event viewer - system
October 17, 2024 · View on GitHub
Expression
product = "event viewer - system"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| cpu_percentile | |||
| edge_fleet | |||
| log_name | ✓ | ||
| event_code | ✓ | ||
| edge_host | |||
| domain | ✓ | ||
| event_name | ✓ | ||
| fallback_user_name | |||
| domain_user_name | |||
| src_host | ✓ | ✓ | |
| user | ✓ | ✓ | |
| page_fault_count |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| service-create | file_path | ||||
| service_command_line | |||||
| service_type | |||||
| file_ext | |||||
| dest_domain_user_name | |||||
| file_name | |||||
| file_dir | |||||
| dest_domain | |||||
| service_start_type | Legacy | ✓ | |||
| dest_user |