Collect Windows Network Policy Server logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google SecOps Technical Support Service guidelines and the Google SecOps Service Specific Terms.
If this feature isn't visible in your environment, see Manage preview features or contact your system administrator.

This document explains how to ingest Windows Network Policy Server (NPS) logs to Google Security Operations using Bindplane.

Windows Network Policy Server (NPS) is a Microsoft RADIUS server that generates authentication, authorization, and accounting logs for network access control. The Bindplane agent collects NPS accounting log files and exported event logs directly from the local file system.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Windows Server 2016 or later with observiq-otel-collector service support
• If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
• Administrative access to the Windows Server with the Network Policy Server role installed

Get Google SecOps credentials for the Bindplane agent

To authenticate the Bindplane agent to Google SecOps, choose one of the following methods:

• New deployments: Use the Chronicle API (Option 1).
• Legacy deployments: Continue using the ingestion authentication file (Option 2) until the Ingestion API is discontinued on July 20, 2027.

Option 1: Create a service account for the Chronicle API (recommended)

1. Sign in to the Google Cloud console and select the Google Cloud project that is linked to your Google SecOps instance.
2. Go to IAM & Admin > Service Accounts.
3. Click Create service account.
4. Provide the following configuration details:
   • Service account name: Enter a name for the account (for example, bindplane-ingest).
   • Service account description: Enter a description (for example, Bindplane agent log ingestion).
5. Click Create and continue.
6. In the Grant this service account access to project section, click Select a role and select Chronicle Editor.
7. Click Continue, and then click Done.
8. Click the service account you created, and then go to the Keys tab.
9. Click Add key > Create new key.
10. Select JSON and click Create. The key file is downloaded to your computer.
11. Save the key file as ingestion-auth.json in the Bindplane collector directory (/opt/observiq-otel-collector/ingestion-auth.json on Linux or C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json on Windows), or update creds_file_path in config.yaml to match the path where you save it.
12. Go to IAM & Admin > Settings and copy the Project number. You'll need it for the exporter configuration.

Note: The JSON key is a credential. Restrict access to the file on the Bindplane host and rotate the key according to your organization's policy.

Option 2: Download the ingestion authentication file (legacy)

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the ingestion authentication file.
4. Save the file securely on the system where the Bindplane agent will be installed.

Note: This file authenticates the agent to the legacy Ingestion API (malachiteingestion-pa.googleapis.com), which Google has scheduled for end of life on July 20, 2027. Plan to move to Option 1 before that date.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.

3. Copy and save the Customer ID from the Organization Details section.

   Note: The customer ID is required for configuring the Bindplane agent exporter.

Install the Bindplane agent

Install the Bindplane agent on your Windows operating system according to the following instructions.

Windows installation

1. Open Command Prompt or PowerShell as an administrator.

2. Run the following command:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

3. Wait for the installation to complete.

4. Verify the installation by running:

   sc query observiq-otel-collector
   

The service should show as RUNNING.

Additional installation resources

For additional installation options and troubleshooting, see Bindplane agent installation guide.

Note: The Chronicle API exporter configuration requires Bindplane collector v1.106.0 or later. The previous commands install the latest release. If you're updating an existing installation, upgrade the collector before changing the configuration.

Configure Bindplane agent to ingest logs and send to Google SecOps

Locate the configuration file

• Windows:

  notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"
  

Edit the configuration file

• Replace the entire contents of config.yaml with the following configuration:

  receivers:
    filelog:
      include:
        - C:\Windows\System32\LogFiles\IN*.log
      start_at: beginning
  
  exporters:
    chronicle/windows_nps:
      protocol: https
      # Region of your instance, for example us, europe, asia-southeast1
      location: <LOCATION>
      # Project number of the Google Cloud project linked to the instance
      project: '<PROJECT_NUMBER>'
      compression: gzip
      creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
      customer_id: '<customer_id>'
      endpoint: chronicle.googleapis.com
      log_type: WINDOWS_NET_POLICY_SERVER
      raw_log_field: body
      ingestion_labels:
        env: production
  
  service:
    pipelines:
      logs/nps_to_chronicle:
        receivers:
          - filelog
        exporters:
          - chronicle/windows_nps
  

Configuration parameters

Replace the following placeholders:

• Receiver configuration:

  • filelog: The receiver type for collecting log files from disk
  • include: List of file paths to monitor. Set this to the location of NPS accounting log files (for example, C:\Windows\System32\LogFiles\IN*.log) or exported event logs (for example, C:\Logs\nps\*.evtx)
  • start_at: Set to beginning to read existing logs or end to only read new entries

• Exporter configuration:

  • windows_nps: Descriptive name for the exporter
  • creds_file_path: Full path to the service account JSON key file (Option 1):
    • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • <customer_id>: Customer ID from the previous step
  • location: Replace <LOCATION> with the region of your Google SecOps instance (for example, us, europe, or asia-southeast1). The exporter prefixes chronicle.googleapis.com with this value. See Regional Endpoints for the complete list.
  • project: Replace <PROJECT_NUMBER> with the project number from IAM & Admin > Settings.
  • endpoint: Keep set to chronicle.googleapis.com.
  • WINDOWS_NET_POLICY_SERVER: Log type exactly as it appears in Chronicle
  • ingestion_labels: Optional labels in YAML format (for example, env: production)

• Pipeline configuration:

  • nps_to_chronicle: Descriptive name for the pipeline

Legacy ingestion API exporter

• If you use the ingestion authentication file from Option 2, replace the exporters block with the following. Set creds_file_path to the path to the ingestion authentication file, and if your instance is outside the US, replace malachiteingestion-pa.googleapis.com with your regional endpoint (for example, europe-malachiteingestion-pa.googleapis.com).

  exporters:
    chronicle/windows_nps:
      compression: gzip
      creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
      customer_id: '<customer_id>'
      endpoint: malachiteingestion-pa.googleapis.com
      log_type: WINDOWS_NET_POLICY_SERVER
      raw_log_field: body
      ingestion_labels:
        env: production
  

Note: This exporter will stop working when the Ingestion API is discontinued on July 20, 2027.

Save the configuration file

• After editing, save the file:
  • Windows: Click File > Save

Restart the Bindplane agent to apply the changes

To restart the Bindplane agent in Windows:

1. Choose one of the following options:

   • Command Prompt or PowerShell as administrator:

   net stop observiq-otel-collector && net start observiq-otel-collector
   

   • Services console:
     1. Press Win+R, type services.msc, and press Enter.
     2. Locate observIQ OpenTelemetry Collector.
     3. Right-click and select Restart.

2. Verify the service is running:

   sc query observiq-otel-collector
   

3. Check logs for errors:

   type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
   

Configure Windows NPS log export

Windows NPS generates two types of logs: NPS accounting log files (IAS format) stored on disk and NPS-related events in the Windows Event Log. You can collect either or both.

Option 1: Collect NPS accounting log files (default)

NPS accounting log files are stored by default at C:\Windows\System32\LogFiles\` with filenames starting withIN(for example,IN2301.log`).

1. Open Server Manager > Network Policy Server.
2. Go to Accounting > Configure Accounting.
3. Verify that Log to a text file (local) is enabled.
4. Note the log file directory (default: %systemroot%\system32\LogFiles).

5. Ensure the Bindplane agent include path in config.yaml matches the log file location.

   Note: NPS accounting logs use IAS or DTS format. The default include path C:\Windows\System32\LogFiles\IN*.log matches the standard NPS log naming convention.

Option 2: Export NPS event logs

NPS authentication events (Event IDs 6272-6280) are logged in the Windows Security event log.

1. Create a directory to store the exported log files:

   mkdir C:\Logs\nps
   

2. Export NPS-related Security events using wevtutil:

   wevtutil epl "Security" /q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID>=6272 and EventID<=6280)]]" C:\Logs\nps\nps-security.evtx
   

3. (Optional) Schedule regular exports using Windows Task Scheduler:

   $action = New-ScheduledTaskAction -Execute "wevtutil" -Argument 'epl "Security" /q:"*[System[Provider[@Name=''Microsoft-Windows-Security-Auditing''] and (EventID>=6272 and EventID<=6280)]]" C:\Logs\nps\nps-security.evtx /ow:true'
   $trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Hours 1) -Once -At (Get-Date)
   Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "ExportNPSLogs" -Description "Export Windows NPS logs for Bindplane agent"
   

4. Update the Bindplane agent include path in config.yaml to match:

   include:
     - C:\Logs\nps\*.evtx
   

   Note: The Bindplane agent service account must have read access to the log directory.

