logpoint_windows_sysmon_variable_mappings = {
    "Image": (
        ("category", "process_creation", "process"),
        ("category", "network_connection", "process"),
        ("category", "process_termination", "process"),
        ("category", "raw_access_read", "process"),
        ("category", "image_load", "process"),
        ("category", "file_event", "process"),
        ("category", "registry_delete", "process"),
        ("category", "registry_add", "process"),
        ("category", "registry_set", "process"),
        ("category", "registry_rename", "process"),
        ("category", "registry_event", "process"),
        ("category", "dns_query", "process"),
        ("category", "file_delete", "process"),
        ("category", "clipboard_capture", "process"),
        ("category", "process_tampering", "process"),
        ("category", "file_block", "process"),

        ("category", "file_change", "source_image"),
        ("category", "create_stream_hash", "source_image"),
        ("category", "pipe_created", "source_image"),
    ),
    "ImageLoaded": (
        ("category", "driver_load", "image"),
        ("category", "image_load", "image")
    ),
    "SourceImage": (
        ("category", "process_access", "process"),
        ("category", "create_remote_thread", "process"),
    ),
    "TargetImage": (
        ("category", "process_access", "image"),
        ("category", "create_remote_thread", "image"),
    )
}

logpoint_windows_sysmon_mapping = {
    'AccountName': 'user',
    'AccountType': 'account_type',
    'ActivityID': 'activity_id',
    'Category': 'event_category',
    'CategoryId': 'category_id',
    'ClientAddress': 'source_address',
    'ClientIP': 'source_address',
    'ClientUserName': 'user',
    'CommandLine': 'command',
    'Company': 'vendor',
    'Conditions': 'condition',
    'CreationUtcTime': 'creation_ts',
    'DestAddress': 'destination_address',
    'DestPort': 'destination_port',
    'DestinationHostname': 'destination_host',
    'DestinationIp': 'destination_address',
    'DestinationIsIpv6': 'destination_is_ipv6',
    'DestinationPort': 'destination_port',
    'Details': 'detail',
    'DomainName': 'domain',
    'EngineVersion': 'engine_version',
    'ErrorCode': 'error_code',
    'Event': 'event',
    'Archived': 'is_archived',
    'CommandLine': 'command',
    'Company': 'vendor',
    'Configuration': 'file',
    'CreationUtcTime': 'creation_ts',
    'CurrentDirectory': 'path',
    'Description': 'message',
    'DestinationHostname': 'destination_host',
    'DestinationIp': 'destination_address',
    'DestinationIsIpv6': 'is_destination_ipv6',
    'DestinationPort': 'destination_port',
    'DestinationPortName': 'destination_service',
    'EventType': 'event_type',
    'FileVersion': 'file_version',
    'Image': 'image',
    'Initiated': 'is_initiated',
    'IntegrityLevel': 'integrity_level',
    'IsExecutable': 'is_executable',
    'LogonGuid': 'logon_guid',
    'LogonId': 'logon_id',
    'OriginalFileName': 'file',
    'ParentCommandLine': 'parent_command',
    'ParentImage': 'parent_process',
    'ParentProcessGuid': 'parent_process_guid',
    'ParentProcessId': 'parent_process_id',
    'ParentUser': 'parent_user',
    'ProcessGuid': 'process_guid',
    'ProcessId': 'process_id',
    'Product': 'application',
    'Protocol': 'protocol',
    'RuleName': 'rule',
    'SchemaVersion': 'schema_version',
    'SourceHostname': 'source_host',
    'SourceIp': 'source_address',
    'SourceIsIpv6': 'is_source_ipv6',
    'SourcePort': 'source_port',
    'SourcePortName': 'source_service',
    'State': 'state',
    'TargetFilename': 'target_file',
    'TargetObject': 'target_object',
    'TerminalSessionId': 'session_id',
    'User': 'user',
    'UtcTime': 'utc_ts',
    'Version': 'version',
    'EventID': 'event_id',
    'EventReceivedTime': 'event_ts',
    'EventTime': 'log_ts',
    'EventType': 'event_type',
    'ExecutionProcessID': 'execution_process_id',
    'ExecutionThreadID': 'execution_thread_id',
    'FailureReason': 'reason',
    'FileVersion': 'file_version',
    'HostApplication': 'application',
    'HostId': 'host_id',
    'Hostname': 'host',
    'IsExecutable': 'is_executable',
    'KeyLength': 'key_length',
    'Keywords': 'keyword',
    'LogonGuid': 'logon_guid',
    'LogonID': 'logon_id',
    'LogonId': 'logon_id',
    'ObjectName': 'object',
    'OpcodeValue': 'opcode_value',
    'OriginalFileName': 'file',
    'PackageName': 'package',
    'ParentProcessGuid': 'parent_process_guid',
    'ParentProcessId': 'parent_process_id',
    'PreviousCreationUtcTime': 'previous_creation_ts',
    'ProcessGuid': 'process_guid',
    'ProcessID': 'process_id',
    'ProcessId': 'process_id',
