Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Channel EventSourceName Event ID

`EventData`

Submit an example

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 5136

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="OpCorrelationID">VALUE_1</ns0:Data>
  <ns0:Data Name="AppCorrelationID">VALUE_2</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_3</ns0:Data>
  <ns0:Data Name="DSName">VALUE_4</ns0:Data>
  <ns0:Data Name="DSType">VALUE_5</ns0:Data>
  <ns0:Data Name="ObjectDN">VALUE_6</ns0:Data>
  <ns0:Data Name="ObjectGUID">VALUE_7</ns0:Data>
  <ns0:Data Name="ObjectClass">VALUE_8</ns0:Data>
  <ns0:Data Name="AttributeLDAPDisplayName">USERNAME_3</ns0:Data>
  <ns0:Data Name="AttributeSyntaxOID">VALUE_9</ns0:Data>
  <ns0:Data Name="AttributeValue">VALUE_10</ns0:Data>
  <ns0:Data Name="OperationType">VALUE_11</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AppCorrelationID]`	element
`/EventData/Data[@Name=AppCorrelationID]/@Name`	string
`/EventData/Data[@Name=AppCorrelationID]/text()`	string
`/EventData/Data[@Name=AttributeLDAPDisplayName]`	element
`/EventData/Data[@Name=AttributeLDAPDisplayName]/@Name`	string
`/EventData/Data[@Name=AttributeLDAPDisplayName]/text()`	string
`/EventData/Data[@Name=AttributeSyntaxOID]`	element
`/EventData/Data[@Name=AttributeSyntaxOID]/@Name`	string
`/EventData/Data[@Name=AttributeSyntaxOID]/text()`	string
`/EventData/Data[@Name=AttributeValue]`	element
`/EventData/Data[@Name=AttributeValue]/@Name`	string
`/EventData/Data[@Name=AttributeValue]/text()`	string
`/EventData/Data[@Name=DSName]`	element
`/EventData/Data[@Name=DSName]/@Name`	string
`/EventData/Data[@Name=DSName]/text()`	string
`/EventData/Data[@Name=DSType]`	element
`/EventData/Data[@Name=DSType]/@Name`	string
`/EventData/Data[@Name=DSType]/text()`	string
`/EventData/Data[@Name=ObjectClass]`	element
`/EventData/Data[@Name=ObjectClass]/@Name`	string
`/EventData/Data[@Name=ObjectClass]/text()`	string
`/EventData/Data[@Name=ObjectDN]`	element
`/EventData/Data[@Name=ObjectDN]/@Name`	string
`/EventData/Data[@Name=ObjectDN]/text()`	string
`/EventData/Data[@Name=ObjectGUID]`	element
`/EventData/Data[@Name=ObjectGUID]/@Name`	string
`/EventData/Data[@Name=ObjectGUID]/text()`	string
`/EventData/Data[@Name=OpCorrelationID]`	element
`/EventData/Data[@Name=OpCorrelationID]/@Name`	string
`/EventData/Data[@Name=OpCorrelationID]/text()`	string
`/EventData/Data[@Name=OperationType]`	element
`/EventData/Data[@Name=OperationType]/@Name`	string
`/EventData/Data[@Name=OperationType]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4702

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContentNew">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:Source&gt;USERNAME_1@example.invalid&lt;/ns0:Source&gt;
    &lt;ns0:Author&gt;USERNAME_2@example.invalid&lt;/ns0:Author&gt;
    &lt;ns0:Description&gt;USERNAME_3@example.invalid&lt;/ns0:Description&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
    &lt;ns0:SecurityDescriptor&gt;VALUE_4&lt;/ns0:SecurityDescriptor&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:TimeTrigger&gt;
      &lt;ns0:Repetition&gt;
        &lt;ns0:Interval&gt;VALUE_5&lt;/ns0:Interval&gt;
        &lt;ns0:StopAtDurationEnd&gt;false&lt;/ns0:StopAtDurationEnd&gt;
      &lt;/ns0:Repetition&gt;
      &lt;ns0:StartBoundary&gt;VALUE_6&lt;/ns0:StartBoundary&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:RandomDelay&gt;VALUE_7&lt;/ns0:RandomDelay&gt;
    &lt;/ns0:TimeTrigger&gt;
    &lt;ns0:WnfStateChangeTrigger&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:StateName&gt;VALUE_8&lt;/ns0:StateName&gt;
    &lt;/ns0:WnfStateChangeTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_9"&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
      &lt;ns0:RunLevel&gt;VALUE_10&lt;/ns0:RunLevel&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_11&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:DisallowStartOnRemoteAppSession&gt;false&lt;/ns0:DisallowStartOnRemoteAppSession&gt;
    &lt;ns0:UseUnifiedSchedulingEngine&gt;false&lt;/ns0:UseUnifiedSchedulingEngine&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_9"&gt;
    &lt;ns0:ComHandler&gt;
      &lt;ns0:ClassId&gt;S-1-5-21-100-200-300-1001&lt;/ns0:ClassId&gt;
    &lt;/ns0:ComHandler&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_12</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContentNew]`	element
`/EventData/Data[@Name=TaskContentNew]/@Name`	string
`/EventData/Data[@Name=TaskContentNew]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContentNew]/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler/ClassId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler/ClassId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Author`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Author/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Description`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Description/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Source`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Source/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/Interval`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/Interval/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/StateName`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/StateName/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4776

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="PackageName">VALUE_1</ns0:Data>
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="Workstation">VALUE_2</ns0:Data>
  <ns0:Data Name="Status">VALUE_3</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=PackageName]`	element
`/EventData/Data[@Name=PackageName]/@Name`	string
`/EventData/Data[@Name=PackageName]/text()`	string
`/EventData/Data[@Name=Status]`	element
`/EventData/Data[@Name=Status]/@Name`	string
`/EventData/Data[@Name=Status]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string
`/EventData/Data[@Name=Workstation]`	element
`/EventData/Data[@Name=Workstation]/@Name`	string
`/EventData/Data[@Name=Workstation]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 5058

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ClientCreationTime">2026-01-01T00:00:00Z</ns0:Data>
  <ns0:Data Name="ProviderName">VALUE_2</ns0:Data>
  <ns0:Data Name="AlgorithmName">VALUE_3</ns0:Data>
  <ns0:Data Name="KeyName">VALUE_4</ns0:Data>
  <ns0:Data Name="KeyType">VALUE_5</ns0:Data>
  <ns0:Data Name="KeyFilePath">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="Operation">VALUE_6</ns0:Data>
  <ns0:Data Name="ReturnCode">VALUE_7</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AlgorithmName]`	element
`/EventData/Data[@Name=AlgorithmName]/@Name`	string
`/EventData/Data[@Name=AlgorithmName]/text()`	string
`/EventData/Data[@Name=ClientCreationTime]`	element
`/EventData/Data[@Name=ClientCreationTime]/@Name`	string
`/EventData/Data[@Name=ClientCreationTime]/text()`	string
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=KeyFilePath]`	element
`/EventData/Data[@Name=KeyFilePath]/@Name`	string
`/EventData/Data[@Name=KeyFilePath]/text()`	string
`/EventData/Data[@Name=KeyName]`	element
`/EventData/Data[@Name=KeyName]/@Name`	string
`/EventData/Data[@Name=KeyName]/text()`	string
`/EventData/Data[@Name=KeyType]`	element
`/EventData/Data[@Name=KeyType]/@Name`	string
`/EventData/Data[@Name=KeyType]/text()`	string
`/EventData/Data[@Name=Operation]`	element
`/EventData/Data[@Name=Operation]/@Name`	string
`/EventData/Data[@Name=Operation]/text()`	string
`/EventData/Data[@Name=ProviderName]`	element
`/EventData/Data[@Name=ProviderName]/@Name`	string
`/EventData/Data[@Name=ProviderName]/text()`	string
`/EventData/Data[@Name=ReturnCode]`	element
`/EventData/Data[@Name=ReturnCode]/@Name`	string
`/EventData/Data[@Name=ReturnCode]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4701

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContent">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:Version&gt;1.5&lt;/ns0:Version&gt;
    &lt;ns0:SecurityDescriptor&gt;VALUE_4&lt;/ns0:SecurityDescriptor&gt;
    &lt;ns0:Source&gt;USERNAME_1@example.invalid&lt;/ns0:Source&gt;
    &lt;ns0:Author&gt;USERNAME_1@example.invalid&lt;/ns0:Author&gt;
    &lt;ns0:Description&gt;USERNAME_2@example.invalid&lt;/ns0:Description&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_5"&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_6&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:RestartOnFailure&gt;
      &lt;ns0:Count&gt;1&lt;/ns0:Count&gt;
      &lt;ns0:Interval&gt;VALUE_7&lt;/ns0:Interval&gt;
    &lt;/ns0:RestartOnFailure&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:UseUnifiedSchedulingEngine&gt;false&lt;/ns0:UseUnifiedSchedulingEngine&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:CalendarTrigger&gt;
      &lt;ns0:StartBoundary&gt;VALUE_8&lt;/ns0:StartBoundary&gt;
      &lt;ns0:ScheduleByDay&gt;
        &lt;ns0:DaysInterval&gt;1&lt;/ns0:DaysInterval&gt;
      &lt;/ns0:ScheduleByDay&gt;
    &lt;/ns0:CalendarTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Actions Context="VALUE_5"&gt;
    &lt;ns0:ComHandler&gt;
      &lt;ns0:ClassId&gt;S-1-5-21-100-200-300-1001&lt;/ns0:ClassId&gt;
      &lt;ns0:Data&gt;VALUE_9&lt;/ns0:Data&gt;
    &lt;/ns0:ComHandler&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_10</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContent]`	element
`/EventData/Data[@Name=TaskContent]/@Name`	string
`/EventData/Data[@Name=TaskContent]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContent]/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/ComHandler`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/ComHandler/ClassId`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/ComHandler/ClassId/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/ComHandler/Data`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/ComHandler/Data/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Author`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Author/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Description`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Description/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Source`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Source/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Version`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Version/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Version/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Version/text()::<json>`	number
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RestartOnFailure`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RestartOnFailure/Count`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RestartOnFailure/Count/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RestartOnFailure/Count/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RestartOnFailure/Count/text()::<json>`	integer
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RestartOnFailure/Interval`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RestartOnFailure/Interval/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()::<json>`	integer
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 5140

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectType">VALUE_2</ns0:Data>
  <ns0:Data Name="IpAddress">192.0.2.1</ns0:Data>
  <ns0:Data Name="IpPort">1</ns0:Data>
  <ns0:Data Name="ShareName">VALUE_3</ns0:Data>
  <ns0:Data Name="ShareLocalPath" />
  <ns0:Data Name="AccessMask">VALUE_4</ns0:Data>
  <ns0:Data Name="AccessList">VALUE_5</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccessList]`	element
`/EventData/Data[@Name=AccessList]/@Name`	string
`/EventData/Data[@Name=AccessList]/text()`	string
`/EventData/Data[@Name=AccessMask]`	element
`/EventData/Data[@Name=AccessMask]/@Name`	string
`/EventData/Data[@Name=AccessMask]/text()`	string
`/EventData/Data[@Name=IpAddress]`	element
`/EventData/Data[@Name=IpAddress]/@Name`	string
`/EventData/Data[@Name=IpAddress]/text()`	string
`/EventData/Data[@Name=IpPort]`	element
`/EventData/Data[@Name=IpPort]/@Name`	string
`/EventData/Data[@Name=IpPort]/text()`	encoded-json
`/EventData/Data[@Name=IpPort]/text()`	string
`/EventData/Data[@Name=IpPort]/text()::<json>`	integer
`/EventData/Data[@Name=ObjectType]`	element
`/EventData/Data[@Name=ObjectType]/@Name`	string
`/EventData/Data[@Name=ObjectType]/text()`	string
`/EventData/Data[@Name=ShareLocalPath]`	element
`/EventData/Data[@Name=ShareLocalPath]/@Name`	string
`/EventData/Data[@Name=ShareName]`	element
`/EventData/Data[@Name=ShareName]/@Name`	string
`/EventData/Data[@Name=ShareName]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4702

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContentNew">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
    &lt;ns0:SecurityDescriptor&gt;VALUE_4&lt;/ns0:SecurityDescriptor&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:TimeTrigger&gt;
      &lt;ns0:Repetition&gt;
        &lt;ns0:Interval&gt;VALUE_5&lt;/ns0:Interval&gt;
        &lt;ns0:StopAtDurationEnd&gt;false&lt;/ns0:StopAtDurationEnd&gt;
      &lt;/ns0:Repetition&gt;
      &lt;ns0:StartBoundary&gt;VALUE_6&lt;/ns0:StartBoundary&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:RandomDelay&gt;VALUE_7&lt;/ns0:RandomDelay&gt;
    &lt;/ns0:TimeTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_8"&gt;
      &lt;ns0:RunLevel&gt;VALUE_9&lt;/ns0:RunLevel&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_10&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:Duration&gt;VALUE_11&lt;/ns0:Duration&gt;
      &lt;ns0:WaitTimeout&gt;2026-01-01T00:00:00Z&lt;/ns0:WaitTimeout&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_8"&gt;
    &lt;ns0:Exec&gt;
      &lt;ns0:Command&gt;echo SAMPLE_1&lt;/ns0:Command&gt;
      &lt;ns0:Arguments&gt;VALUE_12&lt;/ns0:Arguments&gt;
    &lt;/ns0:Exec&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_13</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContentNew]`	element
`/EventData/Data[@Name=TaskContentNew]/@Name`	string
`/EventData/Data[@Name=TaskContentNew]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContentNew]/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/Interval`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/Interval/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4702

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContentNew">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:Source&gt;USERNAME_1@example.invalid&lt;/ns0:Source&gt;
    &lt;ns0:Author&gt;USERNAME_1@example.invalid&lt;/ns0:Author&gt;
    &lt;ns0:Version&gt;1.5&lt;/ns0:Version&gt;
    &lt;ns0:Description&gt;USERNAME_2@example.invalid&lt;/ns0:Description&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
    &lt;ns0:SecurityDescriptor&gt;VALUE_4&lt;/ns0:SecurityDescriptor&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:CalendarTrigger&gt;
      &lt;ns0:StartBoundary&gt;VALUE_5&lt;/ns0:StartBoundary&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:ScheduleByDay&gt;
        &lt;ns0:DaysInterval&gt;1&lt;/ns0:DaysInterval&gt;
      &lt;/ns0:ScheduleByDay&gt;
    &lt;/ns0:CalendarTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_6"&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
      &lt;ns0:RunLevel&gt;VALUE_7&lt;/ns0:RunLevel&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_8&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:DisallowStartOnRemoteAppSession&gt;false&lt;/ns0:DisallowStartOnRemoteAppSession&gt;
    &lt;ns0:UseUnifiedSchedulingEngine&gt;false&lt;/ns0:UseUnifiedSchedulingEngine&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
    &lt;ns0:RestartOnFailure&gt;
      &lt;ns0:Interval&gt;VALUE_9&lt;/ns0:Interval&gt;
      &lt;ns0:Count&gt;1&lt;/ns0:Count&gt;
    &lt;/ns0:RestartOnFailure&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_6"&gt;
    &lt;ns0:ComHandler&gt;
      &lt;ns0:ClassId&gt;S-1-5-21-100-200-300-1001&lt;/ns0:ClassId&gt;
      &lt;ns0:Data&gt;VALUE_10&lt;/ns0:Data&gt;
    &lt;/ns0:ComHandler&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_11</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContentNew]`	element
`/EventData/Data[@Name=TaskContentNew]/@Name`	string
`/EventData/Data[@Name=TaskContentNew]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContentNew]/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler/ClassId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler/ClassId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler/Data`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/ComHandler/Data/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Author`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Author/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Description`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Description/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Source`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Source/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Version`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Version/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Version/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Version/text()::<json>`	number
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RestartOnFailure`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RestartOnFailure/Count`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RestartOnFailure/Count/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RestartOnFailure/Count/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RestartOnFailure/Count/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RestartOnFailure/Interval`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RestartOnFailure/Interval/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/CalendarTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4948