UDM mapping table

Log field	UDM mapping	Logic
EventID	about	Mapped values (5 total, e.g., 4800, 4801 → session_about, 5137, 5141 → `token_about...)
SourceName	about	Mapped values (6 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu... )
about_host	about	Merged
about_token	about	Merged
jsonPayload_about	about	Merged
session_about	about	Merged
token_about	about	Merged
fqdn	about.administrative_domain	Directly mapped
param1	about.file.full_path	Directly mapped
DCDNSName	about.hostname	Directly mapped
LocalEMPrincipalName	about.hostname	Directly mapped
EventID	about.ip	Mapped: 4908, 4964 → address
SourceName	about.ip	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a...
address	about.ip	Merged
EventID	about.labels	Mapped values (15 total, e.g., 4625, 4776, 4794 → keywords_label, 4774, 4775 → `map...)
ImpersonationLevel_label	about.labels	Merged
RestrictedAdminMode_label	about.labels	Merged
SourceName	about.labels	Mapped values (23 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec...)
additional_data_label	about.labels	Merged
audit_policy_changes_label	about.labels	Merged
ca_label	about.labels	Merged
category_label	about.labels	Merged
keywords_label	about.labels	Merged
labels0	about.labels	Merged
labels101	about.labels	Merged
labels202	about.labels	Merged
labels401	about.labels	Merged
level_label	about.labels	Merged
mapped_name_label	about.labels	Merged
mapping_by_label	about.labels	Merged
mapping_channel	about.labels	Merged
mapping_opcode	about.labels	Merged
system_keyword_label	about.labels	Merged
task_label	about.labels	Merged
thread_id_label	about.labels	Merged
value_is_near_0	about.labels	Mapped: true → labels101
value_is_near_1	about.labels	Mapped: true → labels202
version_label	about.labels	Merged
param3	about.registry.registry_key	Directly mapped
EventID	about.resource.attribute.labels	Mapped: 4908, 4964 → label_for_resource_attribute
SourceName	about.resource.attribute.labels	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `l...
label_for_resource_attribute	about.resource.attribute.labels	Merged
ProviderName	about.resource.name	Directly mapped
ProviderKey	about.resource.product_object_id	Directly mapped
temp	about.resource.product_object_id	Directly mapped
Url	about.url	Directly mapped
cacheDenyUrls	about.url	Directly mapped
EventID	about.user.attribute.labels	Mapped: 4765, 4766 → about_user_label, 4908, 4964 → about_user_label, ` 4908, ...
SourceName	about.user.attribute.labels	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a...
about_user_label	about.user.attribute.labels	Merged
label_for_user_attribute	about.user.attribute.labels	Merged
SourceUserName	about.user.userid	Directly mapped
about_user_windows_sid	about.user.windows_sid	Directly mapped
EventID	additiona.fields	Mapped: 4908, 4964 → function_label, 4104, 4105 → function_label
SourceName	additiona.fields	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `f...
function_label	additiona.fields	Merged
AccountAvailableKeys_label	additional.fields	Merged
AccountSupportedEncryptionTypes_label	additional.fields	Merged
ActiveProfile_label	additional.fields	Merged
AdvancedOptions_label	additional.fields	Merged
AppCorrelationID_label	additional.fields	Merged
AppId_label	additional.fields	Merged
AttributeSyntaxOID_label	additional.fields	Merged
AuditResult_label	additional.fields	Merged
AuditType_label	additional.fields	Merged
AuthProtocol_label	additional.fields	Merged
Binding_type_label	additional.fields	Merged
Cache_Control_label	additional.fields	Merged
ClaimsProvider_label	additional.fields	Merged
ClientAdvertizedEncryptionTypes_label	additional.fields	Merged
ClientCreationTime_label	additional.fields	Merged
CommandName_label	additional.fields	Merged
CommandType_label	additional.fields	Merged
ConfigAccessPolicy_label	additional.fields	Merged
ConfiguredNames_label	additional.fields	Merged
Connection_label	additional.fields	Merged
Content_Type_label	additional.fields	Merged
DCAvailableKeys_label	additional.fields	Merged
DCSupportedEncryptionTypes_label	additional.fields	Merged
DN_label	additional.fields	Merged
DSType_label	additional.fields	Merged
DetailSequence_label	additional.fields	Merged
DetailTotal_label	additional.fields	Merged
Details_label	additional.fields	Merged
DeviceAuth_label	additional.fields	Merged
DeviceId_label	additional.fields	Merged
DirectiveName_label	additional.fields	Merged
DisableIntegrityChecks_label	additional.fields	Merged
Endpoint_label	additional.fields	Merged
EngineVersion_label	additional.fields	Merged
ErrorCode_label	additional.fields	Merged
EventID	additional.fields	Mapped values (420 total, e.g., 4719 → additional_field_task_category, ` 4692, 4693, 4694... )
FQDN_label	additional.fields	Merged
FWLink_label	additional.fields	Merged
FailureType_label	additional.fields	Merged
FaultingApplicationPath_label	additional.fields	Merged
FaultingModulePath_label	additional.fields	Merged
FlightSigning_label	additional.fields	Merged
ForwardedIpAddress_label	additional.fields	Merged
GroupPolicyApplied_label	additional.fields	Merged
HandleId_label	additional.fields	Merged
HandleId_label_1	additional.fields	Merged
HostID_label	additional.fields	Merged
HostId_label	additional.fields	Merged
HostName_label	additional.fields	Merged
HostVersion_label	additional.fields	Merged
Host_label	additional.fields	Merged
HypervisorDebug_label	additional.fields	Merged
HypervisorLaunchType_label	additional.fields	Merged
HypervisorLoadOptions_label	additional.fields	Merged
ImpersonationLevel_label	additional.fields	Merged
IpAddress_label	additional.fields	Merged
KernelDebug_label	additional.fields	Merged
KeyLength_label	additional.fields	Merged
LmPackageName_label	additional.fields	Merged
LoadOptions_label	additional.fields	Merged
LogDroppedPacketsEnabled_label	additional.fields	Merged
LogSuccessfulConnectionsEnabled_label	additional.fields	Merged
MandatoryLabel_label	additional.fields	Merged
MessageNumber_label	additional.fields	Merged
MessageTotal_label	additional.fields	Merged
Message_label	additional.fields	Merged
MfaMethod_label	additional.fields	Merged
MfaPerformed_label	additional.fields	Merged
MulticastFlowsEnabled_label	additional.fields	Merged
NetworkIpAddress_label	additional.fields	Merged
NetworkLocation_label	additional.fields	Merged
NewEngineState_label	additional.fields	Merged
NewState_label	additional.fields	Merged
NotificationInterval_label	additional.fields	Merged
OAuthClientId_label	additional.fields	Merged
OAuthGrant_label	additional.fields	Merged
ObjectServer_label	additional.fields	Merged
OpCorrelationID_label	additional.fields	Merged
OperationMode_label	additional.fields	Merged
OperationType_label	additional.fields	Merged
Operation_label	additional.fields	Merged
PacketType_label	additional.fields	Merged
Payload_label	additional.fields	Merged
PipelineID_label	additional.fields	Merged
PipelineId_label	additional.fields	Merged
PreAuthEncryptionType_label	additional.fields	Merged
PreviousEngineState_label	additional.fields	Merged
PrimaryAuth_label	additional.fields	Merged
Product_Name_label	additional.fields	Merged
Product_Version_label	additional.fields	Merged
Profile_label	additional.fields	Merged
Profiles_label	additional.fields	Merged
ProxyIpAddress_label	additional.fields	Merged
ProxyServer_label	additional.fields	Merged
RelyingParty_label	additional.fields	Merged
RemoteAdminEnabled_label	additional.fields	Merged
RemoteEventLogging_label	additional.fields	Merged
RequestTicketHash_label	additional.fields	Merged
ResourceManager_label	additional.fields	Merged
ResponseTicketHash_label	additional.fields	Merged
RestrictedAdminMode_label	additional.fields	Merged
ReturnCode_label	additional.fields	Merged
RunspaceID_label	additional.fields	Merged
RunspaceId_label	additional.fields	Merged
SequenceNumber_label	additional.fields	Merged
Server_label	additional.fields	Merged
ServiceAvailableKeys_label	additional.fields	Merged
ServiceStartType_label	additional.fields	Merged
ServiceSupportedEncryptionTypes_label	additional.fields	Merged
ServiceType_label	additional.fields	Merged
SessionKeyEncryptionType_label	additional.fields	Merged
SkuId_label	additional.fields	Merged
SourceName	additional.fields	Mapped values (564 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows se... )
SsoBindingValidationLevel_label	additional.fields	Merged
StartType_label	additional.fields	Merged
SubjectLogonId_label	additional.fields	Merged
THostName_label	additional.fields	Merged
TargetLinkedLogonId_label	additional.fields	Merged
TestSigning_label	additional.fields	Merged
Ticket_type_label	additional.fields	Merged
TokenBindingProvidedId_label	additional.fields	Merged
TokenBindingReferredId_label	additional.fields	Merged
TokenElevationType_label	additional.fields	Merged
TransactionId_label	additional.fields	Merged
TransmittedServices_label	additional.fields	Merged
Trigger_label	additional.fields	Merged
UserAgentString_label	additional.fields	Merged
UserId_label	additional.fields	Merged
VirtualAccount_label	additional.fields	Merged
VsmLaunchType_label	additional.fields	Merged
X_MS_Endpoint_Absolute_Path_label1	additional.fields	Merged
acc_mask_label	additional.fields	Merged
access_mask_label	additional.fields	Merged
account_name_label	additional.fields	Merged
acct_authentic	additional.fields	Merged
acct_input_octets	additional.fields	Merged
acct_input_packets	additional.fields	Merged
acct_link_count	additional.fields	Merged
acct_output_octets	additional.fields	Merged
acct_output_packets	additional.fields	Merged
acct_session_time	additional.fields	Merged
acct_status_type	additional.fields	Merged
activity_id_label	additional.fields	Merged
add_label	additional.fields	Merged
add_labels202	additional.fields	Merged
addition_ObjectClass	additional.fields	Merged
additional_ClientAdvertizedEncryptionTypes	additional.fields	Merged
additional_ParameterBinding_Add-Type	additional.fields	Merged
additional_Requested_Operation_Desired_Access	additional.fields	Merged
additional_TargetDomainName	additional.fields	Merged
additional_The_SSPI_client_process_is_SYSTEM_PID	additional.fields	Merged
additional_access_mask	additional.fields	Merged
additional_data_label	additional.fields	Merged
additional_field	additional.fields	Merged
additional_field_subject_domain_name	additional.fields	Merged
additional_field_task_category	additional.fields	Merged
additional_information_label	additional.fields	Merged
additional_member_name	additional.fields	Merged
additional_user_data	additional.fields	Merged
attribute_label	additional.fields	Merged
attribute_ldap_display_name_label	additional.fields	Merged