    'ProcessName': 'process',
    'ProviderGuid': 'guid',
    'ProviderKey': 'provider_key',
    'ProviderName': 'provider',
    'QueryName': 'query',
    'QueryResults': 'result',
    'RecordNumber': 'record',
    'RequestType': 'request_type',
    'ResourceManager': 'resource_manager',
    'RuleAttr': 'rule_attribute',
    'RuleId': 'rule_id',
    'RuleName': 'rule',
    'SequenceNumber': 'sequence_number',
    'ServiceName': 'service',
    'ServicePrincipalNames': 'service_principal_name',
    'ServiceSid': 'service_id',
    'SessionId': 'session_id',
    'SessionName': 'session',
    'Severity': 'log_level',
    'SeverityValue': 'severity',
    'SourceAddress': 'source_address',
    'SourceHostname': 'source_host',
    'SourceImage': 'source_image',
    'SourceIp': 'source_address',
    'SourceIsIpv6': 'source_is_ipv6',
    'SourceModuleName': 'source_module',
    'SourceModuleType': 'source_module_type',
    'SourceName': 'event_source',
    'SourcePort': 'source_port',
    'SourceProcessGUID': 'source_process_guid',
    'SourceProcessId': 'source_process_id',
    'SourceThreadId': 'source_thread_id',
    'SourceUser': 'source_user',
    'System_Channel': 'channel',
    'System_Computer': 'host',
    'System_EventID': 'event_id',
    'System_EventRecordID': 'record_id',
    'System_Execution_ProcessID': 'execution_process_id',
    'System_Execution_ThreadID': 'execution_thread_id',
    'System_Keywords': 'keyword',
    'System_Level': 'severity',
    'System_Opcode': 'opcode',
    'System_Provider_Guid': 'guid',
    'System_Provider_Name': 'event_source',
    'System_Security_UserID': 'user_id',
    'System_Security_UserId': 'user_id',
    'System_Task': 'task_value',
    'System_TimeCreated_SystemTime': 'event_ts',
    'System_Version': 'version',
    'TargetProcessGUID': 'target_process_guid',
    'TargetProcessId': 'target_process_id',
    'TargetUser': 'target_user',
    'TaskValue': 'task_value',
    'ThreadID': 'thread_id',
    'UrlAbsolutePath': 'path',
    'UserAgent': 'user_agent',
    'UserID': 'user_id',
    'UserId': 'user_id',
    'UtcTime': 'utc_ts',
    'client_request_id': 'request_id',
    'GrantedAccess': 'access',
    'Hash': 'hashes'
}

logpoint_windows_security_audit_mapping = {
    4610: {'AuthenticationPackageName': 'package'},
    4611: {'LogonProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4614: {'NotificationPackageName': 'package'},
    4616: {'NewTime': 'new_ts',
           'PreviousTime': 'old_ts',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4622: {'SecurityPackageName': 'package'},
    4624: {'AuthenticationPackageName': 'package',
           'ElevatedToken': 'elevated_token',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'ImpersonationLevel': 'impersonation_level',
           'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'LmPackageName': 'lm_package',
           'LogonGuid': 'logon_guid',
           'LogonProcessName': 'logon_process',
           'LogonType': 'logon_type',
           'ProcessId': 'process_id',
           'ProcessName': 'process',
           'SubjectDomainName': 'caller_domain',
           'SubjectLogonId': 'caller_logon_id',
           'SubjectUserName': 'caller_user',
           'SubjectUserSid': 'caller_id',
           'TargetDomainName': 'domain',
           'TargetLinkedLogonId': 'target_linked_logon_id',
           'TargetLogonId': 'logon_id',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id',
           'TaskValue': 'task_value',
           'TransmittedServices': 'transmitted_service',
           'VirtualAccount': 'virtual_account'},
    4625: {'AuthenticationPackageName': 'package',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'FailureReason': 'reason',
           'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'LmPackageName': 'lm_package',
           'LogonProcessName': 'logon_process',
           'LogonType': 'logon_type',
           'ProcessId': 'process_id',
           'ProcessName': 'process',
           'Status': 'status_code',
           'SubStatus': 'sub_status_code',
           'SubjectDomainName': 'caller_domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'caller_user',
           'SubjectUserSid': 'caller_id',
           'TargetDomainName': 'domain',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id',
           'TransmittedServices': 'transmitted_service'},
    4627: {'EventCountTotal': 'event_count',
           'EventIdx': 'event_idx',
           'GroupMembership': 'group_membership',
           'LogonType': 'logon_type',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'caller_logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'domain',