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="ProfileChanged">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="RuleId">VALUE_1</ns0:Data>
  <ns0:Data Name="RuleName">VALUE_2</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ProfileChanged]`	element
`/EventData/Data[@Name=ProfileChanged]/@Name`	string
`/EventData/Data[@Name=ProfileChanged]/text()`	string
`/EventData/Data[@Name=RuleId]`	element
`/EventData/Data[@Name=RuleId]/@Name`	string
`/EventData/Data[@Name=RuleId]/text()`	string
`/EventData/Data[@Name=RuleName]`	element
`/EventData/Data[@Name=RuleName]/@Name`	string
`/EventData/Data[@Name=RuleName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 5140

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectType">VALUE_2</ns0:Data>
  <ns0:Data Name="IpAddress">192.0.2.1</ns0:Data>
  <ns0:Data Name="IpPort">1</ns0:Data>
  <ns0:Data Name="ShareName">VALUE_3</ns0:Data>
  <ns0:Data Name="ShareLocalPath">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="AccessMask">VALUE_4</ns0:Data>
  <ns0:Data Name="AccessList">VALUE_5</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccessList]`	element
`/EventData/Data[@Name=AccessList]/@Name`	string
`/EventData/Data[@Name=AccessList]/text()`	string
`/EventData/Data[@Name=AccessMask]`	element
`/EventData/Data[@Name=AccessMask]/@Name`	string
`/EventData/Data[@Name=AccessMask]/text()`	string
`/EventData/Data[@Name=IpAddress]`	element
`/EventData/Data[@Name=IpAddress]/@Name`	string
`/EventData/Data[@Name=IpAddress]/text()`	string
`/EventData/Data[@Name=IpPort]`	element
`/EventData/Data[@Name=IpPort]/@Name`	string
`/EventData/Data[@Name=IpPort]/text()`	encoded-json
`/EventData/Data[@Name=IpPort]/text()`	string
`/EventData/Data[@Name=IpPort]/text()::<json>`	integer
`/EventData/Data[@Name=ObjectType]`	element
`/EventData/Data[@Name=ObjectType]/@Name`	string
`/EventData/Data[@Name=ObjectType]/text()`	string
`/EventData/Data[@Name=ShareLocalPath]`	element
`/EventData/Data[@Name=ShareLocalPath]/@Name`	string
`/EventData/Data[@Name=ShareLocalPath]/text()`	string
`/EventData/Data[@Name=ShareName]`	element
`/EventData/Data[@Name=ShareName]/@Name`	string
`/EventData/Data[@Name=ShareName]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4724

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_3</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4799

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_3</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="CallerProcessId">S-1-5-21-100-200-300-1002</ns0:Data>
  <ns0:Data Name="CallerProcessName">VALUE_2</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=CallerProcessId]`	element
`/EventData/Data[@Name=CallerProcessId]/@Name`	string
`/EventData/Data[@Name=CallerProcessId]/text()`	string
`/EventData/Data[@Name=CallerProcessName]`	element
`/EventData/Data[@Name=CallerProcessName]/@Name`	string
`/EventData/Data[@Name=CallerProcessName]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4702

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContentNew">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
    &lt;ns0:SecurityDescriptor&gt;VALUE_4&lt;/ns0:SecurityDescriptor&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:LogonTrigger&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:Delay&gt;VALUE_5&lt;/ns0:Delay&gt;
    &lt;/ns0:LogonTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_6&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:Duration&gt;VALUE_7&lt;/ns0:Duration&gt;
      &lt;ns0:WaitTimeout&gt;2026-01-01T00:00:00Z&lt;/ns0:WaitTimeout&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_8"&gt;
    &lt;ns0:Exec&gt;
      &lt;ns0:Command&gt;echo SAMPLE_1&lt;/ns0:Command&gt;
      &lt;ns0:Arguments&gt;VALUE_9&lt;/ns0:Arguments&gt;
    &lt;/ns0:Exec&gt;
  &lt;/ns0:Actions&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_8"&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
      &lt;ns0:RunLevel&gt;VALUE_10&lt;/ns0:RunLevel&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_11</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContentNew]`	element
`/EventData/Data[@Name=TaskContentNew]/@Name`	string
`/EventData/Data[@Name=TaskContentNew]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContentNew]/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/LogonTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/LogonTrigger/Delay`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/LogonTrigger/Delay/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/LogonTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/LogonTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/LogonTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/LogonTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 5379

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TargetName">VALUE_2</ns0:Data>
  <ns0:Data Name="Type">1</ns0:Data>
  <ns0:Data Name="CountOfCredentialsReturned">1</ns0:Data>
  <ns0:Data Name="ReadOperation">VALUE_3</ns0:Data>
  <ns0:Data Name="ReturnCode">1</ns0:Data>
  <ns0:Data Name="ProcessCreationTime">2026-01-01T00:00:00Z</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=CountOfCredentialsReturned]`	element
`/EventData/Data[@Name=CountOfCredentialsReturned]/@Name`	string
`/EventData/Data[@Name=CountOfCredentialsReturned]/text()`	encoded-json
`/EventData/Data[@Name=CountOfCredentialsReturned]/text()`	string
`/EventData/Data[@Name=CountOfCredentialsReturned]/text()::<json>`	integer
`/EventData/Data[@Name=ProcessCreationTime]`	element
`/EventData/Data[@Name=ProcessCreationTime]/@Name`	string
`/EventData/Data[@Name=ProcessCreationTime]/text()`	string
`/EventData/Data[@Name=ReadOperation]`	element
`/EventData/Data[@Name=ReadOperation]/@Name`	string
`/EventData/Data[@Name=ReadOperation]/text()`	string
`/EventData/Data[@Name=ReturnCode]`	element
`/EventData/Data[@Name=ReturnCode]/@Name`	string
`/EventData/Data[@Name=ReturnCode]/text()`	encoded-json
`/EventData/Data[@Name=ReturnCode]/text()`	string
`/EventData/Data[@Name=ReturnCode]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetName]`	element
`/EventData/Data[@Name=TargetName]/@Name`	string
`/EventData/Data[@Name=TargetName]/text()`	string
`/EventData/Data[@Name=Type]`	element
`/EventData/Data[@Name=Type]/@Name`	string
`/EventData/Data[@Name=Type]/text()`	encoded-json
`/EventData/Data[@Name=Type]/text()`	string
`/EventData/Data[@Name=Type]/text()::<json>`	integer

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4771

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ServiceName">VALUE_1</ns0:Data>
  <ns0:Data Name="TicketOptions">VALUE_2</ns0:Data>
  <ns0:Data Name="Status">VALUE_3</ns0:Data>
  <ns0:Data Name="PreAuthType">1</ns0:Data>
  <ns0:Data Name="IpAddress">192.0.2.1</ns0:Data>
  <ns0:Data Name="IpPort">1</ns0:Data>
  <ns0:Data Name="CertIssuerName" />
  <ns0:Data Name="CertSerialNumber" />
  <ns0:Data Name="CertThumbprint" />
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=CertIssuerName]`	element
`/EventData/Data[@Name=CertIssuerName]/@Name`	string
`/EventData/Data[@Name=CertSerialNumber]`	element
`/EventData/Data[@Name=CertSerialNumber]/@Name`	string
`/EventData/Data[@Name=CertThumbprint]`	element
`/EventData/Data[@Name=CertThumbprint]/@Name`	string
`/EventData/Data[@Name=IpAddress]`	element
`/EventData/Data[@Name=IpAddress]/@Name`	string
`/EventData/Data[@Name=IpAddress]/text()`	string
`/EventData/Data[@Name=IpPort]`	element
`/EventData/Data[@Name=IpPort]/@Name`	string
`/EventData/Data[@Name=IpPort]/text()`	encoded-json
`/EventData/Data[@Name=IpPort]/text()`	string
`/EventData/Data[@Name=IpPort]/text()::<json>`	integer
`/EventData/Data[@Name=PreAuthType]`	element
`/EventData/Data[@Name=PreAuthType]/@Name`	string
`/EventData/Data[@Name=PreAuthType]/text()`	encoded-json
`/EventData/Data[@Name=PreAuthType]/text()`	string
`/EventData/Data[@Name=PreAuthType]/text()::<json>`	integer
`/EventData/Data[@Name=ServiceName]`	element
`/EventData/Data[@Name=ServiceName]/@Name`	string
`/EventData/Data[@Name=ServiceName]/text()`	string
`/EventData/Data[@Name=Status]`	element
`/EventData/Data[@Name=Status]/@Name`	string
`/EventData/Data[@Name=Status]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string
`/EventData/Data[@Name=TicketOptions]`	element
`/EventData/Data[@Name=TicketOptions]/@Name`	string
`/EventData/Data[@Name=TicketOptions]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4798

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_3</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="CallerProcessId">S-1-5-21-100-200-300-1002</ns0:Data>
  <ns0:Data Name="CallerProcessName">VALUE_2</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=CallerProcessId]`	element
`/EventData/Data[@Name=CallerProcessId]/@Name`	string
`/EventData/Data[@Name=CallerProcessId]/text()`	string
`/EventData/Data[@Name=CallerProcessName]`	element
`/EventData/Data[@Name=CallerProcessName]/@Name`	string
`/EventData/Data[@Name=CallerProcessName]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4770

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1@example.invalid</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="ServiceName">VALUE_1</ns0:Data>
  <ns0:Data Name="ServiceSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="TicketOptions">VALUE_2</ns0:Data>
  <ns0:Data Name="TicketEncryptionType">VALUE_3</ns0:Data>
  <ns0:Data Name="IpAddress">192.0.2.1</ns0:Data>
  <ns0:Data Name="IpPort">1</ns0:Data>
  <ns0:Data Name="RequestTicketHash">0000000000000000000000000000000000000000000000000000000000000001</ns0:Data>
  <ns0:Data Name="ResponseTicketHash">0000000000000000000000000000000000000000000000000000000000000002</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=IpAddress]`	element
`/EventData/Data[@Name=IpAddress]/@Name`	string
`/EventData/Data[@Name=IpAddress]/text()`	string
`/EventData/Data[@Name=IpPort]`	element
`/EventData/Data[@Name=IpPort]/@Name`	string
`/EventData/Data[@Name=IpPort]/text()`	encoded-json
`/EventData/Data[@Name=IpPort]/text()`	string
`/EventData/Data[@Name=IpPort]/text()::<json>`	integer
`/EventData/Data[@Name=RequestTicketHash]`	element
`/EventData/Data[@Name=RequestTicketHash]/@Name`	string
`/EventData/Data[@Name=RequestTicketHash]/text()`	string
`/EventData/Data[@Name=ResponseTicketHash]`	element
`/EventData/Data[@Name=ResponseTicketHash]/@Name`	string
`/EventData/Data[@Name=ResponseTicketHash]/text()`	string
`/EventData/Data[@Name=ServiceName]`	element
`/EventData/Data[@Name=ServiceName]/@Name`	string
`/EventData/Data[@Name=ServiceName]/text()`	string
`/EventData/Data[@Name=ServiceSid]`	element
`/EventData/Data[@Name=ServiceSid]/@Name`	string
`/EventData/Data[@Name=ServiceSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string
`/EventData/Data[@Name=TicketEncryptionType]`	element
`/EventData/Data[@Name=TicketEncryptionType]/@Name`	string
`/EventData/Data[@Name=TicketEncryptionType]/text()`	string
`/EventData/Data[@Name=TicketOptions]`	element
`/EventData/Data[@Name=TicketOptions]/@Name`	string
`/EventData/Data[@Name=TicketOptions]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4670

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectServer">VALUE_2</ns0:Data>
  <ns0:Data Name="ObjectType">VALUE_3</ns0:Data>
  <ns0:Data Name="ObjectName">VALUE_4</ns0:Data>
  <ns0:Data Name="HandleId">VALUE_5</ns0:Data>
  <ns0:Data Name="OldSd">VALUE_6</ns0:Data>
  <ns0:Data Name="NewSd">VALUE_7</ns0:Data>
  <ns0:Data Name="ProcessId">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ProcessName">VALUE_8</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=HandleId]`	element
`/EventData/Data[@Name=HandleId]/@Name`	string
`/EventData/Data[@Name=HandleId]/text()`	string
`/EventData/Data[@Name=NewSd]`	element
`/EventData/Data[@Name=NewSd]/@Name`	string
`/EventData/Data[@Name=NewSd]/text()`	string
`/EventData/Data[@Name=ObjectName]`	element
`/EventData/Data[@Name=ObjectName]/@Name`	string
`/EventData/Data[@Name=ObjectName]/text()`	string
`/EventData/Data[@Name=ObjectServer]`	element
`/EventData/Data[@Name=ObjectServer]/@Name`	string
`/EventData/Data[@Name=ObjectServer]/text()`	string
`/EventData/Data[@Name=ObjectType]`	element
`/EventData/Data[@Name=ObjectType]/@Name`	string
`/EventData/Data[@Name=ObjectType]/text()`	string
`/EventData/Data[@Name=OldSd]`	element
`/EventData/Data[@Name=OldSd]/@Name`	string
`/EventData/Data[@Name=OldSd]/text()`	string
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=ProcessName]`	element
`/EventData/Data[@Name=ProcessName]/@Name`	string
`/EventData/Data[@Name=ProcessName]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4723

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="PrivilegeList">VALUE_2</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=PrivilegeList]`	element
`/EventData/Data[@Name=PrivilegeList]/@Name`	string
`/EventData/Data[@Name=PrivilegeList]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4699

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContent" />
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_3</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContent]`	element
`/EventData/Data[@Name=TaskContent]/@Name`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4754

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_3</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="PrivilegeList">VALUE_2</ns0:Data>
  <ns0:Data Name="SamAccountName">USERNAME_1</ns0:Data>
  <ns0:Data Name="SidHistory">S-1-5-21-100-200-300-1002</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=PrivilegeList]`	element
`/EventData/Data[@Name=PrivilegeList]/@Name`	string
`/EventData/Data[@Name=PrivilegeList]/text()`	string
`/EventData/Data[@Name=SamAccountName]`	element
`/EventData/Data[@Name=SamAccountName]/@Name`	string
`/EventData/Data[@Name=SamAccountName]/text()`	string
`/EventData/Data[@Name=SidHistory]`	element
`/EventData/Data[@Name=SidHistory]/@Name`	string
`/EventData/Data[@Name=SidHistory]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4702

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContentNew">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:TimeTrigger&gt;
      &lt;ns0:Repetition&gt;
        &lt;ns0:Interval&gt;VALUE_4&lt;/ns0:Interval&gt;
        &lt;ns0:StopAtDurationEnd&gt;false&lt;/ns0:StopAtDurationEnd&gt;
      &lt;/ns0:Repetition&gt;
      &lt;ns0:StartBoundary&gt;VALUE_5&lt;/ns0:StartBoundary&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:RandomDelay&gt;VALUE_6&lt;/ns0:RandomDelay&gt;
    &lt;/ns0:TimeTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_7"&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
      &lt;ns0:RunLevel&gt;VALUE_8&lt;/ns0:RunLevel&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_9&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:Duration&gt;VALUE_10&lt;/ns0:Duration&gt;
      &lt;ns0:WaitTimeout&gt;2026-01-01T00:00:00Z&lt;/ns0:WaitTimeout&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_7"&gt;
    &lt;ns0:Exec&gt;
      &lt;ns0:Command&gt;echo SAMPLE_1&lt;/ns0:Command&gt;
      &lt;ns0:Arguments&gt;VALUE_11&lt;/ns0:Arguments&gt;
    &lt;/ns0:Exec&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_12</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContentNew]`	element
`/EventData/Data[@Name=TaskContentNew]/@Name`	string
`/EventData/Data[@Name=TaskContentNew]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContentNew]/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/Interval`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/Interval/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Repetition/StopAtDurationEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4768