attribute_selection_label	additional.fields	Merged
attributes_preventing_optimization_label	additional.fields	Merged
audit_policy_changes_label	additional.fields	Merged
audit_schema_version_label	additional.fields	Merged
authentication_type_label	additional.fields	Merged
backup_type_label	additional.fields	Merged
ca_label	additional.fields	Merged
cab_id_label	additional.fields	Merged
caller_identity_label	additional.fields	Merged
caller_user_name_label	additional.fields	Merged
category_label	additional.fields	Merged
certificate_identity_label	additional.fields	Merged
charset_label	additional.fields	Merged
check_field_server_names	additional.fields	Merged
class	additional.fields	Merged
class_type_label	additional.fields	Merged
clean_pages_modified_label	additional.fields	Merged
client_options1_label	additional.fields	Merged
client_options_label	additional.fields	Merged
client_request_id_label	additional.fields	Merged
connect_info	additional.fields	Merged
connect_options_label	additional.fields	Merged
content_length_label	additional.fields	Merged
data_1_label	additional.fields	Merged
data_2_label	additional.fields	Merged
data_3_label	additional.fields	Merged
dirty_pages_modified_label	additional.fields	Merged
disposition_label	additional.fields	Merged
domain_label	additional.fields	Merged
environment_label	additional.fields	Merged
event_data_d_word_val_label	additional.fields	Merged
event_data_method_label	additional.fields	Merged
event_data_p10_label	additional.fields	Merged
event_data_p11_label	additional.fields	Merged
event_data_p12_label	additional.fields	Merged
event_data_p13_label	additional.fields	Merged
event_data_p14_label	additional.fields	Merged
event_data_p15_label	additional.fields	Merged
event_data_p16_label	additional.fields	Merged
event_data_p17_label	additional.fields	Merged
event_data_p18_label	additional.fields	Merged
event_data_p19_label	additional.fields	Merged
event_data_p1_label	additional.fields	Merged
event_data_p20_label	additional.fields	Merged
event_data_p21_label	additional.fields	Merged
event_data_p22_label	additional.fields	Merged
event_data_p23_label	additional.fields	Merged
event_data_p24_label	additional.fields	Merged
event_data_p25_label	additional.fields	Merged
event_data_p26_label	additional.fields	Merged
event_data_p27_label	additional.fields	Merged
event_data_p28_label	additional.fields	Merged
event_data_p29_label	additional.fields	Merged
event_data_p2_label	additional.fields	Merged
event_data_p30_label	additional.fields	Merged
event_data_p31_label	additional.fields	Merged
event_data_p32_label	additional.fields	Merged
event_data_p33_label	additional.fields	Merged
event_data_p34_label	additional.fields	Merged
event_data_p35_label	additional.fields	Merged
event_data_p36_label	additional.fields	Merged
event_data_p37_label	additional.fields	Merged
event_data_p38_label	additional.fields	Merged
event_data_p39_label	additional.fields	Merged
event_data_p3_label	additional.fields	Merged
event_data_p40_label	additional.fields	Merged
event_data_p41_label	additional.fields	Merged
event_data_p42_label	additional.fields	Merged
event_data_p43_label	additional.fields	Merged
event_data_p44_label	additional.fields	Merged
event_data_p45_label	additional.fields	Merged
event_data_p46_label	additional.fields	Merged
event_data_p47_label	additional.fields	Merged
event_data_p48_label	additional.fields	Merged
event_data_p49_label	additional.fields	Merged
event_data_p4_label	additional.fields	Merged
event_data_p50_label	additional.fields	Merged
event_data_p51_label	additional.fields	Merged
event_data_p52_label	additional.fields	Merged
event_data_p53_label	additional.fields	Merged
event_data_p54_label	additional.fields	Merged
event_data_p55_label	additional.fields	Merged
event_data_p56_label	additional.fields	Merged
event_data_p57_label	additional.fields	Merged
event_data_p58_label	additional.fields	Merged
event_data_p59_label	additional.fields	Merged
event_data_p5_label	additional.fields	Merged
event_data_p60_label	additional.fields	Merged
event_data_p61_label	additional.fields	Merged
event_data_p62_label	additional.fields	Merged
event_data_p63_label	additional.fields	Merged
event_data_p64_label	additional.fields	Merged
event_data_p65_label	additional.fields	Merged
event_data_p66_label	additional.fields	Merged
event_data_p67_label	additional.fields	Merged
event_data_p68_label	additional.fields	Merged
event_data_p69_label	additional.fields	Merged
event_data_p6_label	additional.fields	Merged
event_data_p70_label	additional.fields	Merged
event_data_p71_label	additional.fields	Merged
event_data_p72_label	additional.fields	Merged
event_data_p73_label	additional.fields	Merged
event_data_p74_label	additional.fields	Merged
event_data_p75_label	additional.fields	Merged
event_data_p76_label	additional.fields	Merged
event_data_p77_label	additional.fields	Merged
event_data_p78_label	additional.fields	Merged
event_data_p79_label	additional.fields	Merged
event_data_p7_label	additional.fields	Merged
event_data_p80_label	additional.fields	Merged
event_data_p81_label	additional.fields	Merged
event_data_p82_label	additional.fields	Merged
event_data_p83_label	additional.fields	Merged
event_data_p84_label	additional.fields	Merged
event_data_p85_label	additional.fields	Merged
event_data_p86_label	additional.fields	Merged
event_data_p87_label	additional.fields	Merged
event_data_p88_label	additional.fields	Merged
event_data_p89_label	additional.fields	Merged
event_data_p8_label	additional.fields	Merged
event_data_p90_label	additional.fields	Merged
event_data_p91_label	additional.fields	Merged
event_data_p92_label	additional.fields	Merged
event_data_p9_label	additional.fields	Merged
event_data_param1_label	additional.fields	Merged
event_data_param2_label	additional.fields	Merged
event_data_param3_label	additional.fields	Merged
event_data_param4_label	additional.fields	Merged
event_data_param5_label	additional.fields	Merged
event_data_param6_label	additional.fields	Merged
event_data_param7_label	additional.fields	Merged
event_data_processing_mode_label	additional.fields	Merged
event_data_processing_time_in_milliseconds_label	additional.fields	Merged
event_data_stage_label	additional.fields	Merged
event_data_support_info1_label	additional.fields	Merged
event_data_support_info2_label	additional.fields	Merged
event_data_thumbprint_label	additional.fields	Merged
event_id_label	additional.fields	Merged
event_in_seq_label	additional.fields	Merged
event_time_label	additional.fields	Merged
exception_info_label	additional.fields	Merged
expensive_search_operations_label	additional.fields	Merged
failure_reason_label	additional.fields	Merged
framework_version_label	additional.fields	Merged
hashed_bucket_label	additional.fields	Merged
inefficient_search_operations_label	additional.fields	Merged
install_date_label	additional.fields	Merged
is_column_permission_label	additional.fields	Merged
is_dac_label	additional.fields	Merged
keywords_label	additional.fields	Merged
label01	additional.fields	Merged
label02	additional.fields	Merged
label03	additional.fields	Merged
label461	additional.fields	Merged
label462	additional.fields	Merged
label463	additional.fields	Merged
label46561	additional.fields	Merged
label46562	additional.fields	Merged
label46563	additional.fields	Merged
label46564	additional.fields	Merged
label46565	additional.fields	Merged
label46571	additional.fields	Merged
label46572	additional.fields	Merged
label47681	additional.fields	Merged
label47682	additional.fields	Merged
label501	additional.fields	Merged
label601	additional.fields	Merged
label_for_additional_fields	additional.fields	Merged
labels0	additional.fields	Merged
labels401	additional.fields	Merged
labels46411	additional.fields	Merged
labels46412	additional.fields	Merged
labels46413	additional.fields	Merged
labels46414	additional.fields	Merged
labels46415	additional.fields	Merged
labels46416	additional.fields	Merged
labels46417	additional.fields	Merged
level_label	additional.fields	Merged
logon_guid_label	additional.fields	Merged
logon_id_label	additional.fields	Merged
mapped_name_label	additional.fields	Merged
mapping_by_label	additional.fields	Merged
mapping_channel	additional.fields	Merged
mapping_opcode	additional.fields	Merged
method	additional.fields	Merged
method_executed_label	additional.fields	Merged
namespace_label	additional.fields	Merged
nas_port_type_label	additional.fields	Merged
network_information_label	additional.fields	Merged
new_obj_dn_label	additional.fields	Merged
new_target_user_name_label	additional.fields	Merged
number_of_search_operations_label	additional.fields	Merged
object_class_label	additional.fields	Merged
object_dn_label	additional.fields	Merged
operation_type_label	additional.fields	Merged
p10_label	additional.fields	Merged
p2_label	additional.fields	Merged
p3_label	additional.fields	Merged
p4_label	additional.fields	Merged
p5_label	additional.fields	Merged
p6_label	additional.fields	Merged
p7_label	additional.fields	Merged
p8_label	additional.fields	Merged
p9_label	additional.fields	Merged
package_label	additional.fields	Merged
packet_data_size_label	additional.fields	Merged
pages_preread_from_disk_label	additional.fields	Merged
pages_read_from_disk_label	additional.fields	Merged
pages_referenced_label	additional.fields	Merged
parent_id_label	additional.fields	Merged
payload_label	additional.fields	Merged
perm_consumer_label	additional.fields	Merged
permission_bitmask_label	additional.fields	Merged
platform_label	additional.fields	Merged
pooled_connection_label	additional.fields	Merged
problem_signature_label	additional.fields	Merged
protocol_seq_label	additional.fields	Merged
proxy_dns_name_label	additional.fields	Merged
query_string_label	additional.fields	Merged
reason_code	additional.fields	Merged
reason_code_labels	additional.fields	Merged
report_id_label	additional.fields	Merged
report_status_label	additional.fields	Merged
req_id_label	additional.fields	Merged
request_detail_label	additional.fields	Merged
request_id_label	additional.fields	Merged
request_path_label	additional.fields	Merged
requester_label	additional.fields	Merged
response_detail_label	additional.fields	Merged
response_label	additional.fields	Merged
returned_entries_label	additional.fields	Merged
search_scope_label	additional.fields	Merged
search_time_ms_label	additional.fields	Merged
sequence_group_id_label	additional.fields	Merged
sequence_number_label	additional.fields	Merged
session_label	additional.fields	Merged
sidtype_label	additional.fields	Merged