           'TargetLogonId': 'logon_id',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id'},
    4634: {'LogonType': 'logon_type',
           'TargetDomainName': 'domain',
           'TargetLogonId': 'logon_id',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id'},
    4647: {'TargetDomainName': 'domain',
           'TargetLogonId': 'logon_id',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id'},
    4648: {'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'LogonGuid': 'logon_guid',
           'ProcessName': 'process',
           'SubjectDomainName': 'caller_domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'caller_user',
           'SubjectUserSid': 'caller_id',
           'TargetDomainName': 'domain',
           'TargetInfo': 'information',
           'TargetLogonGuid': 'logon_guid',
           'TargetServerName': 'server',
           'TargetUserName': 'user'},
    4653: {'EventReceivedTime': 'event_ts',
           'FailurePoint': 'failure_point',
           'FailureReason': 'reason',
           'InitiatorCookie': 'initiator_cookie',
           'KeyModName': 'module_name',
           'Keywords': 'keyword',
           'LocalAddress': 'source_address',
           'LocalKeyModPort': 'source_port',
           'LocalMMPrincipalName': 'local_principal_name',
           'MMAuthMethod': 'authentication_method',
           'MMFilterID': 'filter_id',
           'MMImpersonationState': 'impersonation_state',
           'RemoteAddress': 'destination_address',
           'RemoteKeyModPort': 'destination_port',
           'RemoteMMPrincipalName': 'remote_principal_name',
           'ResponderCookie': 'responder_cookie',
           'Role': 'role',
           'State': 'state',
           'Task': 'task'},
    4656: {'AccessList': 'access',
           'AccessMask': 'access_mask',
           'AccessReason': 'reason',
           'HandleId': 'handle_id',
           'ObjectName': 'object_name',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'PrivilegeList': 'privilege',
           'ProcessName': 'process',
           'RestrictedSidCount': 'restricted_id_count',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TransactionId': 'transaction_id'},
    4657: {'HandleId': 'handle_id',
           'NewValue': 'new_value',
           'NewValueType': 'new_value_type',
           'ObjectName': 'object_name',
           'ObjectValueName': 'object_value',
           'OldValue': 'old_value',
           'OldValueType': 'old_value_type',
           'OperationType': 'operation_type',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4658: {'HandleId': 'handle_id',
           'ObjectServer': 'object_server',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4659: {'AccessList': 'access',
           'AccessMask': 'access_mask',
           'HandleId': 'handle_id',
           'ObjectName': 'object_name',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TransactionId': 'transaction_id'},
    4660: {'HandleId': 'handle_id',
           'ObjectServer': 'object_server',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TransactionId': 'transaction_id'},
    4661: {'AccessList': 'access',
           'AccessMask': 'access_mask',
           'AccessReason': 'reason',
           'HandleId': 'handle_id',
           'ObjectName': 'object',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'PrivilegeList': 'privilege',
           'ProcessName': 'process',
           'Properties': 'properties',
           'RestrictedSidCount': 'restricted_id_count',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TransactionId': 'transaction_id'},
    4662: {'AccessList': 'access',
           'AccessMask': 'access_mask',
           'AdditionalInfo': 'additional_information',
           'AdditionalInfo2': 'additional_information_2',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'HandleId': 'handle_id',
           'ObjectName': 'object_name',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'OperationType': 'operation_type',
           'Properties': 'properties',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TaskValue': 'task_value'},
    4663: {'AccessList': 'access',
           'AccessMask': 'access_mask',
           'HandleId': 'handle_id',
           'ObjectName': 'object_name',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'ProcessName': 'process',
           'ResourceAttributes': 'attributes',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4664: {'FileName': 'file',
           'LinkName': 'link',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TransactionId': 'transaction_id'},
    4670: {'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'HandleId': 'handle_id',
           'NewSD': 'new_sd',