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ServiceName">VALUE_1</ns0:Data>
  <ns0:Data Name="ServiceSid">S-1-5-21-100-200-300-1002</ns0:Data>
  <ns0:Data Name="TicketOptions">VALUE_2</ns0:Data>
  <ns0:Data Name="Status">VALUE_3</ns0:Data>
  <ns0:Data Name="TicketEncryptionType">VALUE_4</ns0:Data>
  <ns0:Data Name="PreAuthType">1</ns0:Data>
  <ns0:Data Name="IpAddress">192.0.2.1</ns0:Data>
  <ns0:Data Name="IpPort">1</ns0:Data>
  <ns0:Data Name="CertIssuerName" />
  <ns0:Data Name="CertSerialNumber" />
  <ns0:Data Name="CertThumbprint" />
  <ns0:Data Name="ResponseTicket">VALUE_5</ns0:Data>
  <ns0:Data Name="AccountSupportedEncryptionTypes">VALUE_6</ns0:Data>
  <ns0:Data Name="AccountAvailableKeys">VALUE_7</ns0:Data>
  <ns0:Data Name="ServiceSupportedEncryptionTypes">VALUE_8</ns0:Data>
  <ns0:Data Name="ServiceAvailableKeys">VALUE_7</ns0:Data>
  <ns0:Data Name="DCSupportedEncryptionTypes">VALUE_8</ns0:Data>
  <ns0:Data Name="DCAvailableKeys">VALUE_7</ns0:Data>
  <ns0:Data Name="ClientAdvertizedEncryptionTypes">VALUE_9</ns0:Data>
  <ns0:Data Name="SessionKeyEncryptionType">VALUE_4</ns0:Data>
  <ns0:Data Name="PreAuthEncryptionType">VALUE_4</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccountAvailableKeys]`	element
`/EventData/Data[@Name=AccountAvailableKeys]/@Name`	string
`/EventData/Data[@Name=AccountAvailableKeys]/text()`	string
`/EventData/Data[@Name=AccountSupportedEncryptionTypes]`	element
`/EventData/Data[@Name=AccountSupportedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=AccountSupportedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=CertIssuerName]`	element
`/EventData/Data[@Name=CertIssuerName]/@Name`	string
`/EventData/Data[@Name=CertSerialNumber]`	element
`/EventData/Data[@Name=CertSerialNumber]/@Name`	string
`/EventData/Data[@Name=CertThumbprint]`	element
`/EventData/Data[@Name=CertThumbprint]/@Name`	string
`/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]`	element
`/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=DCAvailableKeys]`	element
`/EventData/Data[@Name=DCAvailableKeys]/@Name`	string
`/EventData/Data[@Name=DCAvailableKeys]/text()`	string
`/EventData/Data[@Name=DCSupportedEncryptionTypes]`	element
`/EventData/Data[@Name=DCSupportedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=DCSupportedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=IpAddress]`	element
`/EventData/Data[@Name=IpAddress]/@Name`	string
`/EventData/Data[@Name=IpAddress]/text()`	string
`/EventData/Data[@Name=IpPort]`	element
`/EventData/Data[@Name=IpPort]/@Name`	string
`/EventData/Data[@Name=IpPort]/text()`	encoded-json
`/EventData/Data[@Name=IpPort]/text()`	string
`/EventData/Data[@Name=IpPort]/text()::<json>`	integer
`/EventData/Data[@Name=PreAuthEncryptionType]`	element
`/EventData/Data[@Name=PreAuthEncryptionType]/@Name`	string
`/EventData/Data[@Name=PreAuthEncryptionType]/text()`	string
`/EventData/Data[@Name=PreAuthType]`	element
`/EventData/Data[@Name=PreAuthType]/@Name`	string
`/EventData/Data[@Name=PreAuthType]/text()`	encoded-json
`/EventData/Data[@Name=PreAuthType]/text()`	string
`/EventData/Data[@Name=PreAuthType]/text()::<json>`	integer
`/EventData/Data[@Name=ResponseTicket]`	element
`/EventData/Data[@Name=ResponseTicket]/@Name`	string
`/EventData/Data[@Name=ResponseTicket]/text()`	string
`/EventData/Data[@Name=ServiceAvailableKeys]`	element
`/EventData/Data[@Name=ServiceAvailableKeys]/@Name`	string
`/EventData/Data[@Name=ServiceAvailableKeys]/text()`	string
`/EventData/Data[@Name=ServiceName]`	element
`/EventData/Data[@Name=ServiceName]/@Name`	string
`/EventData/Data[@Name=ServiceName]/text()`	string
`/EventData/Data[@Name=ServiceSid]`	element
`/EventData/Data[@Name=ServiceSid]/@Name`	string
`/EventData/Data[@Name=ServiceSid]/text()`	string
`/EventData/Data[@Name=ServiceSupportedEncryptionTypes]`	element
`/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=SessionKeyEncryptionType]`	element
`/EventData/Data[@Name=SessionKeyEncryptionType]/@Name`	string
`/EventData/Data[@Name=SessionKeyEncryptionType]/text()`	string
`/EventData/Data[@Name=Status]`	element
`/EventData/Data[@Name=Status]/@Name`	string
`/EventData/Data[@Name=Status]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string
`/EventData/Data[@Name=TicketEncryptionType]`	element
`/EventData/Data[@Name=TicketEncryptionType]/@Name`	string
`/EventData/Data[@Name=TicketEncryptionType]/text()`	string
`/EventData/Data[@Name=TicketOptions]`	element
`/EventData/Data[@Name=TicketOptions]/@Name`	string
`/EventData/Data[@Name=TicketOptions]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4957

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="RuleId">VALUE_1</ns0:Data>
  <ns0:Data Name="RuleName">VALUE_2</ns0:Data>
  <ns0:Data Name="RuleAttr">VALUE_3</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=RuleAttr]`	element
`/EventData/Data[@Name=RuleAttr]/@Name`	string
`/EventData/Data[@Name=RuleAttr]/text()`	string
`/EventData/Data[@Name=RuleId]`	element
`/EventData/Data[@Name=RuleId]/@Name`	string
`/EventData/Data[@Name=RuleId]/text()`	string
`/EventData/Data[@Name=RuleName]`	element
`/EventData/Data[@Name=RuleName]/@Name`	string
`/EventData/Data[@Name=RuleName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4659

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectServer">VALUE_2</ns0:Data>
  <ns0:Data Name="ObjectType">VALUE_3</ns0:Data>
  <ns0:Data Name="ObjectName">VALUE_4</ns0:Data>
  <ns0:Data Name="HandleId">VALUE_5</ns0:Data>
  <ns0:Data Name="TransactionId">VALUE_6</ns0:Data>
  <ns0:Data Name="AccessList">VALUE_7</ns0:Data>
  <ns0:Data Name="AccessMask">VALUE_8</ns0:Data>
  <ns0:Data Name="PrivilegeList">VALUE_9</ns0:Data>
  <ns0:Data Name="ProcessId">S-1-5-21-100-200-300-1001</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccessList]`	element
`/EventData/Data[@Name=AccessList]/@Name`	string
`/EventData/Data[@Name=AccessList]/text()`	string
`/EventData/Data[@Name=AccessMask]`	element
`/EventData/Data[@Name=AccessMask]/@Name`	string
`/EventData/Data[@Name=AccessMask]/text()`	string
`/EventData/Data[@Name=HandleId]`	element
`/EventData/Data[@Name=HandleId]/@Name`	string
`/EventData/Data[@Name=HandleId]/text()`	string
`/EventData/Data[@Name=ObjectName]`	element
`/EventData/Data[@Name=ObjectName]/@Name`	string
`/EventData/Data[@Name=ObjectName]/text()`	string
`/EventData/Data[@Name=ObjectServer]`	element
`/EventData/Data[@Name=ObjectServer]/@Name`	string
`/EventData/Data[@Name=ObjectServer]/text()`	string
`/EventData/Data[@Name=ObjectType]`	element
`/EventData/Data[@Name=ObjectType]/@Name`	string
`/EventData/Data[@Name=ObjectType]/text()`	string
`/EventData/Data[@Name=PrivilegeList]`	element
`/EventData/Data[@Name=PrivilegeList]/@Name`	string
`/EventData/Data[@Name=PrivilegeList]/text()`	string
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TransactionId]`	element
`/EventData/Data[@Name=TransactionId]/@Name`	string
`/EventData/Data[@Name=TransactionId]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4698

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContent">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:Description&gt;VALUE_4&lt;/ns0:Description&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:CalendarTrigger&gt;
      &lt;ns0:StartBoundary&gt;VALUE_5&lt;/ns0:StartBoundary&gt;
      &lt;ns0:EndBoundary&gt;VALUE_6&lt;/ns0:EndBoundary&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:ScheduleByDay&gt;
        &lt;ns0:DaysInterval&gt;1&lt;/ns0:DaysInterval&gt;
      &lt;/ns0:ScheduleByDay&gt;
    &lt;/ns0:CalendarTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_7"&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
      &lt;ns0:RunLevel&gt;VALUE_8&lt;/ns0:RunLevel&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_9&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:Duration&gt;VALUE_10&lt;/ns0:Duration&gt;
      &lt;ns0:WaitTimeout&gt;2026-01-01T00:00:00Z&lt;/ns0:WaitTimeout&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:DisallowStartOnRemoteAppSession&gt;false&lt;/ns0:DisallowStartOnRemoteAppSession&gt;
    &lt;ns0:UseUnifiedSchedulingEngine&gt;false&lt;/ns0:UseUnifiedSchedulingEngine&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_7"&gt;
    &lt;ns0:Exec&gt;
      &lt;ns0:Command&gt;echo SAMPLE_1&lt;/ns0:Command&gt;
      &lt;ns0:Arguments&gt;VALUE_11&lt;/ns0:Arguments&gt;
    &lt;/ns0:Exec&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_12</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContent]`	element
`/EventData/Data[@Name=TaskContent]/@Name`	string
`/EventData/Data[@Name=TaskContent]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContent]/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/Exec`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/Exec/Arguments`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/Exec/Arguments/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/Exec/Command`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Actions/Exec/Command/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Description`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/Description/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/Duration`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/Duration/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/EndBoundary`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/EndBoundary/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()`	encoded-json
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()`	string
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/ScheduleByDay/DaysInterval/text()::<json>`	integer
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContent]/text()::<xml>/Task/Triggers/CalendarTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4719

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="CategoryId">VALUE_2</ns0:Data>
  <ns0:Data Name="SubcategoryId">VALUE_3</ns0:Data>
  <ns0:Data Name="SubcategoryGuid">VALUE_4</ns0:Data>
  <ns0:Data Name="AuditPolicyChanges">VALUE_5</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AuditPolicyChanges]`	element
`/EventData/Data[@Name=AuditPolicyChanges]/@Name`	string
`/EventData/Data[@Name=AuditPolicyChanges]/text()`	string
`/EventData/Data[@Name=CategoryId]`	element
`/EventData/Data[@Name=CategoryId]/@Name`	string
`/EventData/Data[@Name=CategoryId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=SubcategoryGuid]`	element
`/EventData/Data[@Name=SubcategoryGuid]/@Name`	string
`/EventData/Data[@Name=SubcategoryGuid]/text()`	string
`/EventData/Data[@Name=SubcategoryId]`	element
`/EventData/Data[@Name=SubcategoryId]/@Name`	string
`/EventData/Data[@Name=SubcategoryId]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4673

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectServer">VALUE_2</ns0:Data>
  <ns0:Data Name="Service">VALUE_3</ns0:Data>
  <ns0:Data Name="PrivilegeList">VALUE_4</ns0:Data>
  <ns0:Data Name="ProcessId">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ProcessName">VALUE_5</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ObjectServer]`	element
`/EventData/Data[@Name=ObjectServer]/@Name`	string
`/EventData/Data[@Name=ObjectServer]/text()`	string
`/EventData/Data[@Name=PrivilegeList]`	element
`/EventData/Data[@Name=PrivilegeList]/@Name`	string
`/EventData/Data[@Name=PrivilegeList]/text()`	string
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=ProcessName]`	element
`/EventData/Data[@Name=ProcessName]/@Name`	string
`/EventData/Data[@Name=ProcessName]/text()`	string
`/EventData/Data[@Name=Service]`	element
`/EventData/Data[@Name=Service]/@Name`	string
`/EventData/Data[@Name=Service]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4769

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="TargetUserName">USERNAME_1@example.invalid</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="ServiceName">VALUE_1</ns0:Data>
  <ns0:Data Name="ServiceSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="TicketOptions">VALUE_2</ns0:Data>
  <ns0:Data Name="TicketEncryptionType">VALUE_3</ns0:Data>
  <ns0:Data Name="IpAddress">192.0.2.1</ns0:Data>
  <ns0:Data Name="IpPort">1</ns0:Data>
  <ns0:Data Name="Status">VALUE_4</ns0:Data>
  <ns0:Data Name="LogonGuid">VALUE_5</ns0:Data>
  <ns0:Data Name="TransmittedServices">VALUE_6</ns0:Data>
  <ns0:Data Name="RequestTicketHash">0000000000000000000000000000000000000000000000000000000000000001</ns0:Data>
  <ns0:Data Name="ResponseTicketHash">0000000000000000000000000000000000000000000000000000000000000002</ns0:Data>
  <ns0:Data Name="AccountSupportedEncryptionTypes">VALUE_7</ns0:Data>
  <ns0:Data Name="AccountAvailableKeys">VALUE_7</ns0:Data>
  <ns0:Data Name="ServiceSupportedEncryptionTypes">VALUE_8</ns0:Data>
  <ns0:Data Name="ServiceAvailableKeys">VALUE_9</ns0:Data>
  <ns0:Data Name="DCSupportedEncryptionTypes">VALUE_8</ns0:Data>
  <ns0:Data Name="DCAvailableKeys">VALUE_9</ns0:Data>
  <ns0:Data Name="ClientAdvertizedEncryptionTypes">VALUE_10</ns0:Data>
  <ns0:Data Name="SessionKeyEncryptionType">VALUE_11</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccountAvailableKeys]`	element
`/EventData/Data[@Name=AccountAvailableKeys]/@Name`	string
`/EventData/Data[@Name=AccountAvailableKeys]/text()`	string
`/EventData/Data[@Name=AccountSupportedEncryptionTypes]`	element
`/EventData/Data[@Name=AccountSupportedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=AccountSupportedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]`	element
`/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=ClientAdvertizedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=DCAvailableKeys]`	element
`/EventData/Data[@Name=DCAvailableKeys]/@Name`	string
`/EventData/Data[@Name=DCAvailableKeys]/text()`	string
`/EventData/Data[@Name=DCSupportedEncryptionTypes]`	element
`/EventData/Data[@Name=DCSupportedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=DCSupportedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=IpAddress]`	element
`/EventData/Data[@Name=IpAddress]/@Name`	string
`/EventData/Data[@Name=IpAddress]/text()`	string
`/EventData/Data[@Name=IpPort]`	element
`/EventData/Data[@Name=IpPort]/@Name`	string
`/EventData/Data[@Name=IpPort]/text()`	encoded-json
`/EventData/Data[@Name=IpPort]/text()`	string
`/EventData/Data[@Name=IpPort]/text()::<json>`	integer
`/EventData/Data[@Name=LogonGuid]`	element
`/EventData/Data[@Name=LogonGuid]/@Name`	string
`/EventData/Data[@Name=LogonGuid]/text()`	string
`/EventData/Data[@Name=RequestTicketHash]`	element
`/EventData/Data[@Name=RequestTicketHash]/@Name`	string
`/EventData/Data[@Name=RequestTicketHash]/text()`	string
`/EventData/Data[@Name=ResponseTicketHash]`	element
`/EventData/Data[@Name=ResponseTicketHash]/@Name`	string
`/EventData/Data[@Name=ResponseTicketHash]/text()`	string
`/EventData/Data[@Name=ServiceAvailableKeys]`	element
`/EventData/Data[@Name=ServiceAvailableKeys]/@Name`	string
`/EventData/Data[@Name=ServiceAvailableKeys]/text()`	string
`/EventData/Data[@Name=ServiceName]`	element
`/EventData/Data[@Name=ServiceName]/@Name`	string
`/EventData/Data[@Name=ServiceName]/text()`	string
`/EventData/Data[@Name=ServiceSid]`	element
`/EventData/Data[@Name=ServiceSid]/@Name`	string
`/EventData/Data[@Name=ServiceSid]/text()`	string
`/EventData/Data[@Name=ServiceSupportedEncryptionTypes]`	element
`/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/@Name`	string
`/EventData/Data[@Name=ServiceSupportedEncryptionTypes]/text()`	string
`/EventData/Data[@Name=SessionKeyEncryptionType]`	element
`/EventData/Data[@Name=SessionKeyEncryptionType]/@Name`	string
`/EventData/Data[@Name=SessionKeyEncryptionType]/text()`	string
`/EventData/Data[@Name=Status]`	element
`/EventData/Data[@Name=Status]/@Name`	string
`/EventData/Data[@Name=Status]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string
`/EventData/Data[@Name=TicketEncryptionType]`	element
`/EventData/Data[@Name=TicketEncryptionType]/@Name`	string
`/EventData/Data[@Name=TicketEncryptionType]/text()`	string
`/EventData/Data[@Name=TicketOptions]`	element
`/EventData/Data[@Name=TicketOptions]/@Name`	string
`/EventData/Data[@Name=TicketOptions]/text()`	string
`/EventData/Data[@Name=TransmittedServices]`	element
`/EventData/Data[@Name=TransmittedServices]/@Name`	string
`/EventData/Data[@Name=TransmittedServices]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 5712