source_group_label	additional.fields	Merged
source_module_label	additional.fields	Merged
span_id_label	additional.fields	Merged
stage	additional.fields	Merged
starting_node_label	additional.fields	Merged
statement_label	additional.fields	Merged
subject_key_label	additional.fields	Merged
subject_label	additional.fields	Merged
subject_logon_id_label	additional.fields	Merged
subject_logon_id_label_1	additional.fields	Merged
subject_machine_name_label	additional.fields	Merged
subject_user_name_label	additional.fields	Merged
suppress_count_label	additional.fields	Merged
suppress_label	additional.fields	Merged
system_keyword_label	additional.fields	Merged
target_label	additional.fields	Merged
target_labels	additional.fields	Merged
target_logon_id_label	additional.fields	Merged
target_relying_party_label	additional.fields	Merged
target_user_id_label	additional.fields	Merged
temp_additional_event_category	additional.fields	Merged
temp_additional_event_type	additional.fields	Merged
temp_additional_insert_id	additional.fields	Merged
temp_additional_log_name	additional.fields	Merged
temp_additional_qualifiers	additional.fields	Merged
temp_additional_time_gen	additional.fields	Merged
temp_additional_time_written	additional.fields	Merged
temp_query	additional.fields	Merged
these_files_may_be_available_here_label	additional.fields	Merged
thread_id_label	additional.fields	Merged
through_proxy_label	additional.fields	Merged
ticket_options_label	additional.fields	Merged
time_interval_hours_label	additional.fields	Merged
token_@_xmlns_	additional.fields	Merged
token_subject_logon_id	additional.fields	Merged
trace_id_label	additional.fields	Merged
transaction_id_label	additional.fields	Merged
uf_type_label	additional.fields	Merged
uf_version_label	additional.fields	Merged
used_indexes_label	additional.fields	Merged
user_data_0x8000003F_@_xmlns__label	additional.fields	Merged
user_data_0x8000003F_process_id_label	additional.fields	Merged
user_data_0x8000003F_providers_in_host_label	additional.fields	Merged
user_data_0x8000003F_quota_name_label	additional.fields	Merged
user_data_0x8000003F_quota_threshold_label	additional.fields	Merged
user_data_0x8000003F_quota_value_label	additional.fields	Merged
user_defined_event_id_label	additional.fields	Merged
user_defined_information_label	additional.fields	Merged
user_id_label	additional.fields	Merged
value_is_near_1	additional.fields	Mapped: true → add_labels202
var_client_name	additional.fields	Merged
var_workstation_name	additional.fields	Merged
version_label	additional.fields	Merged
visited_entries_label	additional.fields	Merged
vsad_label	additional.fields	Merged
x_ms_adfs_proxy_client_ip_label	additional.fields	Merged
x_ms_client_application_label	additional.fields	Merged
x_ms_client_user_agent_label	additional.fields	Merged
x_ms_forwarded_client_ip_label	additional.fields	Merged
x_ms_proxy_label	additional.fields	Merged
xmlns_label1	additional.fields	Merged
LogonType	extensions.auth.auth_details	Renamed/mapped
EventID	extensions.auth.mechanism	Mapped: 4908, 4964 → auth_mechanism1, 4908, 4964 → auth_mechanism, ` 1202,1203...
SourceName	extensions.auth.mechanism	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a...
auth_mechanism	extensions.auth.mechanism	Merged
auth_mechanism1	extensions.auth.mechanism	Merged
auth_type	extensions.auth.type	Renamed/mapped
EventID	intermediary	Mapped: 4908, 4964 → intermediary_label, ` 8015, 8018, 8019, 8020, 8027, 8033, 8010, ...
SourceName	intermediary	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `i...
intermediary_label	intermediary	Merged
ComputerName	intermediary.hostname	Directly mapped
HostName	intermediary.hostname	Directly mapped
Hostname	intermediary.hostname	Directly mapped
intermediary_ip	intermediary.ip	Merged
metadata_description	metadata.description	Directly mapped
Detection Time	metadata.event_timestamp	Parsed as ISO8601
EventReceivedTime	metadata.event_timestamp	Parsed as yyyy-MM-dd HH:mm:ss
EventTime	metadata.event_timestamp	Parsed as ISO8601
NewTime	metadata.event_timestamp	Parsed as ISO8601
PasswordLastSet	metadata.event_timestamp	Parsed as M/dd/yyyy H:mm:ss A
PreviousTime	metadata.event_timestamp	Parsed as ISO8601
ValidFrom	metadata.event_timestamp	Parsed as ISO8601
ValidTo	metadata.event_timestamp	Parsed as ISO8601
event_time	metadata.event_timestamp	Parsed as MMM dd HH:mm:ss
event_timestamp	metadata.event_timestamp	Parsed as yyyy-MM-dd HH:mm:ss
eventtime1	metadata.event_timestamp	Parsed as UNIX_MS
receiveTimestamp	metadata.event_timestamp	Parsed as yyyy-MM-ddTHH:mm:ssZ
syslog_ts	metadata.event_timestamp	Parsed as yyyy-MM-ddTHH:mm:ss Z
EventID	metadata.event_type	Mapped values (18 total, e.g., 4908, 4964 → STATUS_UPDATE, 4908, 4964 → `GENERIC_... )
SourceName	metadata.event_type	Mapped values (9 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu... )
event_type	metadata.event_type	Directly mapped
has_principal	metadata.event_type	Mapped: true → NETWORK_CONNECTION, true → STATUS_UPDATE
udm_event_type	metadata.event_type	Renamed/mapped
ProviderGuid	metadata.product_deployment_id	Renamed/mapped
EventID	metadata.product_event_type	Directly mapped
product_event_type	metadata.product_event_type	Directly mapped
RecordNumber	metadata.product_log_id	Renamed/mapped
SourceName	metadata.product_name	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `M...
EventID	metadata.vendor_name	Mapped: 4908, 4964 → Microsoft
SourceName	metadata.vendor_name	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `M...
app_protocol	network.application_protocol	Renamed/mapped
Direction	network.direction	Renamed/mapped
EventID	network.dns.questions	Mapped: 4908, 4964 → questions, 1014, 3008 → questions
SourceName	network.dns.questions	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `q...
questions	network.dns.questions	Merged
http_method	network.http.method	Directly mapped
_userAgentString	network.http.parsed_user_agent	Renamed/mapped
_userAgentString	network.http.user_agent	Directly mapped
ac-user-agent	network.http.user_agent	Directly mapped
ip_protocol_out	network.ip_protocol	Renamed/mapped
AcctMultiSsnID	network.session_id	Directly mapped
SessionID	network.session_id	Directly mapped
SessionId	network.session_id	Directly mapped
SessionName	network.session_id	Renamed/mapped
session_id	network.session_id	Directly mapped
CAName	network.tls.client.certificate.issuer	Directly mapped
Issuer	network.tls.client.certificate.issuer	Renamed/mapped
LocalMMIssuingCA	network.tls.client.certificate.issuer	Directly mapped
CertificateHash	network.tls.client.certificate.md5	Directly mapped
SerialNumber	network.tls.client.certificate.serial	Directly mapped
client_certificate_serial	network.tls.client.certificate.serial	Renamed/mapped
CertificateHash	network.tls.client.certificate.sha1	Directly mapped
client_certificate_sha1	network.tls.client.certificate.sha1	Renamed/mapped
CertificateHash	network.tls.client.certificate.sha256	Directly mapped
client_certificate_subject	network.tls.client.certificate.subject	Renamed/mapped
RemoteMMIssuingCA	network.tls.server.certificate.issuer	Directly mapped
server_certificate_subject	network.tls.server.certificate.subject	Renamed/mapped
SourceModuleType	observer.application	Renamed/mapped
IssuingKDC	observer.asset.asset_id	Directly mapped
EventID	observer.labels	Mapped: 4908, 4964 → verb_label, 4908, 4964 → source_module_label
SourceName	observer.labels	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v...
source_module_label	observer.labels	Merged
verb_label	observer.labels	Merged
AccountDomain	principal.administrative_domain	Renamed/mapped
CallerDomainName	principal.administrative_domain	Renamed/mapped
Domain	principal.administrative_domain	Renamed/mapped
SubjectDomainName	principal.administrative_domain	Renamed/mapped
administrative_domain	principal.administrative_domain	Directly mapped
principal_domain_name	principal.administrative_domain	Renamed/mapped
principal_application	principal.application	Renamed/mapped
src_application	principal.application	Renamed/mapped
device-uid	principal.asset.asset_id	Directly mapped
EventID	principal.asset.attribute.labels	Mapped values (7 total, e.g., 4908, 4964 → server_principal_id_label, 4908, 4964 ... )
SourceName	principal.asset.attribute.labels	Mapped values (7 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu... )
label_for_principal_asset	principal.asset.attribute.labels	Merged
server_instance_name_label	principal.asset.attribute.labels	Merged
server_principal_id_label	principal.asset.attribute.labels	Merged
server_principal_name_label	principal.asset.attribute.labels	Merged
server_principal_sid_label	principal.asset.attribute.labels	Merged
session_server_principal_name_label	principal.asset.attribute.labels	Merged
token_new	principal.asset.attribute.labels	Merged
hardware	principal.asset.hardware	Merged
Hostname	principal.asset.hostname	Directly mapped
auth_server_host	principal.asset.hostname	Directly mapped
hostname	principal.asset.hostname	Directly mapped
principal_asset_hostname	principal.asset.hostname	Renamed/mapped
principal_hostname	principal.asset.hostname	Directly mapped
FramedIPAddress	principal.asset.ip	Merged
SourceName	principal.asset.ip	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `F...
calling_station_id	principal.asset.ip	Merged
src_ip	principal.asset.ip	Merged
var_domain_name	principal.asset.network_domain	Directly mapped
MachineInventory	principal.asset.platform_software.platform_version	Renamed/mapped
device-platform-version	principal.asset.platform_software.platform_version	Directly mapped
platform_version	principal.asset.platform_software.platform_version	Renamed/mapped
device-uid-global	principal.asset.product_object_id	Directly mapped
EventID	principal.asset.software	Mapped: 4908, 4964 → software_version
SourceName	principal.asset.software	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `s...
software_version	principal.asset.software	Merged
ClientRealm	principal.domain.name	Directly mapped
Path	principal.file.full_path	Directly mapped
PrincipalFileName	principal.file.full_path	Renamed/mapped
Hostname	principal.hostname	Directly mapped
auth_server_host	principal.hostname	Directly mapped
hostname	principal.hostname	Directly mapped
principal_asset_hostname	principal.hostname	Directly mapped
principal_hostname	principal.hostname	Directly mapped
EventID	principal.ip	Mapped: 4625, 4776, 4794 → temp_ip, 4908, 4964 → ip_address, 4908, 4964 → ...
FramedIPAddress	principal.ip	Merged
SourceName	principal.ip	Mapped values (5 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu...