           'NewSd': 'new_sd',
           'ObjectName': 'object_name',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'OldSD': 'old_sd',
           'OldSd': 'old_sd',
           'ProcessId': 'process_id',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TaskValue': 'task_value'},
    4672: {'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4673: {'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'ObjectServer': 'object_server',
           'PrivilegeList': 'privilege',
           'ProcessId': 'process_id',
           'ProcessName': 'process',
           'Service': 'service',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TaskValue': 'task_value'},
    4674: {'AccessMask': 'access_mask',
           'HandleId': 'handle_id',
           'ObjectName': 'object',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'PrivilegeList': 'privilege',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4675: {'SidList': 'id_list',
           'TargetDomainName': 'domain',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id',
           'TdoAttributes': 'trust_attribute',
           'TdoDirection': 'trust_direction',
           'TdoSid': 'trust_id',
           'TdoType': 'trust_type'},
    4688: {'Creator_Process_ID': 'parent_process_id',
           'MandatoryLabel': 'integrity_sid',
           'NewProcessId': 'target_process_id',
           'NewProcessName': 'process',
           'New_Process_Name': 'process',
           'Process_Command_Line': 'command',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetLogonId': 'target_logon_id',
           'TargetUserName': 'target_user',
           'TargetUserSid': 'target_id',
           'TokenElevationType': 'token_elevation_type'},
    4689: {'ProcessName': 'process',
           'Status': 'status_code',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4690: {'SourceHandleId': 'handle_id',
           'SourceProcessId': 'source_process_id',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetHandleId': 'new_handle_id',
           'TargetProcessId': 'target_process_id'},
    4692: {'EventReceivedTime': 'event_ts',
           'FailureReason': 'reason',
           'Keywords': 'keyword',
           'MasterKeyId': 'master_key_id',
           'RecoveryKeyId': 'recover_id',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'Task': 'task'},
    4695: {'CryptoAlgorithms': 'cipher',
           'DataDescription': 'data_description',
           'FailureReason': 'reason',
           'MasterKeyId': 'master_key_id',
           'ProtectedDataFlags': 'protected_data_flag',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4697: {'ServiceAccount': 'service_account',
           'ServiceFileName': 'file',
           'ServiceName': 'service',
           'ServiceStartType': 'start_type',
           'ServiceType': 'object_type',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4698: {'RandomDelay': 'random_delay',
           'Source': 'source',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'SubjectUserSidName': 'subject_user_id',
           'TaskContent': 'task_content',
           'TaskName': 'task',
           'WeeksInterval': 'weeks_interval'},
    4699: {'DisallowStartIfOnBatteries': 'disallow_start_if_on_batteries',
           'ExecutionTimeLimit': 'execution_time_limit',
           'LogonType': 'logon_type',
           'RestartOnIdle': 'restart_on_idle',
           'RunLevel': 'run_level',
           'RunOnlyIfIdle': 'run_only_if_idle',
           'StartBoundary': 'start_boundry',
           'StopIfGoingOnBatteries': 'stop_if_going_on_batteries',
           'StopOnIdleEnd': 'stop_on_idle_end',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TaskContent': 'task_content',
           'TaskName': 'task',
           'UserId': 'target_user',
           'WaitTimeout': 'wait_timeout',
           'WakeToRun': 'wake_to_run'},
    4700: {'AllowHardTerminate': 'allow_hard_terminate',
           'AllowStartOnDemand': 'allow_start_on_demand',
           'ClassId': 'class_id',
           'DisallowStartIfOnBatteries': 'disallow_start_if_on_batteries',
           'DisallowStartOnRemoteAppSession': 'disallow_start_on_remote_app_session',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'ExecutionTimeLimit': 'execution_time_limit',
           'GroupId': 'group_id',
           'MultipleInstancesPolicy': 'multiple_instances_policy',
           'RestartOnIdle': 'restart_on_idle',
           'RunOnlyIfIdle': 'run_only_if_idle',
           'RunOnlyIfNetworkAvailable': 'run_only_if_network_available',
           'SecurityDescriptor': 'sd',
           'Source': 'source',
           'StopIfGoingOnBatteries': 'stop_if_going_on_batteries',