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">1</ns0:Data>
  <ns0:Data Name="ProcessId">1</ns0:Data>
  <ns0:Data Name="ProcessName">VALUE_1</ns0:Data>
  <ns0:Data Name="RemoteIpAddress">192.0.2.1</ns0:Data>
  <ns0:Data Name="RemotePort">1</ns0:Data>
  <ns0:Data Name="InterfaceUuid">VALUE_2</ns0:Data>
  <ns0:Data Name="ProtocolSequence">VALUE_3</ns0:Data>
  <ns0:Data Name="AuthenticationService">1</ns0:Data>
  <ns0:Data Name="AuthenticationLevel">1</ns0:Data>
  <ns0:Data Name="OpNum">1</ns0:Data>
  <ns0:Data Name="Endpoint" />
  <ns0:Data Name="RemoteHost" />
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AuthenticationLevel]`	element
`/EventData/Data[@Name=AuthenticationLevel]/@Name`	string
`/EventData/Data[@Name=AuthenticationLevel]/text()`	encoded-json
`/EventData/Data[@Name=AuthenticationLevel]/text()`	string
`/EventData/Data[@Name=AuthenticationLevel]/text()::<json>`	integer
`/EventData/Data[@Name=AuthenticationService]`	element
`/EventData/Data[@Name=AuthenticationService]/@Name`	string
`/EventData/Data[@Name=AuthenticationService]/text()`	encoded-json
`/EventData/Data[@Name=AuthenticationService]/text()`	string
`/EventData/Data[@Name=AuthenticationService]/text()::<json>`	integer
`/EventData/Data[@Name=Endpoint]`	element
`/EventData/Data[@Name=Endpoint]/@Name`	string
`/EventData/Data[@Name=InterfaceUuid]`	element
`/EventData/Data[@Name=InterfaceUuid]/@Name`	string
`/EventData/Data[@Name=InterfaceUuid]/text()`	string
`/EventData/Data[@Name=OpNum]`	element
`/EventData/Data[@Name=OpNum]/@Name`	string
`/EventData/Data[@Name=OpNum]/text()`	encoded-json
`/EventData/Data[@Name=OpNum]/text()`	string
`/EventData/Data[@Name=OpNum]/text()::<json>`	integer
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=ProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ProcessName]`	element
`/EventData/Data[@Name=ProcessName]/@Name`	string
`/EventData/Data[@Name=ProcessName]/text()`	string
`/EventData/Data[@Name=ProtocolSequence]`	element
`/EventData/Data[@Name=ProtocolSequence]/@Name`	string
`/EventData/Data[@Name=ProtocolSequence]/text()`	string
`/EventData/Data[@Name=RemoteHost]`	element
`/EventData/Data[@Name=RemoteHost]/@Name`	string
`/EventData/Data[@Name=RemoteIpAddress]`	element
`/EventData/Data[@Name=RemoteIpAddress]/@Name`	string
`/EventData/Data[@Name=RemoteIpAddress]/text()`	string
`/EventData/Data[@Name=RemotePort]`	element
`/EventData/Data[@Name=RemotePort]/@Name`	string
`/EventData/Data[@Name=RemotePort]/text()`	encoded-json
`/EventData/Data[@Name=RemotePort]/text()`	string
`/EventData/Data[@Name=RemotePort]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	encoded-json
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 5136

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="OpCorrelationID">VALUE_1</ns0:Data>
  <ns0:Data Name="AppCorrelationID">VALUE_2</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_3</ns0:Data>
  <ns0:Data Name="DSName">VALUE_4</ns0:Data>
  <ns0:Data Name="DSType">VALUE_5</ns0:Data>
  <ns0:Data Name="ObjectDN">VALUE_6</ns0:Data>
  <ns0:Data Name="ObjectGUID">VALUE_7</ns0:Data>
  <ns0:Data Name="ObjectClass">VALUE_8</ns0:Data>
  <ns0:Data Name="AttributeLDAPDisplayName">USERNAME_3</ns0:Data>
  <ns0:Data Name="AttributeSyntaxOID">VALUE_9</ns0:Data>
  <ns0:Data Name="AttributeValue">{"Domain":"COMPUTERNAME_2","Forest":"VALUE_4","HeartbeatUTC":"VALUE_10","PasswordPolicyDateUTC":"VALUE_11","ServerFQDN":"VALUE_12","Site":"VALUE_13","SoftwareVersion":"VALUE_14","TenantId":"00000000-0000-4000-8000-000000000001","TenantName":null}</ns0:Data>
  <ns0:Data Name="OperationType">VALUE_15</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AppCorrelationID]`	element
`/EventData/Data[@Name=AppCorrelationID]/@Name`	string
`/EventData/Data[@Name=AppCorrelationID]/text()`	string
`/EventData/Data[@Name=AttributeLDAPDisplayName]`	element
`/EventData/Data[@Name=AttributeLDAPDisplayName]/@Name`	string
`/EventData/Data[@Name=AttributeLDAPDisplayName]/text()`	string
`/EventData/Data[@Name=AttributeSyntaxOID]`	element
`/EventData/Data[@Name=AttributeSyntaxOID]/@Name`	string
`/EventData/Data[@Name=AttributeSyntaxOID]/text()`	string
`/EventData/Data[@Name=AttributeValue]`	element
`/EventData/Data[@Name=AttributeValue]/@Name`	string
`/EventData/Data[@Name=AttributeValue]/text()`	encoded-json
`/EventData/Data[@Name=AttributeValue]/text()`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>`	object
`/EventData/Data[@Name=AttributeValue]/text()::<json>.Domain`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.Forest`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.HeartbeatUTC`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.PasswordPolicyDateUTC`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.ServerFQDN`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.Site`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.SoftwareVersion`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.TenantId`	string
`/EventData/Data[@Name=AttributeValue]/text()::<json>.TenantName`	null
`/EventData/Data[@Name=DSName]`	element
`/EventData/Data[@Name=DSName]/@Name`	string
`/EventData/Data[@Name=DSName]/text()`	string
`/EventData/Data[@Name=DSType]`	element
`/EventData/Data[@Name=DSType]/@Name`	string
`/EventData/Data[@Name=DSType]/text()`	string
`/EventData/Data[@Name=ObjectClass]`	element
`/EventData/Data[@Name=ObjectClass]/@Name`	string
`/EventData/Data[@Name=ObjectClass]/text()`	string
`/EventData/Data[@Name=ObjectDN]`	element
`/EventData/Data[@Name=ObjectDN]/@Name`	string
`/EventData/Data[@Name=ObjectDN]/text()`	string
`/EventData/Data[@Name=ObjectGUID]`	element
`/EventData/Data[@Name=ObjectGUID]/@Name`	string
`/EventData/Data[@Name=ObjectGUID]/text()`	string
`/EventData/Data[@Name=OpCorrelationID]`	element
`/EventData/Data[@Name=OpCorrelationID]/@Name`	string
`/EventData/Data[@Name=OpCorrelationID]/text()`	string
`/EventData/Data[@Name=OperationType]`	element
`/EventData/Data[@Name=OperationType]/@Name`	string
`/EventData/Data[@Name=OperationType]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4674

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectServer">VALUE_2</ns0:Data>
  <ns0:Data Name="ObjectType">VALUE_3</ns0:Data>
  <ns0:Data Name="ObjectName">VALUE_3</ns0:Data>
  <ns0:Data Name="HandleId">VALUE_4</ns0:Data>
  <ns0:Data Name="AccessMask">1</ns0:Data>
  <ns0:Data Name="PrivilegeList">VALUE_5</ns0:Data>
  <ns0:Data Name="ProcessId">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ProcessName">VALUE_6</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccessMask]`	element
`/EventData/Data[@Name=AccessMask]/@Name`	string
`/EventData/Data[@Name=AccessMask]/text()`	encoded-json
`/EventData/Data[@Name=AccessMask]/text()`	string
`/EventData/Data[@Name=AccessMask]/text()::<json>`	integer
`/EventData/Data[@Name=HandleId]`	element
`/EventData/Data[@Name=HandleId]/@Name`	string
`/EventData/Data[@Name=HandleId]/text()`	string
`/EventData/Data[@Name=ObjectName]`	element
`/EventData/Data[@Name=ObjectName]/@Name`	string
`/EventData/Data[@Name=ObjectName]/text()`	string
`/EventData/Data[@Name=ObjectServer]`	element
`/EventData/Data[@Name=ObjectServer]/@Name`	string
`/EventData/Data[@Name=ObjectServer]/text()`	string
`/EventData/Data[@Name=ObjectType]`	element
`/EventData/Data[@Name=ObjectType]/@Name`	string
`/EventData/Data[@Name=ObjectType]/text()`	string
`/EventData/Data[@Name=PrivilegeList]`	element
`/EventData/Data[@Name=PrivilegeList]/@Name`	string
`/EventData/Data[@Name=PrivilegeList]/text()`	string
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=ProcessName]`	element
`/EventData/Data[@Name=ProcessName]/@Name`	string
`/EventData/Data[@Name=ProcessName]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4697

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ServiceName">VALUE_2</ns0:Data>
  <ns0:Data Name="ServiceFileName">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="ServiceType">VALUE_3</ns0:Data>
  <ns0:Data Name="ServiceStartType">1</ns0:Data>
  <ns0:Data Name="ServiceAccount">VALUE_4</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ServiceAccount]`	element
`/EventData/Data[@Name=ServiceAccount]/@Name`	string
`/EventData/Data[@Name=ServiceAccount]/text()`	string
`/EventData/Data[@Name=ServiceFileName]`	element
`/EventData/Data[@Name=ServiceFileName]/@Name`	string
`/EventData/Data[@Name=ServiceFileName]/text()`	string
`/EventData/Data[@Name=ServiceName]`	element
`/EventData/Data[@Name=ServiceName]/@Name`	string
`/EventData/Data[@Name=ServiceName]/text()`	string
`/EventData/Data[@Name=ServiceStartType]`	element
`/EventData/Data[@Name=ServiceStartType]/@Name`	string
`/EventData/Data[@Name=ServiceStartType]/text()`	encoded-json
`/EventData/Data[@Name=ServiceStartType]/text()`	string
`/EventData/Data[@Name=ServiceStartType]/text()::<json>`	integer
`/EventData/Data[@Name=ServiceType]`	element
`/EventData/Data[@Name=ServiceType]/@Name`	string
`/EventData/Data[@Name=ServiceType]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4702

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContentNew">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:Source&gt;VALUE_4&lt;/ns0:Source&gt;
    &lt;ns0:Author&gt;VALUE_4&lt;/ns0:Author&gt;
    &lt;ns0:Description&gt;VALUE_5&lt;/ns0:Description&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
    &lt;ns0:SecurityDescriptor&gt;VALUE_6&lt;/ns0:SecurityDescriptor&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:TimeTrigger&gt;
      &lt;ns0:StartBoundary&gt;VALUE_7&lt;/ns0:StartBoundary&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:RandomDelay&gt;VALUE_8&lt;/ns0:RandomDelay&gt;
    &lt;/ns0:TimeTrigger&gt;
    &lt;ns0:SessionStateChangeTrigger&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:StateChange&gt;VALUE_9&lt;/ns0:StateChange&gt;
    &lt;/ns0:SessionStateChangeTrigger&gt;
    &lt;ns0:SessionStateChangeTrigger&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:StateChange&gt;VALUE_10&lt;/ns0:StateChange&gt;
    &lt;/ns0:SessionStateChangeTrigger&gt;
    &lt;ns0:WnfStateChangeTrigger&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
      &lt;ns0:StateName&gt;VALUE_11&lt;/ns0:StateName&gt;
      &lt;ns0:Data&gt;VALUE_12&lt;/ns0:Data&gt;
      &lt;ns0:DataOffset&gt;1&lt;/ns0:DataOffset&gt;
    &lt;/ns0:WnfStateChangeTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_13"&gt;
      &lt;ns0:RunLevel&gt;VALUE_14&lt;/ns0:RunLevel&gt;
      &lt;ns0:UserId&gt;USERNAME_3&lt;/ns0:UserId&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_15&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:Duration&gt;VALUE_16&lt;/ns0:Duration&gt;
      &lt;ns0:WaitTimeout&gt;2026-01-01T00:00:00Z&lt;/ns0:WaitTimeout&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:DisallowStartOnRemoteAppSession&gt;false&lt;/ns0:DisallowStartOnRemoteAppSession&gt;
    &lt;ns0:UseUnifiedSchedulingEngine&gt;false&lt;/ns0:UseUnifiedSchedulingEngine&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_13"&gt;
    &lt;ns0:Exec&gt;
      &lt;ns0:Command&gt;echo SAMPLE_1&lt;/ns0:Command&gt;
      &lt;ns0:Arguments&gt;VALUE_17&lt;/ns0:Arguments&gt;
    &lt;/ns0:Exec&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_18</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContentNew]`	element
`/EventData/Data[@Name=TaskContentNew]/@Name`	string
`/EventData/Data[@Name=TaskContentNew]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContentNew]/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Author`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Author/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Description`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Description/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Source`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/Source/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartOnRemoteAppSession/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/UseUnifiedSchedulingEngine/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/SessionStateChangeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/SessionStateChangeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/SessionStateChangeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/SessionStateChangeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/SessionStateChangeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/SessionStateChangeTrigger/StateChange`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/SessionStateChangeTrigger/StateChange/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/RandomDelay/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Data`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Data/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/DataOffset`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/DataOffset/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/DataOffset/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/DataOffset/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/StateName`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/WnfStateChangeTrigger/StateName/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4627

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TargetUserSid">USERNAME_3</ns0:Data>
  <ns0:Data Name="TargetUserName">USERNAME_4</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_2</ns0:Data>
  <ns0:Data Name="TargetLogonId">VALUE_2</ns0:Data>
  <ns0:Data Name="LogonType">1</ns0:Data>
  <ns0:Data Name="EventIdx">1</ns0:Data>
  <ns0:Data Name="EventCountTotal">1</ns0:Data>
  <ns0:Data Name="GroupMembership">192.0.2.1</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=EventCountTotal]`	element
`/EventData/Data[@Name=EventCountTotal]/@Name`	string
`/EventData/Data[@Name=EventCountTotal]/text()`	encoded-json
`/EventData/Data[@Name=EventCountTotal]/text()`	string
`/EventData/Data[@Name=EventCountTotal]/text()::<json>`	integer
`/EventData/Data[@Name=EventIdx]`	element
`/EventData/Data[@Name=EventIdx]/@Name`	string
`/EventData/Data[@Name=EventIdx]/text()`	encoded-json
`/EventData/Data[@Name=EventIdx]/text()`	string
`/EventData/Data[@Name=EventIdx]/text()::<json>`	integer
`/EventData/Data[@Name=GroupMembership]`	element
`/EventData/Data[@Name=GroupMembership]/@Name`	string
`/EventData/Data[@Name=GroupMembership]/text()`	string
`/EventData/Data[@Name=LogonType]`	element
`/EventData/Data[@Name=LogonType]/@Name`	string
`/EventData/Data[@Name=LogonType]/text()`	encoded-json
`/EventData/Data[@Name=LogonType]/text()`	string
`/EventData/Data[@Name=LogonType]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetLogonId]`	element
`/EventData/Data[@Name=TargetLogonId]/@Name`	string
`/EventData/Data[@Name=TargetLogonId]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string
`/EventData/Data[@Name=TargetUserSid]`	element
`/EventData/Data[@Name=TargetUserSid]/@Name`	string
`/EventData/Data[@Name=TargetUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4742