calling_station_id	principal.ip	Merged
ip	principal.ip	Merged
ip_address	principal.ip	Merged
principal_ip	principal.ip	Merged
principal_ip1	principal.ip	Merged
src_ip	principal.ip	Merged
temp_ip	principal.ip	Merged
AdvancedOptions_label	principal.labels	Merged
ClientCreationTime_label	principal.labels	Merged
ConfigAccessPolicy_label	principal.labels	Merged
DisableIntegrityChecks_label	principal.labels	Merged
EventID	principal.labels	Mapped values (28 total, e.g., 4692, 4693, 4694, 4695, 4983, 4984 → `subject_logon_id_lab...
FlightSigning_label	principal.labels	Merged
HypervisorDebug_label	principal.labels	Merged
HypervisorLaunchType_label	principal.labels	Merged
HypervisorLoadOptions_label	principal.labels	Merged
KernelDebug_label	principal.labels	Merged
LoadOptions_label	principal.labels	Merged
RemoteEventLogging_label	principal.labels	Merged
SourceName	principal.labels	Mapped values (36 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec... )
SubjectLogonId_label	principal.labels	Merged
TestSigning_label	principal.labels	Merged
VsmLaunchType_label	principal.labels	Merged
acc_mask_label	principal.labels	Merged
account_name_label	principal.labels	Merged
caller_user_name_label	principal.labels	Merged
data_1_label	principal.labels	Merged
data_2_label	principal.labels	Merged
data_3_label	principal.labels	Merged
label01	principal.labels	Merged
label03	principal.labels	Merged
label461	principal.labels	Merged
label501	principal.labels	Merged
logon_id_label	principal.labels	Merged
method_executed_label	principal.labels	Merged
namespace_label	principal.labels	Merged
subject_logon_id_label	principal.labels	Merged
subject_machine_name_label	principal.labels	Merged
subject_user_name_label	principal.labels	Merged
user_id_label	principal.labels	Merged
var_client_name	principal.labels	Merged
var_workstation	principal.labels	Merged
var_workstation_name	principal.labels	Merged
CallingStationID	principal.mac	Mapped: (([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2})$ → CallingStationID
EventID	principal.mac	Mapped: 4908, 4964 → principal_mac
SourceName	principal.mac	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p...
calling_station_id	principal.mac	Merged
device-mac	principal.mac	Merged
mac	principal.mac	Merged
principal_mac	principal.mac	Merged
principal_port	principal.port	Renamed/mapped
AccessMask	principal.process.access_mask	Renamed/mapped
am	principal.process.access_mask	Renamed/mapped
ParentCommandLine	principal.process.command_line	Renamed/mapped
ProcessName	principal.process.command_line	Renamed/mapped
principal_process_command_line	principal.process.command_line	Renamed/mapped
task_arguments	principal.process.command_line	Renamed/mapped
CallerProcessName	principal.process.file.full_path	Renamed/mapped
ParentImage	principal.process.file.full_path	Renamed/mapped
SourceImage	principal.process.file.full_path	Renamed/mapped
principal_process_name	principal.process.file.full_path	Renamed/mapped
task_command	principal.process.file.full_path	Renamed/mapped
SourceName	principal.process.file.names	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v...
var_process_parent_name	principal.process.file.names	Merged
ParentProcessId	principal.process.parent_process.pid	Renamed/mapped
principal_process_pid	principal.process.pid	Renamed/mapped
process_id	principal.process.pid	Renamed/mapped
ObjectPath	principal.registry.registry_key	Renamed/mapped
EventID	principal.resource.attribute.permissions	Mapped: 4659, 5140, 5145 → permissions
SourceName	principal.resource.attribute.permissions	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p...
permissions	principal.resource.attribute.permissions	Merged
principal_resource_product_object_id	principal.resource.product_object_id	Renamed/mapped
EventID	principal.user.attribute.labels	Mapped: 4908, 4964 → label_for_principal_user, 4908, 4964 → user_label, ` 4908...
SourceName	principal.user.attribute.labels	Mapped values (6 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu... )
account_name_label	principal.user.attribute.labels	Merged
label_for_principal_user	principal.user.attribute.labels	Merged
sam_acc_label	principal.user.attribute.labels	Merged
sid_history_label	principal.user.attribute.labels	Merged
subject_user_sid_name_label	principal.user.attribute.labels	Merged
user_label	principal.user.attribute.labels	Merged
EventID	principal.user.attribute.roles	Mapped values (20 total, e.g., 4908, 4964 → roles, ` 7000, 7011, 7022, 7023, 7024, 702... )
SourceName	principal.user.attribute.roles	Mapped values (63 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec... )
roles	principal.user.attribute.roles	Merged
Subject_Logon_GUID	principal.user.product_object_id	Directly mapped
principal_user_display_name	principal.user.user_display_name	Renamed/mapped
AccountName	principal.user.userid	Renamed/mapped
AccountToReset	principal.user.userid	Renamed/mapped
CallerUserName	principal.user.userid	Renamed/mapped
SubjectMachineName	principal.user.userid	Renamed/mapped
SubjectUserName	principal.user.userid	Renamed/mapped
principal_user_id	principal.user.userid	Renamed/mapped
subject_machine_name	principal.user.userid	Renamed/mapped
principal_user_windows_sid	principal.user.windows_sid	Renamed/mapped
subject_machine_sid	principal.user.windows_sid	Directly mapped
EventID	security_result	Mapped values (5 total, e.g., 4953, 4957, 4951, 4952, 4958 → security_result1, ` 4908, ... )
SourceName	security_result	Mapped values (11 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec... )
category_details	security_result	Mapped values (9 total, e.g., ` "Security State Change", "Security System Extension", "System... )
label_security_result	security_result	Merged
security_result1	security_result	Merged
security_result2	security_result	Merged
security_result_1	security_result	Merged
security_result_2	security_result	Merged
security_result_3	security_result	Merged
security_result_4	security_result	Merged
security_result_5	security_result	Merged
KeyUserPath	security_result.about.file.full_path	Directly mapped
EventID	security_result.about.labels	Mapped: 4625, 4776, 4794 → failure_reason_label, 4908, 4964 → `label_for_security...
SourceName	security_result.about.labels	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `f...
failure_reason_label	security_result.about.labels	Merged
label_for_security_result_about_label	security_result.about.labels	Merged
EventID	security_result.about.resource.attribute.labels	Mapped values (14 total, e.g., 4908, 4964 → label, 4908, 4964 → label1, ` 4908,... )
SourceName	security_result.about.resource.attribute.labels	Mapped values (29 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec... )
TicketOptions_label	security_result.about.resource.attribute.labels	Merged
label	security_result.about.resource.attribute.labels	Merged
label1	security_result.about.resource.attribute.labels	Merged
label10	security_result.about.resource.attribute.labels	Merged
label11	security_result.about.resource.attribute.labels	Merged
label12	security_result.about.resource.attribute.labels	Merged
label13	security_result.about.resource.attribute.labels	Merged
label2	security_result.about.resource.attribute.labels	Merged
label3	security_result.about.resource.attribute.labels	Merged
label4	security_result.about.resource.attribute.labels	Merged
label5	security_result.about.resource.attribute.labels	Merged
label6	security_result.about.resource.attribute.labels	Merged
label7	security_result.about.resource.attribute.labels	Merged
label8	security_result.about.resource.attribute.labels	Merged
label9	security_result.about.resource.attribute.labels	Merged
security_result_about_resource_name	security_result.about.resource.name	Renamed/mapped
EventID	security_result.action	Mapped: 4908, 4964 → action
SourceName	security_result.action	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a...
action	security_result.action	Merged
security_action	security_result.action	Merged
Action Name	security_result.action_details	Directly mapped
action_details	security_result.action_details	Renamed/mapped
action_id	security_result.action_details	Directly mapped
EventID	security_result.category	Mapped: 4908, 4964 → category
SourceName	security_result.category	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `c...
category	security_result.category	Merged
Category	security_result.category_details	Merged
CategoryId	security_result.category_details	Merged
CategoryName	security_result.category_details	Merged
EventID	security_result.category_details	Mapped: 4908, 4964 → Category, 4908, 4964 → CategoryName, ` 102, 103, 300, 301...
SourceName	security_result.category_details	Mapped values (9 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu... )
AccessReason	security_result.description	Directly mapped
AdditionalInfo	security_result.description	Renamed/mapped
AuditPolicyChanges	security_result.description	Directly mapped
Data_2	security_result.description	Directly mapped
Error Description	security_result.description	Directly mapped
ErrorContext	security_result.description	Directly mapped
ErrorMessage	security_result.description	Directly mapped
Message	security_result.description	Directly mapped
ReasonForRejection	security_result.description	Renamed/mapped
RootCause	security_result.description	Directly mapped
description	security_result.description	Renamed/mapped
security_description	security_result.description	Directly mapped
status	security_result.description	Directly mapped
AdditionalInfo2_label	security_result.detection_fields	Merged
AppendData_or_AddSubdirectory_or_CreatePipeInstance_label	security_result.detection_fields	Merged
ApplicationDomain_label	security_result.detection_fields	Merged
ApplicationPath_label	security_result.detection_fields	Merged
ApplicationVirtualPath_label	security_result.detection_fields	Merged
AuthenticationType_label	security_result.detection_fields	Merged
CONTROL_label	security_result.detection_fields	Merged
CustomEventDetails_label	security_result.detection_fields	Merged
DAC_label	security_result.detection_fields	Merged
DELETE_label	security_result.detection_fields	Merged
ErrorCode_label	security_result.detection_fields	Merged
EventCode_label	security_result.detection_fields	Merged
EventDetailCode_label	security_result.detection_fields	Merged
EventID	security_result.detection_fields	Mapped values (150 total, e.g., 5158,5159,5154,5153,5155 → labels0, ` 5158,5159,5154,51... )
EventId_label	security_result.detection_fields	Merged
