetDomainName
TargetFilename,Event.EventData.TargetFilename
TargetImage,Event.EventData.TargetImage
TargetInfo,Event.EventData.TargetInfo
TargetLogonId,Event.EventData.TargetLogonId
TargetObject,Event.EventData.TargetObject
TargetProcessAddress,Event.EventData.TargetProcessAddress
TargetServerName,Event.EventData.TargetServerName
TargetSid,Event.EventData.TargetSid
TargetUserName,Event.EventData.TargetUserName
TaskDate,Event.EventData.TaskContent
TaskName,Event.EventData.TaskName
TemplateContent,Event.EventData.TemplateContent
ThreatName,Event.EventData.Threat Name
TicketEncryptionType,Event.EventData.TicketEncryptionType
TicketOptions,Event.EventData.TicketOptions
Url,Event.EventData.url
User,Event.EventData.User
UserDataAddress,Event.UserData.EventXML.Address
UserDataCode,Event.UserData.Operation_StartedOperational.Code
UserDataConsumer,Event.UserData.Operation_ESStoConsumerBinding.CONSUMER
UserDataESS,Event.UserData.Operation_ESStoConsumerBinding.ESS
UserDataHostProcess,Event.UserData.Operation_StartedOperational.HostProcess
UserDataNamespace,Event.UserData.Operation_ESStoConsumerBinding.Namespace
UserDataNamespaceName,Event.UserData.Operation_TemporaryEssStarted.NamespaceName
UserDataParam1,Event.UserData.EventXML.Param1
UserDataParam2,Event.UserData.EventXML.Param2
UserDataParam3,Event.UserData.EventXML.Param3
UserDataPossibleCause,Event.UserData.Operation_ESStoConsumerBinding.PossibleCause
UserDataProcessID,Event.UserData.Operation_StartedOperational.ProcessID
UserDataProcessid,Event.UserData.Operation_TemporaryEssStarted.Processid
UserDataProviderName,Event.UserData.Operation_StartedOperational.ProviderName
UserDataProviderPath,Event.UserData.Operation_StartedOperational.ProviderPath
UserDataQuery,Event.UserData.Operation_TemporaryEssStarted.Query
UserDataSessionID,Event.UserData.EventXML.SessionID
UserDataUser,Event.UserData.EventXML.User
UserName,Event.EventData.UserName
Value,Event.EventData.Value
Version,Event.System.Version
WindowsDefenderProcessName,Event.EventData.Process Name
WMI-UserDataUser,Event.UserData.Operation_TemporaryEssStarted.User
Workstation,Event.EventData.Workstation
WorkstationName,Event.EventData.WorkstationName