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="ComputerAccountChange">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="TargetUserName">USERNAME_1</ns0:Data>
  <ns0:Data Name="TargetDomainName">COMPUTERNAME_2</ns0:Data>
  <ns0:Data Name="TargetSid">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="SubjectUserSid">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_3</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_3</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="PrivilegeList">VALUE_2</ns0:Data>
  <ns0:Data Name="SamAccountName">USERNAME_4</ns0:Data>
  <ns0:Data Name="DisplayName">USERNAME_4</ns0:Data>
  <ns0:Data Name="UserPrincipalName">USERNAME_1@example.invalid</ns0:Data>
  <ns0:Data Name="HomeDirectory">VALUE_2</ns0:Data>
  <ns0:Data Name="HomePath">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="ScriptPath">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="ProfilePath">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="UserWorkstations">USERNAME_4</ns0:Data>
  <ns0:Data Name="PasswordLastSet">VALUE_2</ns0:Data>
  <ns0:Data Name="AccountExpires">VALUE_2</ns0:Data>
  <ns0:Data Name="PrimaryGroupId">VALUE_2</ns0:Data>
  <ns0:Data Name="AllowedToDelegateTo">VALUE_2</ns0:Data>
  <ns0:Data Name="OldUacValue">VALUE_2</ns0:Data>
  <ns0:Data Name="NewUacValue">VALUE_2</ns0:Data>
  <ns0:Data Name="UserAccountControl">USERNAME_4</ns0:Data>
  <ns0:Data Name="UserParameters">USERNAME_4</ns0:Data>
  <ns0:Data Name="SidHistory">S-1-5-21-100-200-300-1002</ns0:Data>
  <ns0:Data Name="LogonHours">VALUE_2</ns0:Data>
  <ns0:Data Name="DnsHostName">VALUE_2</ns0:Data>
  <ns0:Data Name="ServicePrincipalNames">USERNAME_1@example.invalid</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccountExpires]`	element
`/EventData/Data[@Name=AccountExpires]/@Name`	string
`/EventData/Data[@Name=AccountExpires]/text()`	string
`/EventData/Data[@Name=AllowedToDelegateTo]`	element
`/EventData/Data[@Name=AllowedToDelegateTo]/@Name`	string
`/EventData/Data[@Name=AllowedToDelegateTo]/text()`	string
`/EventData/Data[@Name=ComputerAccountChange]`	element
`/EventData/Data[@Name=ComputerAccountChange]/@Name`	string
`/EventData/Data[@Name=ComputerAccountChange]/text()`	string
`/EventData/Data[@Name=DisplayName]`	element
`/EventData/Data[@Name=DisplayName]/@Name`	string
`/EventData/Data[@Name=DisplayName]/text()`	string
`/EventData/Data[@Name=DnsHostName]`	element
`/EventData/Data[@Name=DnsHostName]/@Name`	string
`/EventData/Data[@Name=DnsHostName]/text()`	string
`/EventData/Data[@Name=HomeDirectory]`	element
`/EventData/Data[@Name=HomeDirectory]/@Name`	string
`/EventData/Data[@Name=HomeDirectory]/text()`	string
`/EventData/Data[@Name=HomePath]`	element
`/EventData/Data[@Name=HomePath]/@Name`	string
`/EventData/Data[@Name=HomePath]/text()`	string
`/EventData/Data[@Name=LogonHours]`	element
`/EventData/Data[@Name=LogonHours]/@Name`	string
`/EventData/Data[@Name=LogonHours]/text()`	string
`/EventData/Data[@Name=NewUacValue]`	element
`/EventData/Data[@Name=NewUacValue]/@Name`	string
`/EventData/Data[@Name=NewUacValue]/text()`	string
`/EventData/Data[@Name=OldUacValue]`	element
`/EventData/Data[@Name=OldUacValue]/@Name`	string
`/EventData/Data[@Name=OldUacValue]/text()`	string
`/EventData/Data[@Name=PasswordLastSet]`	element
`/EventData/Data[@Name=PasswordLastSet]/@Name`	string
`/EventData/Data[@Name=PasswordLastSet]/text()`	string
`/EventData/Data[@Name=PrimaryGroupId]`	element
`/EventData/Data[@Name=PrimaryGroupId]/@Name`	string
`/EventData/Data[@Name=PrimaryGroupId]/text()`	string
`/EventData/Data[@Name=PrivilegeList]`	element
`/EventData/Data[@Name=PrivilegeList]/@Name`	string
`/EventData/Data[@Name=PrivilegeList]/text()`	string
`/EventData/Data[@Name=ProfilePath]`	element
`/EventData/Data[@Name=ProfilePath]/@Name`	string
`/EventData/Data[@Name=ProfilePath]/text()`	string
`/EventData/Data[@Name=SamAccountName]`	element
`/EventData/Data[@Name=SamAccountName]/@Name`	string
`/EventData/Data[@Name=SamAccountName]/text()`	string
`/EventData/Data[@Name=ScriptPath]`	element
`/EventData/Data[@Name=ScriptPath]/@Name`	string
`/EventData/Data[@Name=ScriptPath]/text()`	string
`/EventData/Data[@Name=ServicePrincipalNames]`	element
`/EventData/Data[@Name=ServicePrincipalNames]/@Name`	string
`/EventData/Data[@Name=ServicePrincipalNames]/text()`	string
`/EventData/Data[@Name=SidHistory]`	element
`/EventData/Data[@Name=SidHistory]/@Name`	string
`/EventData/Data[@Name=SidHistory]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TargetDomainName]`	element
`/EventData/Data[@Name=TargetDomainName]/@Name`	string
`/EventData/Data[@Name=TargetDomainName]/text()`	string
`/EventData/Data[@Name=TargetSid]`	element
`/EventData/Data[@Name=TargetSid]/@Name`	string
`/EventData/Data[@Name=TargetSid]/text()`	string
`/EventData/Data[@Name=TargetUserName]`	element
`/EventData/Data[@Name=TargetUserName]/@Name`	string
`/EventData/Data[@Name=TargetUserName]/text()`	string
`/EventData/Data[@Name=UserAccountControl]`	element
`/EventData/Data[@Name=UserAccountControl]/@Name`	string
`/EventData/Data[@Name=UserAccountControl]/text()`	string
`/EventData/Data[@Name=UserParameters]`	element
`/EventData/Data[@Name=UserParameters]/@Name`	string
`/EventData/Data[@Name=UserParameters]/text()`	string
`/EventData/Data[@Name=UserPrincipalName]`	element
`/EventData/Data[@Name=UserPrincipalName]/@Name`	string
`/EventData/Data[@Name=UserPrincipalName]/text()`	string
`/EventData/Data[@Name=UserWorkstations]`	element
`/EventData/Data[@Name=UserWorkstations]/@Name`	string
`/EventData/Data[@Name=UserWorkstations]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Microsoft-Windows-AppLocker/EXE and DLL · EventSourceName: Microsoft-Windows-AppLocker · Event ID: 8002

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:UserData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event" xmlns:ns1="http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0">
  <ns1:RuleAndFileData>
    <ns1:PolicyNameLength>1</ns1:PolicyNameLength>
    <ns1:PolicyName>VALUE_1</ns1:PolicyName>
    <ns1:RuleId>VALUE_2</ns1:RuleId>
    <ns1:RuleNameLength>1</ns1:RuleNameLength>
    <ns1:RuleName>VALUE_3</ns1:RuleName>
    <ns1:RuleSddlLength>1</ns1:RuleSddlLength>
    <ns1:RuleSddl>VALUE_4</ns1:RuleSddl>
    <ns1:TargetUser>USERNAME_1</ns1:TargetUser>
    <ns1:TargetProcessId>1</ns1:TargetProcessId>
    <ns1:FilePathLength>1</ns1:FilePathLength>
    <ns1:FilePath>SAMPLEFILE_1.txt</ns1:FilePath>
    <ns1:FileHashLength>1</ns1:FileHashLength>
    <ns1:FileHash />
    <ns1:FqbnLength>1</ns1:FqbnLength>
    <ns1:Fqbn>VALUE_5</ns1:Fqbn>
    <ns1:TargetLogonId>VALUE_6</ns1:TargetLogonId>
    <ns1:FullFilePathLength>1</ns1:FullFilePathLength>
    <ns1:FullFilePath>SAMPLEFILE_2.txt</ns1:FullFilePath>
  </ns1:RuleAndFileData>
</ns0:UserData>

Payload fields and types

Path	Type
`/UserData`	element
`/UserData/RuleAndFileData`	element
`/UserData/RuleAndFileData/FileHash`	element
`/UserData/RuleAndFileData/FileHashLength`	element
`/UserData/RuleAndFileData/FileHashLength/text()`	encoded-json
`/UserData/RuleAndFileData/FileHashLength/text()`	string
`/UserData/RuleAndFileData/FileHashLength/text()::<json>`	integer
`/UserData/RuleAndFileData/FilePath`	element
`/UserData/RuleAndFileData/FilePath/text()`	string
`/UserData/RuleAndFileData/FilePathLength`	element
`/UserData/RuleAndFileData/FilePathLength/text()`	encoded-json
`/UserData/RuleAndFileData/FilePathLength/text()`	string
`/UserData/RuleAndFileData/FilePathLength/text()::<json>`	integer
`/UserData/RuleAndFileData/Fqbn`	element
`/UserData/RuleAndFileData/Fqbn/text()`	string
`/UserData/RuleAndFileData/FqbnLength`	element
`/UserData/RuleAndFileData/FqbnLength/text()`	encoded-json
`/UserData/RuleAndFileData/FqbnLength/text()`	string
`/UserData/RuleAndFileData/FqbnLength/text()::<json>`	integer
`/UserData/RuleAndFileData/FullFilePath`	element
`/UserData/RuleAndFileData/FullFilePath/text()`	string
`/UserData/RuleAndFileData/FullFilePathLength`	element
`/UserData/RuleAndFileData/FullFilePathLength/text()`	encoded-json
`/UserData/RuleAndFileData/FullFilePathLength/text()`	string
`/UserData/RuleAndFileData/FullFilePathLength/text()::<json>`	integer
`/UserData/RuleAndFileData/PolicyName`	element
`/UserData/RuleAndFileData/PolicyName/text()`	string
`/UserData/RuleAndFileData/PolicyNameLength`	element
`/UserData/RuleAndFileData/PolicyNameLength/text()`	encoded-json
`/UserData/RuleAndFileData/PolicyNameLength/text()`	string
`/UserData/RuleAndFileData/PolicyNameLength/text()::<json>`	integer
`/UserData/RuleAndFileData/RuleId`	element
`/UserData/RuleAndFileData/RuleId/text()`	string
`/UserData/RuleAndFileData/RuleName`	element
`/UserData/RuleAndFileData/RuleName/text()`	string
`/UserData/RuleAndFileData/RuleNameLength`	element
`/UserData/RuleAndFileData/RuleNameLength/text()`	encoded-json
`/UserData/RuleAndFileData/RuleNameLength/text()`	string
`/UserData/RuleAndFileData/RuleNameLength/text()::<json>`	integer
`/UserData/RuleAndFileData/RuleSddl`	element
`/UserData/RuleAndFileData/RuleSddl/text()`	string
`/UserData/RuleAndFileData/RuleSddlLength`	element
`/UserData/RuleAndFileData/RuleSddlLength/text()`	encoded-json
`/UserData/RuleAndFileData/RuleSddlLength/text()`	string
`/UserData/RuleAndFileData/RuleSddlLength/text()::<json>`	integer
`/UserData/RuleAndFileData/TargetLogonId`	element
`/UserData/RuleAndFileData/TargetLogonId/text()`	string
`/UserData/RuleAndFileData/TargetProcessId`	element
`/UserData/RuleAndFileData/TargetProcessId/text()`	encoded-json
`/UserData/RuleAndFileData/TargetProcessId/text()`	string
`/UserData/RuleAndFileData/TargetProcessId/text()::<json>`	integer
`/UserData/RuleAndFileData/TargetUser`	element
`/UserData/RuleAndFileData/TargetUser/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4702

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TaskName">VALUE_2</ns0:Data>
  <ns0:Data Name="TaskContentNew">&lt;ns0:Task xmlns:ns0="http://schemas.microsoft.com/windows/2004/02/mit/task" version="VALUE_3"&gt;
  &lt;ns0:RegistrationInfo&gt;
    &lt;ns0:URI&gt;VALUE_2&lt;/ns0:URI&gt;
    &lt;ns0:SecurityDescriptor&gt;VALUE_4&lt;/ns0:SecurityDescriptor&gt;
  &lt;/ns0:RegistrationInfo&gt;
  &lt;ns0:Triggers&gt;
    &lt;ns0:TimeTrigger&gt;
      &lt;ns0:StartBoundary&gt;VALUE_5&lt;/ns0:StartBoundary&gt;
      &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;/ns0:TimeTrigger&gt;
  &lt;/ns0:Triggers&gt;
  &lt;ns0:Principals&gt;
    &lt;ns0:Principal id="VALUE_6"&gt;
      &lt;ns0:RunLevel&gt;VALUE_7&lt;/ns0:RunLevel&gt;
      &lt;ns0:UserId&gt;USERNAME_1&lt;/ns0:UserId&gt;
    &lt;/ns0:Principal&gt;
  &lt;/ns0:Principals&gt;
  &lt;ns0:Settings&gt;
    &lt;ns0:MultipleInstancesPolicy&gt;VALUE_8&lt;/ns0:MultipleInstancesPolicy&gt;
    &lt;ns0:DisallowStartIfOnBatteries&gt;false&lt;/ns0:DisallowStartIfOnBatteries&gt;
    &lt;ns0:StopIfGoingOnBatteries&gt;false&lt;/ns0:StopIfGoingOnBatteries&gt;
    &lt;ns0:AllowHardTerminate&gt;false&lt;/ns0:AllowHardTerminate&gt;
    &lt;ns0:StartWhenAvailable&gt;false&lt;/ns0:StartWhenAvailable&gt;
    &lt;ns0:RunOnlyIfNetworkAvailable&gt;false&lt;/ns0:RunOnlyIfNetworkAvailable&gt;
    &lt;ns0:IdleSettings&gt;
      &lt;ns0:Duration&gt;VALUE_9&lt;/ns0:Duration&gt;
      &lt;ns0:WaitTimeout&gt;2026-01-01T00:00:00Z&lt;/ns0:WaitTimeout&gt;
      &lt;ns0:StopOnIdleEnd&gt;false&lt;/ns0:StopOnIdleEnd&gt;
      &lt;ns0:RestartOnIdle&gt;false&lt;/ns0:RestartOnIdle&gt;
    &lt;/ns0:IdleSettings&gt;
    &lt;ns0:AllowStartOnDemand&gt;false&lt;/ns0:AllowStartOnDemand&gt;
    &lt;ns0:Enabled&gt;false&lt;/ns0:Enabled&gt;
    &lt;ns0:Hidden&gt;false&lt;/ns0:Hidden&gt;
    &lt;ns0:RunOnlyIfIdle&gt;false&lt;/ns0:RunOnlyIfIdle&gt;
    &lt;ns0:WakeToRun&gt;false&lt;/ns0:WakeToRun&gt;
    &lt;ns0:ExecutionTimeLimit&gt;2026-01-01T00:00:00Z&lt;/ns0:ExecutionTimeLimit&gt;
    &lt;ns0:Priority&gt;1&lt;/ns0:Priority&gt;
  &lt;/ns0:Settings&gt;
  &lt;ns0:Actions Context="VALUE_6"&gt;
    &lt;ns0:Exec&gt;
      &lt;ns0:Command&gt;echo SAMPLE_1&lt;/ns0:Command&gt;
      &lt;ns0:Arguments&gt;VALUE_10&lt;/ns0:Arguments&gt;
    &lt;/ns0:Exec&gt;
  &lt;/ns0:Actions&gt;
&lt;/ns0:Task&gt;</ns0:Data>
  <ns0:Data Name="ClientProcessStartKey">1</ns0:Data>
  <ns0:Data Name="ClientProcessId">1</ns0:Data>
  <ns0:Data Name="ParentProcessId">1</ns0:Data>
  <ns0:Data Name="RpcCallClientLocality">1</ns0:Data>
  <ns0:Data Name="FQDN">VALUE_11</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ClientProcessId]`	element
`/EventData/Data[@Name=ClientProcessId]/@Name`	string
`/EventData/Data[@Name=ClientProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessId]/text()`	string
`/EventData/Data[@Name=ClientProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=ClientProcessStartKey]`	element
`/EventData/Data[@Name=ClientProcessStartKey]/@Name`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	encoded-json
`/EventData/Data[@Name=ClientProcessStartKey]/text()`	string
`/EventData/Data[@Name=ClientProcessStartKey]/text()::<json>`	integer
`/EventData/Data[@Name=FQDN]`	element
`/EventData/Data[@Name=FQDN]/@Name`	string
`/EventData/Data[@Name=FQDN]/text()`	string
`/EventData/Data[@Name=ParentProcessId]`	element
`/EventData/Data[@Name=ParentProcessId]/@Name`	string
`/EventData/Data[@Name=ParentProcessId]/text()`	encoded-json
`/EventData/Data[@Name=ParentProcessId]/text()`	string
`/EventData/Data[@Name=ParentProcessId]/text()::<json>`	integer
`/EventData/Data[@Name=RpcCallClientLocality]`	element
`/EventData/Data[@Name=RpcCallClientLocality]/@Name`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	encoded-json
`/EventData/Data[@Name=RpcCallClientLocality]/text()`	string
`/EventData/Data[@Name=RpcCallClientLocality]/text()::<json>`	integer
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TaskContentNew]`	element
`/EventData/Data[@Name=TaskContentNew]/@Name`	string
`/EventData/Data[@Name=TaskContentNew]/text()`	encoded-xml
`/EventData/Data[@Name=TaskContentNew]/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/@version`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/@Context`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Arguments/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Actions/Exec/Command/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/@id`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/RunLevel/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Principals/Principal/UserId/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/SecurityDescriptor/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/RegistrationInfo/URI/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowHardTerminate/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/AllowStartOnDemand/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/DisallowStartIfOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/ExecutionTimeLimit/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Hidden/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/Duration/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/RestartOnIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/StopOnIdleEnd/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/IdleSettings/WaitTimeout/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/MultipleInstancesPolicy/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/Priority/text()::<json>`	integer
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfIdle/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/RunOnlyIfNetworkAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StartWhenAvailable/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/StopIfGoingOnBatteries/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Settings/WakeToRun/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	encoded-json
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()`	string
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/Enabled/text()::<json>`	boolean
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary`	element
`/EventData/Data[@Name=TaskContentNew]/text()::<xml>/Task/Triggers/TimeTrigger/StartBoundary/text()`	string
`/EventData/Data[@Name=TaskName]`	element
`/EventData/Data[@Name=TaskName]/@Name`	string
`/EventData/Data[@Name=TaskName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4660