EventOccurrence_label	security_result.detection_fields	Merged
EventSequence_label	security_result.detection_fields	Merged
FailureId_label	security_result.detection_fields	Merged
GPOList_label	security_result.detection_fields	Merged
IsAuthenticated_label	security_result.detection_fields	Merged
IsImpersonating_label	security_result.detection_fields	Merged
MasterKeyId_label	security_result.detection_fields	Merged
ReadAttributes_label	security_result.detection_fields	Merged
RecoveryKeyId_label	security_result.detection_fields	Merged
RequestPath_label	security_result.detection_fields	Merged
SecurityDescriptor_label	security_result.detection_fields	Merged
Sid_Filtering_label	security_result.detection_fields	Merged
SourceName	security_result.detection_fields	Mapped values (357 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows se... )
StackTrace_label	security_result.detection_fields	Merged
ThreadAccountName_label	security_result.detection_fields	Merged
ThreadId_label	security_result.detection_fields	Merged
TrustLevel_label	security_result.detection_fields	Merged
Trust_Attributes_label	security_result.detection_fields	Merged
Trust_Direction_label	security_result.detection_fields	Merged
Trust_Type_label	security_result.detection_fields	Merged
WriteAttributes_label	security_result.detection_fields	Merged
WriteData_or_AddFile_label	security_result.detection_fields	Merged
WriteEA_label	security_result.detection_fields	Merged
account_name_label	security_result.detection_fields	Merged
action_id_label	security_result.detection_fields	Merged
affected_rows_label	security_result.detection_fields	Merged
analysis_symbol_label	security_result.detection_fields	Merged
application_information_label	security_result.detection_fields	Merged
application_name_label	security_result.detection_fields	Merged
audit_event_label	security_result.detection_fields	Merged
audit_schema_version_label	security_result.detection_fields	Merged
cert_issuer_name_label	security_result.detection_fields	Merged
cert_serial_number_label	security_result.detection_fields	Merged
cert_thumbprint_label	security_result.detection_fields	Merged
class_type_label	security_result.detection_fields	Merged
client_ip_label	security_result.detection_fields	Merged
client_name_label	security_result.detection_fields	Merged
client_name_session_id_label	security_result.detection_fields	Merged
client_tls_version_label	security_result.detection_fields	Merged
client_tls_version_name_label	security_result.detection_fields	Merged
connection_id_label	security_result.detection_fields	Merged
database_name_label	security_result.detection_fields	Merged
database_principal_id_label	security_result.detection_fields	Merged
database_principal_name_label	security_result.detection_fields	Merged
database_transaction_id_label	security_result.detection_fields	Merged
detect_field	security_result.detection_fields	Merged
detection_fields	security_result.detection_fields	Merged
detection_label	security_result.detection_fields	Merged
device_guid_label	security_result.detection_fields	Merged
duration_milliseconds_label	security_result.detection_fields	Merged
error_label	security_result.detection_fields	Merged
event_detail_code_label	security_result.detection_fields	Merged
event_id_label	security_result.detection_fields	Merged
event_message_label	security_result.detection_fields	Merged
event_name_label	security_result.detection_fields	Merged
event_occurrence_label	security_result.detection_fields	Merged
event_sequence_label	security_result.detection_fields	Merged
event_time_label	security_result.detection_fields	Merged
event_time_utc_label	security_result.detection_fields	Merged
exce_label	security_result.detection_fields	Merged
exception_information_label	security_result.detection_fields	Merged
external_policy_permissions_checked_label	security_result.detection_fields	Merged
failure_status_label	security_result.detection_fields	Merged
host_name_label	security_result.detection_fields	Merged
is_column_permission_label	security_result.detection_fields	Merged
is_impersonating_label	security_result.detection_fields	Merged
is_local_secondary_replica_label	security_result.detection_fields	Merged
label	security_result.detection_fields	Merged
label_for_security_result_detection	security_result.detection_fields	Merged
labels0	security_result.detection_fields	Merged
labels1	security_result.detection_fields	Merged
labels2	security_result.detection_fields	Merged
labels3	security_result.detection_fields	Merged
ledger_start_sequence_number_label	security_result.detection_fields	Merged
machine_name_label	security_result.detection_fields	Merged
nas_port_field	security_result.detection_fields	Merged
network_protocol_label	security_result.detection_fields	Merged
object_id_label	security_result.detection_fields	Merged
object_name_label	security_result.detection_fields	Merged
obo_middle_tier_app_id_label	security_result.detection_fields	Merged
permission_bitmask_label	security_result.detection_fields	Merged
proxy_policy_name	security_result.detection_fields	Merged
req_url_label	security_result.detection_fields	Merged
response_rows_label	security_result.detection_fields	Merged
response_ticket_label	security_result.detection_fields	Merged
schema_name_label	security_result.detection_fields	Merged
sec_error_label	security_result.detection_fields	Merged
security_detection1	security_result.detection_fields	Merged
security_detection2	security_result.detection_fields	Merged
security_detection3	security_result.detection_fields	Merged
security_detection4	security_result.detection_fields	Merged
sequence_group_id_label	security_result.detection_fields	Merged
sequence_number_label	security_result.detection_fields	Merged
server_instance_name_label	security_result.detection_fields	Merged
server_principal_id_label	security_result.detection_fields	Merged
server_principal_name_label	security_result.detection_fields	Merged
server_principal_sid_label	security_result.detection_fields	Merged
session_id_label	security_result.detection_fields	Merged
session_server_principal_name_label	security_result.detection_fields	Merged
statement_label	security_result.detection_fields	Merged
succeeded_label	security_result.detection_fields	Merged
target_database_principal_id_label	security_result.detection_fields	Merged
target_database_principal_name_label	security_result.detection_fields	Merged
target_server_principal_id_label	security_result.detection_fields	Merged
target_server_principal_name_label	security_result.detection_fields	Merged
target_server_principal_sid_label	security_result.detection_fields	Merged
transaction_id_label	security_result.detection_fields	Merged
type_label	security_result.detection_fields	Merged
user_defined_event_id_label	security_result.detection_fields	Merged
user_defined_information_label	security_result.detection_fields	Merged
var_Action_ID	security_result.detection_fields	Merged
var_Additional_Actions_ID	security_result.detection_fields	Merged
var_Additional_Actions_String	security_result.detection_fields	Merged
var_Category_ID	security_result.detection_fields	Merged
var_DetectionOrigin	security_result.detection_fields	Merged
var_DetectionSource	security_result.detection_fields	Merged
var_DetectionType	security_result.detection_fields	Merged
var_Detection_ID	security_result.detection_fields	Merged
var_EngineVersion	security_result.detection_fields	Merged
var_Error_Code	security_result.detection_fields	Merged
var_Execution_ID	security_result.detection_fields	Merged
var_Execution_Name	security_result.detection_fields	Merged
var_Origin_ID	security_result.detection_fields	Merged
var_Post_Clean_Status	security_result.detection_fields	Merged
var_Pre_Execution_Status	security_result.detection_fields	Merged
var_SecurityintelligenceVersion	security_result.detection_fields	Merged
var_SeverityName	security_result.detection_fields	Merged
var_Severity_ID	security_result.detection_fields	Merged
var_Source_ID	security_result.detection_fields	Merged
var_State	security_result.detection_fields	Merged
var_Status_Code	security_result.detection_fields	Merged
var_Type_ID	security_result.detection_fields	Merged
var_process_information	security_result.detection_fields	Merged
var_process_name	security_result.detection_fields	Merged
var_request_information	security_result.detection_fields	Merged
var_stack_trace	security_result.detection_fields	Merged
var_thread_account_name	security_result.detection_fields	Merged
Priority	security_result.priority_details	Renamed/mapped
RuleId	security_result.rule_id	Renamed/mapped
EventID	security_result.rule_labels	Mapped: 4908, 4964 → Title_label, 4908, 4964 → `label_for_security_result_rule_l...
SourceName	security_result.rule_labels	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `T...
Title_label	security_result.rule_labels	Merged
label_for_security_result_rule_label	security_result.rule_labels	Merged
EventID	security_result.rule_name	Directly mapped
connection_req_policy	security_result.rule_name	Directly mapped
Severity	security_result.severity	Renamed/mapped
BlockReasonErrorCode	security_result.summary	Directly mapped
CorruptionActionState	security_result.summary	Directly mapped
CrashOnAuditFailValue	security_result.summary	Directly mapped
Error	security_result.summary	Directly mapped
ErrorCode	security_result.summary	Directly mapped
FailureReason	security_result.summary	Directly mapped
FinalStatus	security_result.summary	Directly mapped
QueryResults	security_result.summary	Directly mapped
Reason	security_result.summary	Directly mapped
Status	security_result.summary	Directly mapped
Win32Error	security_result.summary	Directly mapped
error	security_result.summary	Directly mapped
hr	security_result.summary	Directly mapped
param1	security_result.summary	Directly mapped
sec_summary	security_result.summary	Directly mapped
security_summary	security_result.summary	Directly mapped
status	security_result.summary	Directly mapped
summary	security_result.summary	Renamed/mapped
ThreatID	security_result.threat_id	Directly mapped
ThreatName	security_result.threat_name	Directly mapped
src_path	src.file.full_path	Renamed/mapped
CallerComputerName	src.hostname	Directly mapped
EventID	src.ip	Mapped: 4908, 4964 → varclientip, ` 1162, 1311, 1535, 1566, 1644, 1865, 1925, 2085, 2...
SourceName	src.ip	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v...
varclientip	src.ip	Merged
varclientport	src.port	Renamed/mapped
Service	src.resource.name	Renamed/mapped
SourceDRA	src.resource.name	Directly mapped
SourceHandleId	src.resource.name	Renamed/mapped