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectServer">VALUE_2</ns0:Data>
  <ns0:Data Name="HandleId">VALUE_3</ns0:Data>
  <ns0:Data Name="ProcessId">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ProcessName">VALUE_4</ns0:Data>
  <ns0:Data Name="TransactionId">VALUE_5</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=HandleId]`	element
`/EventData/Data[@Name=HandleId]/@Name`	string
`/EventData/Data[@Name=HandleId]/text()`	string
`/EventData/Data[@Name=ObjectServer]`	element
`/EventData/Data[@Name=ObjectServer]/@Name`	string
`/EventData/Data[@Name=ObjectServer]/text()`	string
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=ProcessName]`	element
`/EventData/Data[@Name=ProcessName]/@Name`	string
`/EventData/Data[@Name=ProcessName]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TransactionId]`	element
`/EventData/Data[@Name=TransactionId]/@Name`	string
`/EventData/Data[@Name=TransactionId]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4985

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="TransactionId">VALUE_2</ns0:Data>
  <ns0:Data Name="NewState">1</ns0:Data>
  <ns0:Data Name="ResourceManager">VALUE_3</ns0:Data>
  <ns0:Data Name="ProcessId">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ProcessName">VALUE_4</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=NewState]`	element
`/EventData/Data[@Name=NewState]/@Name`	string
`/EventData/Data[@Name=NewState]/text()`	encoded-json
`/EventData/Data[@Name=NewState]/text()`	string
`/EventData/Data[@Name=NewState]/text()::<json>`	integer
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=ProcessName]`	element
`/EventData/Data[@Name=ProcessName]/@Name`	string
`/EventData/Data[@Name=ProcessName]/text()`	string
`/EventData/Data[@Name=ResourceManager]`	element
`/EventData/Data[@Name=ResourceManager]/@Name`	string
`/EventData/Data[@Name=ResourceManager]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string
`/EventData/Data[@Name=TransactionId]`	element
`/EventData/Data[@Name=TransactionId]/@Name`	string
`/EventData/Data[@Name=TransactionId]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4872

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="IsBaseCRL">VALUE_1</ns0:Data>
  <ns0:Data Name="CRLNumber">1</ns0:Data>
  <ns0:Data Name="KeyContainer">VALUE_2</ns0:Data>
  <ns0:Data Name="NextPublish">VALUE_3</ns0:Data>
  <ns0:Data Name="PublishURLs">https://example.invalid/SAMPLE_1</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=CRLNumber]`	element
`/EventData/Data[@Name=CRLNumber]/@Name`	string
`/EventData/Data[@Name=CRLNumber]/text()`	encoded-json
`/EventData/Data[@Name=CRLNumber]/text()`	string
`/EventData/Data[@Name=CRLNumber]/text()::<json>`	integer
`/EventData/Data[@Name=IsBaseCRL]`	element
`/EventData/Data[@Name=IsBaseCRL]/@Name`	string
`/EventData/Data[@Name=IsBaseCRL]/text()`	string
`/EventData/Data[@Name=KeyContainer]`	element
`/EventData/Data[@Name=KeyContainer]/@Name`	string
`/EventData/Data[@Name=KeyContainer]/text()`	string
`/EventData/Data[@Name=NextPublish]`	element
`/EventData/Data[@Name=NextPublish]/@Name`	string
`/EventData/Data[@Name=NextPublish]/text()`	string
`/EventData/Data[@Name=PublishURLs]`	element
`/EventData/Data[@Name=PublishURLs]/@Name`	string
`/EventData/Data[@Name=PublishURLs]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4946

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="ProfileChanged">SAMPLEFILE_1.txt</ns0:Data>
  <ns0:Data Name="RuleId">VALUE_1</ns0:Data>
  <ns0:Data Name="RuleName">VALUE_2</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=ProfileChanged]`	element
`/EventData/Data[@Name=ProfileChanged]/@Name`	string
`/EventData/Data[@Name=ProfileChanged]/text()`	string
`/EventData/Data[@Name=RuleId]`	element
`/EventData/Data[@Name=RuleId]/@Name`	string
`/EventData/Data[@Name=RuleId]/text()`	string
`/EventData/Data[@Name=RuleName]`	element
`/EventData/Data[@Name=RuleName]/@Name`	string
`/EventData/Data[@Name=RuleName]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

Channel: Security · EventSourceName: Microsoft-Windows-Security-Auditing · Event ID: 4663

All values in this example are synthetic. Format: XML; column encoding: xml-string.

<ns0:EventData xmlns:ns0="http://schemas.microsoft.com/win/2004/08/events/event">
  <ns0:Data Name="SubjectUserSid">USERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectUserName">USERNAME_2</ns0:Data>
  <ns0:Data Name="SubjectDomainName">COMPUTERNAME_1</ns0:Data>
  <ns0:Data Name="SubjectLogonId">VALUE_1</ns0:Data>
  <ns0:Data Name="ObjectServer">VALUE_2</ns0:Data>
  <ns0:Data Name="ObjectType">VALUE_3</ns0:Data>
  <ns0:Data Name="ObjectName">VALUE_4</ns0:Data>
  <ns0:Data Name="HandleId">VALUE_5</ns0:Data>
  <ns0:Data Name="AccessList">VALUE_6</ns0:Data>
  <ns0:Data Name="AccessMask">VALUE_7</ns0:Data>
  <ns0:Data Name="ProcessId">S-1-5-21-100-200-300-1001</ns0:Data>
  <ns0:Data Name="ProcessName">VALUE_8</ns0:Data>
  <ns0:Data Name="ResourceAttributes">VALUE_9</ns0:Data>
</ns0:EventData>

Payload fields and types

Path	Type
`/EventData`	element
`/EventData/Data[@Name=AccessList]`	element
`/EventData/Data[@Name=AccessList]/@Name`	string
`/EventData/Data[@Name=AccessList]/text()`	string
`/EventData/Data[@Name=AccessMask]`	element
`/EventData/Data[@Name=AccessMask]/@Name`	string
`/EventData/Data[@Name=AccessMask]/text()`	string
`/EventData/Data[@Name=HandleId]`	element
`/EventData/Data[@Name=HandleId]/@Name`	string
`/EventData/Data[@Name=HandleId]/text()`	string
`/EventData/Data[@Name=ObjectName]`	element
`/EventData/Data[@Name=ObjectName]/@Name`	string
`/EventData/Data[@Name=ObjectName]/text()`	string
`/EventData/Data[@Name=ObjectServer]`	element
`/EventData/Data[@Name=ObjectServer]/@Name`	string
`/EventData/Data[@Name=ObjectServer]/text()`	string
`/EventData/Data[@Name=ObjectType]`	element
`/EventData/Data[@Name=ObjectType]/@Name`	string
`/EventData/Data[@Name=ObjectType]/text()`	string
`/EventData/Data[@Name=ProcessId]`	element
`/EventData/Data[@Name=ProcessId]/@Name`	string
`/EventData/Data[@Name=ProcessId]/text()`	string
`/EventData/Data[@Name=ProcessName]`	element
`/EventData/Data[@Name=ProcessName]/@Name`	string
`/EventData/Data[@Name=ProcessName]/text()`	string
`/EventData/Data[@Name=ResourceAttributes]`	element
`/EventData/Data[@Name=ResourceAttributes]/@Name`	string
`/EventData/Data[@Name=ResourceAttributes]/text()`	string
`/EventData/Data[@Name=SubjectDomainName]`	element
`/EventData/Data[@Name=SubjectDomainName]/@Name`	string
`/EventData/Data[@Name=SubjectDomainName]/text()`	string
`/EventData/Data[@Name=SubjectLogonId]`	element
`/EventData/Data[@Name=SubjectLogonId]/@Name`	string
`/EventData/Data[@Name=SubjectLogonId]/text()`	string
`/EventData/Data[@Name=SubjectUserName]`	element
`/EventData/Data[@Name=SubjectUserName]/@Name`	string
`/EventData/Data[@Name=SubjectUserName]/text()`	string
`/EventData/Data[@Name=SubjectUserSid]`	element
`/EventData/Data[@Name=SubjectUserSid]/@Name`	string
`/EventData/Data[@Name=SubjectUserSid]/text()`	string

XML string; paths identify elements, attributes, and text. No required fields are inferred. Embedded task XML is escaped text; ::<xml> paths mark another XML parsing boundary.

Sources and context: Microsoft table reference.

SecurityEvent Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Usx		Microsoft Sentinel	Security events collected from windows machines by Azure Security Center or Azure Sentinel.	Sentinel

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
_ResourceId	A unique identifier for the resource that the record is associated with	String
_SubscriptionId	A unique identifier for the subscription that the record is associated with	String
AccessMask	Hexadecimal mask for the requested or performed operation.	String
Account	An identifier for the account as found by Microsoft Defender for Cloud. Could be Microsoft Entra ID, user principal name, IaM role or other identifiers	String
AccountDomain	Domain of the account	String
AccountExpires	The date when the account expires.	String
AccountName	User name of the account	String
AccountSessionIdentifier	A unique identifier that is generated by the machine when the session is created.	String
AccountType	Type of user account, indicating its general role and access levels, such as Regular, System, Admin, Application	String
Activity	Sensor activity	String
AdditionalInfo	Additional information that is provided by the source, which do not mapped to other fields, represented by list.	String
AdditionalInfo2	Additional information that is provided by the source, which do not mapped to other fields, represented by list.	String
AllowedToDelegateTo	The list of SPNs to which this account can present delegated credentials.	String
Attributes	Additional information about the event.	String
AuditPolicyChanges	Events that are generated when changes are made to the system audit policy or audit settings on a file or registry key.	String
AuditsDiscarded	Number of audit messages that were discarded.	Int32
AuthenticationLevel	Number of audit messages that were discarded.	Int32
AuthenticationPackageName	the name of loaded Authentication Package. The format is: DLL_PATH_AND_NAME: AUTHENTICATION_PACKAGE_NAME.	String
AuthenticationProvider	The identity of the provider responsible for the authentication process (can include a certificate authority, a username, a password authentication system, etc).	String
AuthenticationServer	The server in which located the authentication provider.	String
AuthenticationService	The service in which located the authentication provider.	Int32
AuthenticationType	the type of authentication that was used for the event (two-factor authentication, biometric authentication, etc).	String
AzureDeploymentID	Azure deployment ID of the cloud service the log belongs to.	String
CACertificateHash	The hash value of the certificate authority’s (CA) certificate that was used to authenticate the user who performed the event.	String
CalledStationID	Information about the ID of the station that initiated the action that led to the security event.	String
CallerProcessId	Hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process.	String
CallerProcessName	Full path and the name of the executable for the process.	String
CallingStationID	Information about the ID of the station that initiated the action that led to the security event.	String
CAPublicKeyHash	Hash value that identifies the public key of a certification authority (CA) that issued a certificate.	String
CategoryId	The category of the security event that occurred (login attempt, data breach, etc).	String
CertificateDatabaseHash	Hash value that identifies the database that issued a certificate.	String
Channel	The channel to which the event was logged.	String
ClassId	‘Class Guid’ attribute of device.	String
ClassName	‘Class’ attribute of device.	String
ClientAddress	IP address of the computer from which the TGT request was received.	String
ClientIPAddress	IP address of the computer that initiated the action that led to the event.	String
ClientName	computer name from which the user was reconnected. Has ‘Unknown’ value for console session.	String
CommandLine	The command line arguments that were passed to an application or process that was involved in the event.	String
CompatibleIds	‘Compatible Ids’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’:	String
Computer	The name of the computer on which the event occurred.	String
Correlation	The activity identifiers that consumers can use to group related events together.	String
DCDNSName	The DNS name of the domain controller that was involved in the event.	String
DeviceDescription	the description of the device that was involved in the event.	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DisplayName	Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.	String
Disposition	The event outcome/ resolution, such as whether the event was resolved or whether any action was taken in response to the event.	String
DomainBehaviorVersion	msDS-Behavior-Version domain attribute was modified. Numeric value.	String
DomainName	Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack	String
DomainPolicyChanged	Indicates whether any domain policies have been changed as part of the event (password policies, security policies, etc).	String
DomainSid	SID of the trust partner. This parameter might not be captured in the event, and in that case appears as ‘NULL SID’.	String
EAPType	The type of Extensible Authentication Protocol (EAP) that was used for the event authentication process.	String
ElevatedToken	A ‘Yes’ or ‘No’ flag. If ‘Yes’, then the session this event represents is elevated and has administrator privileges.	String
ErrorCode	Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes	Int32
EventData	Event specific data associated with the event.	String
EventID	The identifier that the provider used to identify the event.	Int32
EventLevelName	The rendered message string of the level specified in the event.	String
EventRecordId	The record number assigned to the event when it was logged.	String
EventSourceName	The name of the software that logs the event (applicationor a succomponent).	String
ExtendedQuarantineState	The state of the network quarantine process, if applicable. Network quarantine is a process by which unauthorized devices are prevented from accessing a network until they meet certain security requirements or have been checked for malware.	String
FailureReason	Information explaining why the recorded action failed	String
FileHash	The hash value for any files that are were accessed or modified as part of the event, or any files that were used in the authentication or authorization process.	String
FilePath	Full path and filename of the key file on which the operation was performed.	String
FilePathNoUser	The path of any files that are related to the event, excluding the username or other user-specific information.	String
Filter	Filters that are used in the performed event.	String
ForceLogoff	‘\Security Settings\Local Policies\Security Options\Network security: Force logoff when logon hours expire’ group policy.	String
Fqbn	The fully qualified binary name (FQBN) for any files that are related to the event.	String
FullyQualifiedSubjectMachineName	The fully qualified domain name (FQDN) of the machine that initiated the event.	String
FullyQualifiedSubjectUserName	The username of the user or service that initiated the event in FQDN format.	String
GroupMembership	Account’s group membership description	String
HandleId	Hexadecimal value of a handle to Object Name. This field can be used for correlation with other events.	String
HardwareIds	‘Hardware Ids’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’:	String
HomeDirectory	User’s home directory. If homeDrive attribute is set and specifies a drive letter, homeDirectory should be a UNC path. The path must be a network UNC of the form \Server\Share\Directory.	String
HomePath	User’s home path. The path must be a network UNC of the form \Server\Share\Directory.	String
InterfaceUuid	Unique identifier (UUID) for the Remote Procedure Call (RPC) interface that the attacker attempted to access	String
IpAddress	IP address that the attacker attempted to access	String
IpPort	The network port number associated with the event.	String
KeyLength	The length of NTLM Session Security key. Typically it has 128 bit or 56 bit length.	Int32
Keywords	A bitmask of the keywords defined in the event.	String
Level	Windows categorizes every event with a severity level. The levels in order of severity are information, verbose, warning, error and critical expressed in numbers.	String
LmPackageName	The name of the package or software component that is currently using the Local Security Authority (LSA) on the machine where the event is being generated.	String
LocationInformation	‘Location information’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’:	String
LockoutDuration	‘\Security Settings\Account Policies\Account Lockout Policy\Account lockout duration’ group policy. Numeric value.	String
LockoutObservationWindow	‘\Security Settings\Account Policies\Account Lockout Policy\Reset account lockout counter after’ group policy. Numeric value.	String
LockoutThreshold	‘\Security Settings\Account Policies\Account Lockout Policy\Account lockout threshold’ group policy. Numeric value.	String
LoggingResult	The result of the logon process.	String
LogonGuid	A GUID that can help you correlate this event with another event that can contain the same Logon GUID.	String
LogonHours	Hours that the account is allowed to logon to the domain.	String
LogonID	Hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID.	String
LogonProcessName	The name of registered logon process.	String
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	Int32
LogonTypeName	The type of logon or authentication event that is being captured by the event log (common values:Interactive, Network, RemoteInteractive, Unlock).	String
MachineAccountQuota	ms-DS-MachineAccountQuota domain attribute was modified. Numeric value.	String
MachineInventory	Information about the hardware configuration and software environment of the computer where the event is being generated. It can include different data points, for instance: the make and model of the computer, the amount of RAM or storage space available, the version numbers of various software applications, etc).	String
MachineLogon	Information about a successful logon event in the machine.	String
ManagementGroupName	Additional information based on the resource type.	String
MandatoryLabel	ID of integrity label which was assigned to the new process.	String
MaxPasswordAge	The period of time (in days) that a password can be used before the system requires the user to change it.	String
MemberName	The user account that was involved in the event.	String
MemberSid	The security identifier (SID) associated with the user account that was involved in the event.	String
MinPasswordAge	The period of time (in days) that a password must be used before the system requires the user to change it.	String
MinPasswordLength	The least number of characters that can make up a password for a user account.	String
MixedDomainMode	The domain mode of a system or domain controller.	String
NASIdentifier	The identifier of the network access server (NAS) that was involved in the event.	String
NASIPv4Address	The IPv4Address of the network access server (NAS) that was involved in the event, if applicable.	String
NASIPv6Address	The IPv6Address of the network access server (NAS) that was involved in the event, if applicable.	String
NASPort	the port on the network access server that was used in the event.	String
NASPortType	the type of network access server (NAS) used in the event.	String
NetworkPolicyName	The name of the network policy associated with the event.	String
NewDate	New date in UTC time zone. The format is YYYY-MM-DD.	String
NewMaxUsers	The new maximum number of users allowed for a resource in the event.	String
NewProcessId	Hexadecimal Process ID of the new process. Process ID (PID) is a number used by the operating system to uniquely identify an active process.	String
NewProcessName	Full path and the name of the executable for the new process.	String
NewRemark	The new value of network share ‘Comments:’ field. Has ‘N/A’ value if it isn’t set.	String
NewShareFlags	The share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.	String
NewTime	New time that was set in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ	String
NewUacValue	Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account.	String
NewValue	New value for changed registry key value.	String
NewValueType	New type of changed registry key value.	String
ObjectName	Name of the object that the recorded action was applied to	String
ObjectServer	Contains the name of the Windows subsystem calling the routine.	String
ObjectType	The type of object, such as a file or a folder, that the recorded action was applied to	String
ObjectValueName	The name of modified registry key value.	String
OemInformation	The original equipment manufacturer (OEM) associated with a device or system in the event.	String
OldMaxUsers	The previous maximum number of users allowed for a resource in the event.	String
OldRemark	the old value of network share ‘Comments:’ field. Has ‘N/A’ value if it isn’t set.	String
OldShareFlags	The previous share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.	String
OldUacValue	Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the previous value of userAccountControl attribute of user object.	String
OldValue	Old value for changed registry key value.	String
OldValueType	Old type of changed registry key value.	String
Opcode	The opcode element is defined by the SystemPropertiesType complex type.	String
OperationType	The type of operation which was performed on an object	String
PackageName	The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon.	String
ParentProcessName	The name of the parent process	String
PasswordHistoryLength	\Security Settings\Account Policies\Password Policy\Enforce password history” group policy. Numeric value.	String
PasswordLastSet	Last time the account’s password was modified.	String
PasswordProperties	The password policies or properties associated with the event, for example: password length, complexity and expiration date.	String
PreviousDate	The previous date associated with the event.	String
PreviousTime	Previous time in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ.	String
PrimaryGroupId	Relative Identifier (RID) of user’s object primary group.	String
PrivateKeyUsageCount	The number of times a private key has been used.	String
PrivilegeList	The privileges, including user, group, or system privileges associated with the event.	String
Process	The name of the process that generates the event.	String
ProcessId	Process ID (PID) of the newly created process	String
ProcessName	The name of the process	String
ProfilePath	Specifies a path to the account’s profile. This value can be a null string, a local absolute path, or a UNC path.	String
Properties	Depends on Object Type. This field can be empty or contain the list of the object properties that were accessed.	String
ProtocolSequence	Information about the protocol used for an authentication attempt.	String
ProxyPolicyName	Name of the policy that was used to configure the proxy server for connecting to the network.	String
QuarantineHelpURL	URL that provides help with troubleshooting a network quarantine issue.	String
QuarantineSessionID	Identifier of the session where the file was assessed for quarantine.	String
QuarantineSessionIdentifier	Identifier of the session where the file was assessed for quarantine.	String
QuarantineState	It shows whether the file is quarantined.	String
QuarantineSystemHealthResult	Report that shows the status of the files that have been quarantined.	String
RelativeTargetName	Relative name of the accessed target file or folder. This file-path is relative to the network share. If access was requested for the share itself, then this field appears as “\”.	String
RemoteIpAddress	The IP address of the computer that initiated a remote connection.	String
RemotePort	TCP port on the remote device that was being connected to	String
Requester	The event requester identifier.	String
RequestId	Unique identifier of the request	String
RestrictedAdminMode	Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.	String
RowsDeleted	The number of rows that were deleted as a part of a particular operation.	String
SamAccountName	logon name for account used to support clients and servers from previous versions of Windows (pre-Windows 2000 logon name).	String
ScriptPath	Specifies the path of the account’s logon script.	String
SecurityDescriptor	Information about the security settings and permissions of a particular object or resource.	String
ServiceAccount	The security context that the service will run as when started.	String
ServiceFileName	Indicates the type of service that was registered with the Service Control Manager.	String
ServiceName	The name of installed service.	String
ServiceStartType	Contains information about how a particular service should be started, whether it should be started automatically or manually.	Int32
ServiceType	Indicates the type of service that was registered with the Service Control Manager.	String
SessionName	The name of the session to which the user was reconnected.	String
ShareLocalPath	The local path of accessed network share.	String
ShareName	Name of shared folder containing the file	String
SidHistory	Contains previous SIDs used for the object if the object was moved from another domain.	String
SourceComputerId	The source computer ID of the activity	String
SourceSystem	The Log Analytics source system. Value is always ‘OpsManager’.	String
Status	Indicator of the profile status - can be Enabled or Disabled	String
StorageAccount	Sets the storage account access key.	String
SubcategoryGuid	The unique GUID of changed subcategory.	String
SubcategoryId	A unique identifier for a specific type of the event.	String
Subject	Subject of the email	String
SubjectAccount	Information about the account that is initiating the event.	String
SubjectDomainName	Information about the domain or workgroup to which the subject account belongs.	String
SubjectKeyIdentifier	A unique identifier for a particular certificate subject.	String
SubjectLogonId	A unique identifier for the logon session associated with the subject account.	String
SubjectMachineName	Information about the machine or system from which the event was created.	String
SubjectMachineSID	The security identifier (SID) for the machine that generated the event.	String
SubjectUserName	The name of the user account that generated the event.	String
SubjectUserSid	The security identifier (SID) for the user account that generated the event.	String
SubStatus	Additional information about logon failure. The most common substatus codes listed in the ‘Table 12. Windows logon status codes’.	String
SystemProcessId	Identifies the process that generated the event.	Int32
SystemThreadId	Identifies the thread that generated the event.	Int32
SystemUserId	The ID of the user who is responsible for the event.	String
TableId	The specific data table identifier the event data is stored in.	String
TargetAccount	The account targeted by the event (user name, computer name, etc).	String
TargetDomainName	Domain name of the device that was targeted or attacked	String
TargetInfo	Additional information about the event target (for example: the path to a file or folder, the name of a registry key, etc).	String
TargetLinkedLogonId	Information that helps to link related events together by their logon attempt IDs. It can be useful in keeping all relevant events organized, tracking activity across multiple sessions, and identifying the attack source.	String
TargetLogonGuid	A globally unique identifier (GUID) associated with the logon session related to the event.	String
TargetLogonId	A unique identifier associated with the logon session related to the event.	String
TargetOutboundDomainName	The domain that the account specified in the TargetAccount field was authenticated against during an outbound authentication attempt.	String
TargetOutboundUserName	The name of the user account that was authenticated during an outbound authentication attempt.	String
TargetServerName	The name of the server on which the new process was run. Has “localhost” value if the process was run locally.	String
TargetSid	The security identifier (SID) of the server on which the new process was run.	String
TargetUser	The user account identifier that generated the new process.	String
TargetUserName	The name of the user account that generated the new process.	String
TargetUserSid	The security identifier (SID) associated with the user or resource involved in the event.	String
Task	The task defined in the event.	Int32
TemplateContent	The content of the event message or notification in a structured form.	String
TemplateDSObjectFQDN	FQDN of the DS object that represents the GPO template.	String
TemplateInternalName	The internal name of the GPO template.	String
TemplateOID	the unique identifier for the template that was used to create the event.	String
TemplateSchemaVersion	Version of the template schema that defines the data to include with an event.	String
TemplateVersion	Version of the template that defines the data to include with an event.	String
TenantId	Unique identifier of the tenant into which the data connector ingests data.	String
TimeGenerated	The time stamp when the event was generated on the computer.	DateTime
TokenElevationType	Type of token that was assigned to a new process in accordance with User Account Control Policy.	String
TransmittedServices	The list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see https://msdn.microsoft.com/library/cc246072.aspx.	String
Type	The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other	String
UserAccountControl	Security attributes of the user account in the AD domain.	String
UserParameters	If you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see <value changed, but not displayed> in this field. For local accounts, this field is not applicable and always has value.	String
UserPrincipalName	Internet-style login name for the account, based on the Internet standard RFC 822. By convention this should map to the account’s email name.	String
UserWorkstations	Contains the list of NetBIOS or DNS names of the computers from which the user can logon. Each computer name is separated by a comma. The name of a computer is the sAMAccountName property of a computer object.	String
VendorIds	‘Hardware Ids’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’.	String
Version	Version of the agent.	Int32
VirtualAccount	A ‘Yes’ or ‘No’ flag, which indicates if the account is a virtual account (e.g., ‘Managed Service Account’), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using ‘NetworkService’.	String
Workstation	The name of the machine that was used to perform the event.	String
WorkstationName	Machine name from which a logon attempt was performed.	String

Schema changes

Date	Action
2026-10-07	Table added to tracking
2026-02-27	Table removed from tracking
2024-10-18	Table added to tracking

Other notes

Parse EventData

If EventData is empty, check the table’s extracted columns. AppLocker event 8002 uses UserData/RuleAndFileData rather than named Data elements. See the SecurityEvent reference and AppLocker event reference.

Use parse_xml() to read named fields: @Name holds the field name and #text holds its value. The example below expands event 4627’s Data elements. See the XML parsing reference and event 4627 reference.

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4627 and isnotempty(EventData)
| top 20 by TimeGenerated desc
| extend Parsed = parse_xml(EventData)
| mv-expand Field = Parsed.EventData.Data
| project TimeGenerated, Computer, EventID,
    FieldName = tostring(Field["@Name"]),
    FieldValue = tostring(Field["#text"])

JSON inside directory change XML

In event 5136, AttributeValue can contain JSON text. Select that named field after parsing the XML, then decode its text with parse_json(tostring(Field["#text"])).

Embedded scheduled-task XML

TaskContent and TaskContentNew can contain escaped XML. Parse the outer event first, then parse the extracted task text, as shown below. See the task update event reference and Task Scheduler schema.

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID in (4698, 4702) and isnotempty(EventData)
| top 20 by TimeGenerated desc
| extend Parsed = parse_xml(EventData)
| mv-expand Field = Parsed.EventData.Data
| where tostring(Field["@Name"]) in ("TaskContent", "TaskContentNew")
| project TimeGenerated, Computer, EventID,
    TaskField = tostring(Field["@Name"]),
    ParsedTask = parse_xml(tostring(Field["#text"]))

Known observations

Value casing varies

Fields: Account, EventData, AdditionalInfo2, CommandLine, NewProcessName, ObjectName, ParentProcessName, Process, ProcessName, RelativeTargetName, ServiceFileName, ServiceName, SubjectAccount, SubjectUserName, TargetAccount, TargetDomainName, TargetInfo, TargetOutboundDomainName, TargetServerName, TargetUserName.

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.

SecurityEvent Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Usx		Microsoft Sentinel	Security events collected from windows machines by Azure Security Center or Azure Sentinel.	Sentinel