EventID	target	Mapped: 4908, 4964 → clsid_labels, 10001, 10002, 10100 → clsid_labels
SourceName	target	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `c...
clsid_labels	target	Merged
DomainName	target.administrative_domain	Renamed/mapped
ServerRealm	target.administrative_domain	Directly mapped
TargetDomainName	target.administrative_domain	Renamed/mapped
subject_domain_name	target.administrative_domain	Renamed/mapped
target_domain_name	target.administrative_domain	Renamed/mapped
ServiceName	target.application	Directly mapped
Targetname	target.application	Directly mapped
event_source	target.application	Directly mapped
target_application	target.application	Renamed/mapped
UserData.InstallDeviceID.DeviceInstanceID	target.asset.asset_id	Directly mapped
EventID	target.asset.attribute.labels	Mapped values (10 total, e.g., 4741, 4742 → dns_host_label, 4908, 4964 → `user_dat... )
SourceName	target.asset.attribute.labels	Mapped values (14 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec... )
dns_host_label	target.asset.attribute.labels	Merged
label_for_target_asset	target.asset.attribute.labels	Merged
target_server_principal_id_label	target.asset.attribute.labels	Merged
target_server_principal_name_label	target.asset.attribute.labels	Merged
target_server_principal_sid_label	target.asset.attribute.labels	Merged
token_new	target.asset.attribute.labels	Merged
user_data_install_device_id_is_driver_oem_label	target.asset.attribute.labels	Merged
user_data_install_device_id_reboot_option_label	target.asset.attribute.labels	Merged
user_data_install_device_id_setup_class_label	target.asset.attribute.labels	Merged
user_data_install_device_id_upgrade_device_label	target.asset.attribute.labels	Merged
AccountName	target.asset.hostname	Directly mapped
NodeName	target.asset.hostname	Directly mapped
client_name	target.asset.hostname	Directly mapped
target_hostname	target.asset.hostname	Directly mapped
ClientIPAddress	target.asset.ip	Merged
NASIPAddress	target.asset.ip	Merged
SourceName	target.asset.ip	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `N...
called_station_id	target.asset.ip	Merged
client_ip	target.asset.ip	Merged
nas_ip	target.asset.ip	Merged
UserData.InstallDeviceID.DeviceInstanceID	target.asset_id	Directly mapped
Data_1	target.domain.name	Directly mapped
TargetName	target.domain.name	Directly mapped
TargetRealm	target.domain.name	Directly mapped
param2	target.domain.name	Directly mapped
AutoBackup.BackupPath	target.file.full_path	Renamed/mapped
BackupFileName	target.file.full_path	Renamed/mapped
FileName	target.file.full_path	Renamed/mapped
FilePath	target.file.full_path	Renamed/mapped
KeyFilePath	target.file.full_path	Renamed/mapped
KeyUserPath	target.file.full_path	Renamed/mapped
Namespace	target.file.full_path	Renamed/mapped
PublishURLs	target.file.full_path	Renamed/mapped
ServiceFileName	target.file.full_path	Renamed/mapped
ShareLocalPath	target.file.full_path	Renamed/mapped
target_file_name	target.file.full_path	Renamed/mapped
MD5	target.file.md5	Renamed/mapped
EventID	target.file.names	Mapped: ` 5049, 5140 , 5145, 5142, 5143, 5144, 4698, 4702, 4699, 4700, 4701, 4946, 4690, 4...
RelativeTargetName	target.file.names	Merged
ScriptName	target.file.names	Merged
SourceName	target.file.names	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `R...
SHA1	target.file.sha1	Renamed/mapped
SHA256	target.file.sha256	Renamed/mapped
NewSize	target.file.size	Renamed/mapped
target_file_size	target.file.size	Renamed/mapped
EventID	target.group.attribute.labels	Mapped: 4908, 4964 → label_for_target_group
SourceName	target.group.attribute.labels	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `l...
label_for_target_group	target.group.attribute.labels	Merged
EventID	target.group.attribute.permissions	Mapped: ` 4656, 4704, 4672, 4731, 4720, 4723, 4726, 4728, 4729, 4730, 4732, 4733, 4734, 47...
SourceName	target.group.attribute.permissions	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p...
privilege_list	target.group.attribute.permissions	Merged
target_group_display_name	target.group.group_display_name	Renamed/mapped
target_group_product_object_id	target.group.product_object_id	Renamed/mapped
target_group_windows_sid	target.group.windows_sid	Renamed/mapped
AccountName	target.hostname	Directly mapped
client_name	target.hostname	Directly mapped
target_asset_hostname	target.hostname	Directly mapped
target_hostname	target.hostname	Renamed/mapped
ClientIPAddress	target.ip	Merged
EventID	target.ip	Mapped: 4908, 4964 → target_ip
NASIPAddress	target.ip	Merged
SourceName	target.ip	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v...
called_station_id	target.ip	Merged
client_ip	target.ip	Merged
nas_ip	target.ip	Merged
target_ip	target.ip	Merged
var_valid_ip	target.ip	Merged
ActiveProfile_label	target.labels	Merged
AppId_label	target.labels	Merged
CommandName_label	target.labels	Merged
ConfiguredNames_label	target.labels	Merged
DN_label	target.labels	Merged
DSType_label	target.labels	Merged
DirectiveName_label	target.labels	Merged
EngineVersion_label	target.labels	Merged
EventID	target.labels	Mapped values (35 total, e.g., 4907 , 4817, 4715 → ObjectServer_label, ` 4907 , 4817, 4... )
FQDN_label	target.labels	Merged
HandleId_label	target.labels	Merged
HostId_label	target.labels	Merged
HostVersion_label	target.labels	Merged
KeyLength_label	target.labels	Merged
LmPackageName_label	target.labels	Merged
MandatoryLabel_label	target.labels	Merged
NewState_label	target.labels	Merged
NotificationInterval_label	target.labels	Merged
ObjectServer_label	target.labels	Merged
Operation_label	target.labels	Merged
PipelineId_label	target.labels	Merged
Profiles_label	target.labels	Merged
ResourceManager_label	target.labels	Merged
ReturnCode_label	target.labels	Merged
RunspaceId_label	target.labels	Merged
ServiceStartType_label	target.labels	Merged
ServiceType_label	target.labels	Merged
SkuId_label	target.labels	Merged
SourceName	target.labels	Mapped values (77 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec... )
TargetLinkedLogonId_label	target.labels	Merged
TokenElevationType_label	target.labels	Merged
TransactionId_label	target.labels	Merged
TransmittedServices_label	target.labels	Merged
Trigger_label	target.labels	Merged
VirtualAccount_label	target.labels	Merged
client_friendly_name_label	target.labels	Merged
event_in_seq_label	target.labels	Merged
label02	target.labels	Merged
label462	target.labels	Merged
label463	target.labels	Merged
label46561	target.labels	Merged
label46562	target.labels	Merged
label46563	target.labels	Merged
label46564	target.labels	Merged
label46565	target.labels	Merged
label46571	target.labels	Merged
label46572	target.labels	Merged
label47681	target.labels	Merged
label47682	target.labels	Merged
label501	target.labels	Merged
label601	target.labels	Merged
labels46411	target.labels	Merged
labels46412	target.labels	Merged
labels46413	target.labels	Merged
labels46414	target.labels	Merged
labels46415	target.labels	Merged
labels46416	target.labels	Merged
labels46417	target.labels	Merged
nas_port_type	target.labels	Merged
new_target_user_name_label	target.labels	Merged
object_class_label	target.labels	Merged
object_dn_label	target.labels	Merged
target_label	target.labels	Merged
target_labels	target.labels	Merged
target_logon_id_label	target.labels	Merged
target_user_id_label	target.labels	Merged
EventID	target.mac	Mapped: 4908, 4964 → target_mac
NASIdentifier	target.mac	Mapped: (([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2})$ → NASIdentifier
SourceName	target.mac	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `t...
mac_address	target.mac	Merged
target_mac	target.mac	Merged
PeerPrivateAddress	target.nat_ip	Merged
SourceName	target.nat_ip	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `P...
NASPort	target.nat_port	Renamed/mapped
var_http_method	target.network.http.method	Directly mapped
target_platform_version	target.platform_version	Renamed/mapped
nas_port	target.port	Renamed/mapped
targetport	target.port	Renamed/mapped
CommandLine	target.process.command_line	Renamed/mapped
target_process_command_line	target.process.command_line	Renamed/mapped
ImagePath	target.process.file.full_path	Renamed/mapped
NewProcessName	target.process.file.full_path	Renamed/mapped
TargetProcessName	target.process.file.full_path	Renamed/mapped
target_process_file_full_path	target.process.file.full_path	Renamed/mapped
MD5	target.process.file.md5	Directly mapped
SourceName	target.process.file.names	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v...
var_process_file_name	target.process.file.names	Merged
SHA1	target.process.file.sha1	Directly mapped
SHA256	target.process.file.sha256	Directly mapped
target_parent_process_command_line	target.process.parent_process.command_line	Renamed/mapped
target_parent_process_file_full_path	target.process.parent_process.file.full_path	Renamed/mapped
target_parent_process_pid	target.process.parent_process.pid	Renamed/mapped
TargetProcessId	target.process.pid	Renamed/mapped
target_process_pid	target.process.pid	Renamed/mapped
EventOriginId	target.process.product_specific_process_id	Directly mapped
ObjectName	target.registry.registry_key	Directly mapped
ObjectVirtualPath	target.registry.registry_key	Renamed/mapped
target_registry_key	target.registry.registry_key	Renamed/mapped
NewValue	target.registry.registry_value_data	Renamed/mapped
target_registry_registry_value_data	target.registry.registry_value_data	Renamed/mapped
ObjectValueName	target.registry.registry_value_name	Renamed/mapped
registry_value	target.registry.registry_value_name	Renamed/mapped
target_registry_registry_value_name	target.registry.registry_value_name	Renamed/mapped
AlgorithmName_label	target.resource.attribute.labels	Merged
ClassId_label	target.resource.attribute.labels	Merged
ClassName_label	target.resource.attribute.labels	Merged
CompatibleIds_label	target.resource.attribute.labels	Merged
DomainBehaviorVersion_label	target.resource.attribute.labels	Merged
ErrorCode_label	target.resource.attribute.labels	Merged
EventID	target.resource.attribute.labels	Mapped values (101 total, e.g., 4907 , 4817, 4715 → label0, 4907 , 4817, 4715 → `la... )
ForceLogoff_label	target.resource.attribute.labels	Merged
HandleID_label	target.resource.attribute.labels	Merged
HardwareIds_label	target.resource.attribute.labels	Merged
KeyType_label	target.resource.attribute.labels	Merged
LocationInformation_label	target.resource.attribute.labels	Merged
LockoutDuration_label	target.resource.attribute.labels	Merged