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
_ResourceId	A unique identifier for the resource that the record is associated with	String
_SubscriptionId	A unique identifier for the subscription that the record is associated with	String
AccessMask	Hexadecimal mask for the requested or performed operation.	String
Account	An identifier for the account as found by Microsoft Defender for Cloud. Could be Microsoft Entra ID, user principal name, IaM role or other identifiers	String
AccountDomain	Domain of the account	String
AccountExpires	The date when the account expires.	String
AccountName	User name of the account	String
AccountSessionIdentifier	A unique identifier that is generated by the machine when the session is created.	String
AccountType	Type of user account, indicating its general role and access levels, such as Regular, System, Admin, Application	String
Activity	Sensor activity	String
AdditionalInfo	Additional information that is provided by the source, which do not mapped to other fields, represented by list.	String
AdditionalInfo2	Additional information that is provided by the source, which do not mapped to other fields, represented by list.	String
AllowedToDelegateTo	The list of SPNs to which this account can present delegated credentials.	String
Attributes	Additional information about the event.	String
AuditPolicyChanges	Events that are generated when changes are made to the system audit policy or audit settings on a file or registry key.	String
AuditsDiscarded	Number of audit messages that were discarded.	Int32
AuthenticationLevel	Number of audit messages that were discarded.	Int32
AuthenticationPackageName	the name of loaded Authentication Package. The format is: DLL_PATH_AND_NAME: AUTHENTICATION_PACKAGE_NAME.	String
AuthenticationProvider	The identity of the provider responsible for the authentication process (can include a certificate authority, a username, a password authentication system, etc).	String
AuthenticationServer	The server in which located the authentication provider.	String
AuthenticationService	The service in which located the authentication provider.	Int32
AuthenticationType	the type of authentication that was used for the event (two-factor authentication, biometric authentication, etc).	String
AzureDeploymentID	Azure deployment ID of the cloud service the log belongs to.	String
CACertificateHash	The hash value of the certificate authority’s (CA) certificate that was used to authenticate the user who performed the event.	String
CalledStationID	Information about the ID of the station that initiated the action that led to the security event.	String
CallerProcessId	Hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process.	String
CallerProcessName	Full path and the name of the executable for the process.	String
CallingStationID	Information about the ID of the station that initiated the action that led to the security event.	String
CAPublicKeyHash	Hash value that identifies the public key of a certification authority (CA) that issued a certificate.	String
CategoryId	The category of the security event that occurred (login attempt, data breach, etc).	String
CertificateDatabaseHash	Hash value that identifies the database that issued a certificate.	String
Channel	The channel to which the event was logged.	String
ClassId	‘Class Guid’ attribute of device.	String
ClassName	‘Class’ attribute of device.	String
ClientAddress	IP address of the computer from which the TGT request was received.	String
ClientIPAddress	IP address of the computer that initiated the action that led to the event.	String
ClientName	computer name from which the user was reconnected. Has ‘Unknown’ value for console session.	String
CommandLine	The command line arguments that were passed to an application or process that was involved in the event.	String
CompatibleIds	‘Compatible Ids’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’:	String
Computer	The name of the computer on which the event occurred.	String
Correlation	The activity identifiers that consumers can use to group related events together.	String
DCDNSName	The DNS name of the domain controller that was involved in the event.	String
DeviceDescription	the description of the device that was involved in the event.	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DisplayName	Name of the account user displayed in the address book. Typically a combination of a given or first name, a middle initial, and a last name or surname.	String
Disposition	The event outcome/ resolution, such as whether the event was resolved or whether any action was taken in response to the event.	String
DomainBehaviorVersion	msDS-Behavior-Version domain attribute was modified. Numeric value.	String
DomainName	Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack	String
DomainPolicyChanged	Indicates whether any domain policies have been changed as part of the event (password policies, security policies, etc).	String
DomainSid	SID of the trust partner. This parameter might not be captured in the event, and in that case appears as ‘NULL SID’.	String
EAPType	The type of Extensible Authentication Protocol (EAP) that was used for the event authentication process.	String
ElevatedToken	A ‘Yes’ or ‘No’ flag. If ‘Yes’, then the session this event represents is elevated and has administrator privileges.	String
ErrorCode	Contains the error code if a sign-in error occurs. To find a description of a specific error code, visit https://aka.ms/AADsigninsErrorCodes	Int32
EventData	Event specific data associated with the event.	String
EventID	The identifier that the provider used to identify the event.	Int32
EventLevelName	The rendered message string of the level specified in the event.	String
EventRecordId	The record number assigned to the event when it was logged.	String
EventSourceName	The name of the software that logs the event (applicationor a succomponent).	String
ExtendedQuarantineState	The state of the network quarantine process, if applicable. Network quarantine is a process by which unauthorized devices are prevented from accessing a network until they meet certain security requirements or have been checked for malware.	String
FailureReason	Information explaining why the recorded action failed	String
FileHash	The hash value for any files that are were accessed or modified as part of the event, or any files that were used in the authentication or authorization process.	String
FilePath	Full path and filename of the key file on which the operation was performed.	String
FilePathNoUser	The path of any files that are related to the event, excluding the username or other user-specific information.	String
Filter	Filters that are used in the performed event.	String
ForceLogoff	‘\Security Settings\Local Policies\Security Options\Network security: Force logoff when logon hours expire’ group policy.	String
Fqbn	The fully qualified binary name (FQBN) for any files that are related to the event.	String
FullyQualifiedSubjectMachineName	The fully qualified domain name (FQDN) of the machine that initiated the event.	String
FullyQualifiedSubjectUserName	The username of the user or service that initiated the event in FQDN format.	String
GroupMembership	Account’s group membership description	String
HandleId	Hexadecimal value of a handle to Object Name. This field can be used for correlation with other events.	String
HardwareIds	‘Hardware Ids’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’:	String
HomeDirectory	User’s home directory. If homeDrive attribute is set and specifies a drive letter, homeDirectory should be a UNC path. The path must be a network UNC of the form \Server\Share\Directory.	String
HomePath	User’s home path. The path must be a network UNC of the form \Server\Share\Directory.	String
InterfaceUuid	Unique identifier (UUID) for the Remote Procedure Call (RPC) interface that the attacker attempted to access	String
IpAddress	IP address that the attacker attempted to access	String
IpPort	The network port number associated with the event.	String
KeyLength	The length of NTLM Session Security key. Typically it has 128 bit or 56 bit length.	Int32
Keywords	A bitmask of the keywords defined in the event.	String
Level	Windows categorizes every event with a severity level. The levels in order of severity are information, verbose, warning, error and critical expressed in numbers.	String
LmPackageName	The name of the package or software component that is currently using the Local Security Authority (LSA) on the machine where the event is being generated.	String
LocationInformation	‘Location information’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’:	String
LockoutDuration	‘\Security Settings\Account Policies\Account Lockout Policy\Account lockout duration’ group policy. Numeric value.	String
LockoutObservationWindow	‘\Security Settings\Account Policies\Account Lockout Policy\Reset account lockout counter after’ group policy. Numeric value.	String
LockoutThreshold	‘\Security Settings\Account Policies\Account Lockout Policy\Account lockout threshold’ group policy. Numeric value.	String
LoggingResult	The result of the logon process.	String
LogonGuid	A GUID that can help you correlate this event with another event that can contain the same Logon GUID.	String
LogonHours	Hours that the account is allowed to logon to the domain.	String
LogonID	Hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID.	String
LogonProcessName	The name of registered logon process.	String
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	Int32
LogonTypeName	The type of logon or authentication event that is being captured by the event log (common values:Interactive, Network, RemoteInteractive, Unlock).	String
MachineAccountQuota	ms-DS-MachineAccountQuota domain attribute was modified. Numeric value.	String
MachineInventory	Information about the hardware configuration and software environment of the computer where the event is being generated. It can include different data points, for instance: the make and model of the computer, the amount of RAM or storage space available, the version numbers of various software applications, etc).	String
MachineLogon	Information about a successful logon event in the machine.	String
ManagementGroupName	Additional information based on the resource type.	String
MandatoryLabel	ID of integrity label which was assigned to the new process.	String
MaxPasswordAge	The period of time (in days) that a password can be used before the system requires the user to change it.	String
MemberName	The user account that was involved in the event.	String
MemberSid	The security identifier (SID) associated with the user account that was involved in the event.	String
MinPasswordAge	The period of time (in days) that a password must be used before the system requires the user to change it.	String
MinPasswordLength	The least number of characters that can make up a password for a user account.	String
MixedDomainMode	The domain mode of a system or domain controller.	String
NASIdentifier	The identifier of the network access server (NAS) that was involved in the event.	String
NASIPv4Address	The IPv4Address of the network access server (NAS) that was involved in the event, if applicable.	String
NASIPv6Address	The IPv6Address of the network access server (NAS) that was involved in the event, if applicable.	String
NASPort	the port on the network access server that was used in the event.	String
NASPortType	the type of network access server (NAS) used in the event.	String
NetworkPolicyName	The name of the network policy associated with the event.	String
NewDate	New date in UTC time zone. The format is YYYY-MM-DD.	String
NewMaxUsers	The new maximum number of users allowed for a resource in the event.	String
NewProcessId	Hexadecimal Process ID of the new process. Process ID (PID) is a number used by the operating system to uniquely identify an active process.	String
NewProcessName	Full path and the name of the executable for the new process.	String
NewRemark	The new value of network share ‘Comments:’ field. Has ‘N/A’ value if it isn’t set.	String
NewShareFlags	The share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.	String
NewTime	New time that was set in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ	String
NewUacValue	Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account.	String
NewValue	New value for changed registry key value.	String
NewValueType	New type of changed registry key value.	String
ObjectName	Name of the object that the recorded action was applied to	String
ObjectServer	Contains the name of the Windows subsystem calling the routine.	String
ObjectType	The type of object, such as a file or a folder, that the recorded action was applied to	String
ObjectValueName	The name of modified registry key value.	String
OemInformation	The original equipment manufacturer (OEM) associated with a device or system in the event.	String
OldMaxUsers	The previous maximum number of users allowed for a resource in the event.	String
OldRemark	the old value of network share ‘Comments:’ field. Has ‘N/A’ value if it isn’t set.	String
OldShareFlags	The previous share flags associated with a resource in the event, for instance: information on whether the resource is read-only or read/write, whether it is hidden, and other parameters that can affect access and permissions.	String
OldUacValue	Specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the previous value of userAccountControl attribute of user object.	String
OldValue	Old value for changed registry key value.	String
OldValueType	Old type of changed registry key value.	String
Opcode	The opcode element is defined by the SystemPropertiesType complex type.	String
OperationType	The type of operation which was performed on an object	String
PackageName	The name of the LAN Manager sub-package (NTLM-family protocol name) that was used during logon.	String
ParentProcessName	The name of the parent process	String
PasswordHistoryLength	\Security Settings\Account Policies\Password Policy\Enforce password history” group policy. Numeric value.	String
PasswordLastSet	Last time the account’s password was modified.	String
PasswordProperties	The password policies or properties associated with the event, for example: password length, complexity and expiration date.	String
PreviousDate	The previous date associated with the event.	String
PreviousTime	Previous time in UTC time zone. The format is YYYY-MM-DDThh:mm:ss.nnnnnnnZ.	String
PrimaryGroupId	Relative Identifier (RID) of user’s object primary group.	String
PrivateKeyUsageCount	The number of times a private key has been used.	String
PrivilegeList	The privileges, including user, group, or system privileges associated with the event.	String
Process	The name of the process that generates the event.	String
ProcessId	Process ID (PID) of the newly created process	String
ProcessName	The name of the process	String
ProfilePath	Specifies a path to the account’s profile. This value can be a null string, a local absolute path, or a UNC path.	String
Properties	Depends on Object Type. This field can be empty or contain the list of the object properties that were accessed.	String
ProtocolSequence	Information about the protocol used for an authentication attempt.	String
ProxyPolicyName	Name of the policy that was used to configure the proxy server for connecting to the network.	String
QuarantineHelpURL	URL that provides help with troubleshooting a network quarantine issue.	String
QuarantineSessionID	Identifier of the session where the file was assessed for quarantine.	String
QuarantineSessionIdentifier	Identifier of the session where the file was assessed for quarantine.	String
QuarantineState	It shows whether the file is quarantined.	String
QuarantineSystemHealthResult	Report that shows the status of the files that have been quarantined.	String
RelativeTargetName	Relative name of the accessed target file or folder. This file-path is relative to the network share. If access was requested for the share itself, then this field appears as “\”.	String
RemoteIpAddress	The IP address of the computer that initiated a remote connection.	String
RemotePort	TCP port on the remote device that was being connected to	String
Requester	The event requester identifier.	String
RequestId	Unique identifier of the request	String
RestrictedAdminMode	Only populated for RemoteInteractive logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10.	String
RowsDeleted	The number of rows that were deleted as a part of a particular operation.	String
SamAccountName	logon name for account used to support clients and servers from previous versions of Windows (pre-Windows 2000 logon name).	String
ScriptPath	Specifies the path of the account’s logon script.	String
SecurityDescriptor	Information about the security settings and permissions of a particular object or resource.	String
ServiceAccount	The security context that the service will run as when started.	String
ServiceFileName	Indicates the type of service that was registered with the Service Control Manager.	String
ServiceName	The name of installed service.	String
ServiceStartType	Contains information about how a particular service should be started, whether it should be started automatically or manually.	Int32
ServiceType	Indicates the type of service that was registered with the Service Control Manager.	String
SessionName	The name of the session to which the user was reconnected.	String
ShareLocalPath	The local path of accessed network share.	String
ShareName	Name of shared folder containing the file	String
SidHistory	Contains previous SIDs used for the object if the object was moved from another domain.	String
SourceComputerId	The source computer ID of the activity	String
SourceSystem	The Log Analytics source system. Value is always ‘OpsManager’.	String
Status	Indicator of the profile status - can be Enabled or Disabled	String
StorageAccount	Sets the storage account access key.	String
SubcategoryGuid	The unique GUID of changed subcategory.	String
SubcategoryId	A unique identifier for a specific type of the event.	String
Subject	Subject of the email	String
SubjectAccount	Information about the account that is initiating the event.	String
SubjectDomainName	Information about the domain or workgroup to which the subject account belongs.	String
SubjectKeyIdentifier	A unique identifier for a particular certificate subject.	String
SubjectLogonId	A unique identifier for the logon session associated with the subject account.	String
SubjectMachineName	Information about the machine or system from which the event was created.	String
SubjectMachineSID	The security identifier (SID) for the machine that generated the event.	String
SubjectUserName	The name of the user account that generated the event.	String
SubjectUserSid	The security identifier (SID) for the user account that generated the event.	String
SubStatus	Additional information about logon failure. The most common substatus codes listed in the ‘Table 12. Windows logon status codes’.	String
SystemProcessId	Identifies the process that generated the event.	Int32
SystemThreadId	Identifies the thread that generated the event.	Int32
SystemUserId	The ID of the user who is responsible for the event.	String
TableId	The specific data table identifier the event data is stored in.	String
TargetAccount	The account targeted by the event (user name, computer name, etc).	String
TargetDomainName	Domain name of the device that was targeted or attacked	String
TargetInfo	Additional information about the event target (for example: the path to a file or folder, the name of a registry key, etc).	String
TargetLinkedLogonId	Information that helps to link related events together by their logon attempt IDs. It can be useful in keeping all relevant events organized, tracking activity across multiple sessions, and identifying the attack source.	String
TargetLogonGuid	A globally unique identifier (GUID) associated with the logon session related to the event.	String
TargetLogonId	A unique identifier associated with the logon session related to the event.	String
TargetOutboundDomainName	The domain that the account specified in the TargetAccount field was authenticated against during an outbound authentication attempt.	String
TargetOutboundUserName	The name of the user account that was authenticated during an outbound authentication attempt.	String
TargetServerName	The name of the server on which the new process was run. Has “localhost” value if the process was run locally.	String
TargetSid	The security identifier (SID) of the server on which the new process was run.	String
TargetUser	The user account identifier that generated the new process.	String
TargetUserName	The name of the user account that generated the new process.	String
TargetUserSid	The security identifier (SID) associated with the user or resource involved in the event.	String
Task	The task defined in the event.	Int32
TemplateContent	The content of the event message or notification in a structured form.	String
TemplateDSObjectFQDN	FQDN of the DS object that represents the GPO template.	String
TemplateInternalName	The internal name of the GPO template.	String
TemplateOID	the unique identifier for the template that was used to create the event.	String
TemplateSchemaVersion	Version of the template schema that defines the data to include with an event.	String
TemplateVersion	Version of the template that defines the data to include with an event.	String
TenantId	Unique identifier of the tenant into which the data connector ingests data.	String
TimeGenerated	The time stamp when the event was generated on the computer.	DateTime
TokenElevationType	Type of token that was assigned to a new process in accordance with User Account Control Policy.	String
TransmittedServices	The list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see https://msdn.microsoft.com/library/cc246072.aspx.	String
Type	The certificate’s type. It is one of the following: Machine, Server, Intermediate, Root, TrustedPublisher or Other	String
UserAccountControl	Security attributes of the user account in the AD domain.	String
UserParameters	If you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see <value changed, but not displayed> in this field. For local accounts, this field is not applicable and always has value.	String
UserPrincipalName	Internet-style login name for the account, based on the Internet standard RFC 822. By convention this should map to the account’s email name.	String
UserWorkstations	Contains the list of NetBIOS or DNS names of the computers from which the user can logon. Each computer name is separated by a comma. The name of a computer is the sAMAccountName property of a computer object.	String
VendorIds	‘Hardware Ids’ attribute of device. To see device properties, start Device Manager, open specific device properties, and click ‘Details’.	String
Version	Version of the agent.	Int32
VirtualAccount	A ‘Yes’ or ‘No’ flag, which indicates if the account is a virtual account (e.g., ‘Managed Service Account’), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using ‘NetworkService’.	String
Workstation	The name of the machine that was used to perform the event.	String
WorkstationName	Machine name from which a logon attempt was performed.	String

Schema changes

Date	Action
2026-10-07	Table added to tracking
2026-02-27	Table removed from tracking
2024-10-18	Table added to tracking

Other notes

Parse EventData

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4627 and isnotempty(EventData)
| top 20 by TimeGenerated desc
| extend Parsed = parse_xml(EventData)
| mv-expand Field = Parsed.EventData.Data
| project TimeGenerated, Computer, EventID,
    FieldName = tostring(Field["@Name"]),
    FieldValue = tostring(Field["#text"])

JSON inside directory change XML

In event 5136, AttributeValue can contain JSON text. Select that named field after parsing the XML, then decode its text with parse_json(tostring(Field["#text"])).

Embedded scheduled-task XML

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID in (4698, 4702) and isnotempty(EventData)
| top 20 by TimeGenerated desc
| extend Parsed = parse_xml(EventData)
| mv-expand Field = Parsed.EventData.Data
| where tostring(Field["@Name"]) in ("TaskContent", "TaskContentNew")
| project TimeGenerated, Computer, EventID,
    TaskField = tostring(Field["@Name"]),
    ParsedTask = parse_xml(tostring(Field["#text"]))

Known observations

Value casing varies

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.