LockoutObservationWindow_label	target.resource.attribute.labels	Merged
LockoutThreshold_label	target.resource.attribute.labels	Merged
MachineAccountQuota_label	target.resource.attribute.labels	Merged
MaxPasswordAge_label	target.resource.attribute.labels	Merged
MinPasswordAge_label	target.resource.attribute.labels	Merged
MinPasswordLength_label	target.resource.attribute.labels	Merged
MixedDomainMode_label	target.resource.attribute.labels	Merged
ModifiedObjectProperties_label	target.resource.attribute.labels	Merged
ObjectIdentifyingProperties_label	target.resource.attribute.labels	Merged
ObjectProperties_label	target.resource.attribute.labels	Merged
ObjectServer_label	target.resource.attribute.labels	Merged
OemInformation_label	target.resource.attribute.labels	Merged
PasswordHistoryLength_label	target.resource.attribute.labels	Merged
PasswordProperties_label	target.resource.attribute.labels	Merged
ProfileChanged_label	target.resource.attribute.labels	Merged
ProfileUsed_label	target.resource.attribute.labels	Merged
ProviderName_label	target.resource.attribute.labels	Merged
PuaCount_label	target.resource.attribute.labels	Merged
ResourceAttributes_label	target.resource.attribute.labels	Merged
SettingValue_label	target.resource.attribute.labels	Merged
SourceName	target.resource.attribute.labels	Mapped values (120 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows se... )
TemplateContent_label	target.resource.attribute.labels	Merged
TemplateDSObjectFQDN_label	target.resource.attribute.labels	Merged
TemplateSchemaVersion_label	target.resource.attribute.labels	Merged
TemplateVersion_label	target.resource.attribute.labels	Merged
TransactionId_label	target.resource.attribute.labels	Merged
database_principal_id_label	target.resource.attribute.labels	Merged
database_principal_name_label	target.resource.attribute.labels	Merged
entry_type_label	target.resource.attribute.labels	Merged
label0	target.resource.attribute.labels	Merged
label00	target.resource.attribute.labels	Merged
label01	target.resource.attribute.labels	Merged
label02	target.resource.attribute.labels	Merged
label03	target.resource.attribute.labels	Merged
label04	target.resource.attribute.labels	Merged
label05	target.resource.attribute.labels	Merged
label06	target.resource.attribute.labels	Merged
label07	target.resource.attribute.labels	Merged
label08	target.resource.attribute.labels	Merged
label09	target.resource.attribute.labels	Merged
label1	target.resource.attribute.labels	Merged
label2	target.resource.attribute.labels	Merged
label3	target.resource.attribute.labels	Merged
label4	target.resource.attribute.labels	Merged
label4681	target.resource.attribute.labels	Merged
label4682	target.resource.attribute.labels	Merged
label4683	target.resource.attribute.labels	Merged
label4684	target.resource.attribute.labels	Merged
label5	target.resource.attribute.labels	Merged
label6	target.resource.attribute.labels	Merged
label_SessionStateChangeTrigger_Enabled	target.resource.attribute.labels	Merged
label_SessionStateChangeTrigger_StateChange	target.resource.attribute.labels	Merged
label_for_target_resource	target.resource.attribute.labels	Merged
labels0	target.resource.attribute.labels	Merged
labels1	target.resource.attribute.labels	Merged
labels10	target.resource.attribute.labels	Merged
labels11	target.resource.attribute.labels	Merged
labels12	target.resource.attribute.labels	Merged
labels13	target.resource.attribute.labels	Merged
labels14	target.resource.attribute.labels	Merged
labels15	target.resource.attribute.labels	Merged
labels16	target.resource.attribute.labels	Merged
labels17	target.resource.attribute.labels	Merged
labels19	target.resource.attribute.labels	Merged
labels2	target.resource.attribute.labels	Merged
labels21	target.resource.attribute.labels	Merged
labels26	target.resource.attribute.labels	Merged
labels3	target.resource.attribute.labels	Merged
labels35	target.resource.attribute.labels	Merged
labels4	target.resource.attribute.labels	Merged
labels41	target.resource.attribute.labels	Merged
labels5	target.resource.attribute.labels	Merged
labels6	target.resource.attribute.labels	Merged
labels7	target.resource.attribute.labels	Merged
labels8	target.resource.attribute.labels	Merged
labels9	target.resource.attribute.labels	Merged
nas_port_label	target.resource.attribute.labels	Merged
netbios_name_label	target.resource.attribute.labels	Merged
object_id_label	target.resource.attribute.labels	Merged
object_name_label	target.resource.attribute.labels	Merged
operation_id_label	target.resource.attribute.labels	Merged
schema_name_label	target.resource.attribute.labels	Merged
target_database_principal_id_label	target.resource.attribute.labels	Merged
target_database_principal_name_label	target.resource.attribute.labels	Merged
top_level_name_label	target.resource.attribute.labels	Merged
uac_label	target.resource.attribute.labels	Merged
user_data_install_device_id_@_xmlns__label	target.resource.attribute.labels	Merged
user_data_install_device_id_driver_description_label	target.resource.attribute.labels	Merged
user_data_install_device_id_driver_provider_label	target.resource.attribute.labels	Merged
user_data_install_device_id_driver_version_label	target.resource.attribute.labels	Merged
user_data_install_device_id_install_status_label	target.resource.attribute.labels	Merged
volume_label	target.resource.attribute.labels	Merged
EventID	target.resource.attribute.permissions	Mapped: 4663, 4656, 4659 → permissions, 4908, 4964 → permissions
SourceName	target.resource.attribute.permissions	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p...
permissions	target.resource.attribute.permissions	Merged
DeviceId	target.resource.id	Renamed/mapped
ContextName	target.resource.name	Directly mapped
DestinationDRA	target.resource.name	Directly mapped
DfsNamespace	target.resource.name	Renamed/mapped
DomainPolicyChanged	target.resource.name	Renamed/mapped
ExtensionName	target.resource.name	Renamed/mapped
HiveName	target.resource.name	Renamed/mapped
SecurityPackageName	target.resource.name	Renamed/mapped
TicketOptions	target.resource.name	Directly mapped
attribute_value	target.resource.name	Renamed/mapped
target_resource_name	target.resource.name	Renamed/mapped
updateTitle	target.resource.name	Renamed/mapped
ObjectServer	target.resource.parent	Renamed/mapped
AppInstance	target.resource.product_object_id	Renamed/mapped
AuthenticationSetId	target.resource.product_object_id	Renamed/mapped
ConnectionSecurityRuleId	target.resource.product_object_id	Renamed/mapped
CryptographicSetId	target.resource.product_object_id	Renamed/mapped
DeviceId	target.resource.product_object_id	Directly mapped
ExtensionId	target.resource.product_object_id	Renamed/mapped
FilterId	target.resource.product_object_id	Renamed/mapped
IpSecSecurityAssociationId	target.resource.product_object_id	Renamed/mapped
ObjectGUID	target.resource.product_object_id	Renamed/mapped
PuaPolicyId	target.resource.product_object_id	Renamed/mapped
TargetJobId	target.resource.product_object_id	Renamed/mapped
TemplateOID	target.resource.product_object_id	Renamed/mapped
target_resource_product_object_id	target.resource.product_object_id	Renamed/mapped
updateGuid	target.resource.product_object_id	Renamed/mapped
val_instance_id	target.resource.product_object_id	Directly mapped
KeyType	target.resource.resource_subtype	Renamed/mapped
ObjectType	target.resource.resource_subtype	Directly mapped
TicketEncryptionType	target.resource.resource_subtype	Directly mapped
resource_subtype	target.resource.resource_subtype	Renamed/mapped
EventID	target.resource.resource_type	Mapped: 4908, 4964 → SETTING, 4908, 4964 → TASK
SourceName	target.resource.resource_type	Mapped values (6 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu... )
resource_type	target.resource.resource_type	Renamed/mapped
EventID	target.resource.type	Mapped: 4908, 4964 → DATABASE
SourceName	target.resource.type	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `D...
SourceName	target.resource_ancestors	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `r...
resource_ancestors	target.resource_ancestors	Merged
SubscriptionManagerAddress	target.url	Renamed/mapped
target_url	target.url	Renamed/mapped
fileLength	target.url_metadata.last_http_response_content_length	Renamed/mapped
EventID	target.user.attribute.labels	Mapped: 4908, 4964 → label_for_target_user, 4908, 4964 → user_label1
MembershipExpirationTime_label	target.user.attribute.labels	Merged
SourceName	target.user.attribute.labels	Mapped values (7 total, e.g., `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu... )
TargetOutboundDomainName_label	target.user.attribute.labels	Merged
label_for_target_user	target.user.attribute.labels	Merged
target_group_membership_name_label	target.user.attribute.labels	Merged
target_user_sid_name_label	target.user.attribute.labels	Merged
user_att	target.user.attribute.labels	Merged
user_label1	target.user.attribute.labels	Merged
EventID	target.user.attribute.permissions	Mapped: ` 4656, 4704, 4672, 4731, 4720, 4723, 4726, 4728, 4729, 4730, 4732, 4733, 4734, 47...
SourceName	target.user.attribute.permissions	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a...
access_granted	target.user.attribute.permissions	Merged
access_removed_list	target.user.attribute.permissions	Merged
privilege_list	target.user.attribute.permissions	Merged
EventID	target.user.group_identifiers	Mapped: 4908, 4964 → new_sid
SourceName	target.user.group_identifiers	Mapped: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `i...
input_sid	target.user.group_identifiers	Merged
new_sid	target.user.group_identifiers	Merged
DisplayName	target.user.user_display_name	Renamed/mapped
FullName	target.user.user_display_name	Directly mapped
target_user_display_name	target.user.user_display_name	Renamed/mapped
DetectionUser	target.user.userid	Directly mapped
NewTargetUserName	target.user.userid	Renamed/mapped
UserName	target.user.userid	Directly mapped
subject_user_name	target.user.userid	Renamed/mapped
target_user_id	target.user.userid	Renamed/mapped
subject_user_sid	target.user.windows_sid	Directly mapped
target_user_windows_sid	target.user.windows_sid	Renamed/mapped
N/A	metadata.event_type	Constant: STATUS_UPDATE
N/A	metadata.product_name	Constant: Microsoft-Windows-Security-Auditing
N/A	metadata.vendor_name	Constant: Microsoft
N/A	principal.asset.platform_software.platform	Constant: WINDOWS
N/A	target.resource.resource_type	Constant: BACKEND_SERVICE
N/A	target.resource.type	Constant: DATABASE

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.