           'StopOnIdleEnd': 'stop_on_idle_end',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TaskContent': 'content',
           'TaskName': 'task',
           'TaskValue': 'task_value',
           'URI': 'url',
           'UseUnifiedSchedulingEngine': 'use_unified_scheduling_engine',
           'UserId': 'user_id',
           'WakeToRun': 'wake_to_run'},
    4701: {'AllowHardTerminate': 'allow_hard_terminate',
           'AllowStartOnDemand': 'allow_start_on_demand',
           'Author': 'author',
           'ClassId': 'class_id',
           'ComHandler': 'com_handler',
           'Count': 'count',
           'Data': 'data',
           'Description': 'description',
           'DisallowStartIfOnBatteries': 'disallow_start_on_Batteries',
           'DisallowStartOnRemoteAppSession': 'disallow_start_on_remote_session',
           'Enabled': 'enabled',
           'EventTrigger': 'event_trigger',
           'ExecutionTimeLimit': 'execution_time_limit',
           'Hidden': 'hidden',
           'Interval': 'interval',
           'MultipleInstancesPolicy': 'multiple_instance_policy',
           'Principal': 'principle',
           'Priority': 'priority',
           'RestartOnFailure': 'restart_on_failure',
           'RunOnlyIfIdle': 'run_only_if_idle',
           'RunOnlyIfNetworkAvailable': 'run_only_if_network_available',
           'SecurityDescriptor': 'sd',
           'Source': 'source',
           'StopIfGoingOnBatteries': 'stop_if_going_on_batteries',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'Subscription': 'subscription',
           'TaskContent': 'task_content',
           'TaskName': 'task',
           'URI': 'url',
           'UseUnifiedSchedulingEngine': 'user_unified_scheduling_engine',
           'UserId': 'user_id',
           'WakeToRun': 'wake_to_run'},
    4702: {'AllowHardTerminate': 'allow_hard_terminate',
           'AllowStartOnDemand': 'allow_start_on_demand',
           'Category': 'event_category',
           'ClassId': 'class_id',
           'DaysInterval': 'days_interval',
           'DisallowStartIfOnBatteries': 'disallow_start_if_on_batteries',
           'DisallowStartOnRemoteAppSession': 'disallow_start_on_remote_app_session',
           'ExecutionTimeLimit': 'execution_time_limit',
           'Hidden': 'hidden',
           'LogonType': 'logon_type',
           'MultipleInstancesPolicy': 'multiple_instance_policy',
           'RandomDelay': 'random_delay',
           'RestartOnIdle': 'restart_on_idle',
           'RunLevel': 'run_level',
           'RunOnlyIfIdle': 'run_only_if_idle',
           'RunOnlyIfNetworkAvailable': 'run_only_if_network_available',
           'SecurityDescriptor': 'sd',
           'Source': 'source',
           'StartBoundary': 'start_boundry',
           'StartWhenAvailable': 'start_when_available',
           'StopIfGoingOnBatteries': 'stop_if_going_on_batteries',
           'StopOnIdleEnd': 'stop_on_idle_end',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'Task': 'task',
           'TaskContentNew': 'content',
           'TaskName': 'task',
           'URI': 'url',
           'UseUnifiedSchedulingEngine': 'use_unified_scheduling_engine',
           'UserId': 'user_id',
           'WaitTimeout': 'wait_timeout',
           'WakeToRun': 'wake_to_run',
           'file_extension': 'file_type'},
    4703: {'DisabledPrivilegeList': 'disabled_privilege_list',
           'EnabledPrivilegeList': 'enabled_privilege_list',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'caller_logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'domain',
           'TargetLogonId': 'logon_id',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id'},
    4704: {'PrivilegeList': 'privilege',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user'},
    4705: {'PrivilegeList': 'privilege',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user'},
    4713: {'KerberosPolicyChange': 'policy',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4714: {'EventReceivedTime': 'event_ts', 'Keywords': 'keyword', 'Task': 'task'},
    4716: {'DomainName': 'domain',
           'DomainSid': 'domain_id',
           'SidFilteringEnabled': 'sid_filtering_enabled',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'caller_domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TdoAttributes': 'tdo_attributes',
           'TdoDirection': 'tdo_direction',
           'TdoType': 'tdo_type'},
    4717: {'AccessGranted': 'privilege',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user',
           'TaskValue': 'task_value'},
    4718: {'AccessRemoved': 'privilege',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id ',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'caller_id',
           'TargetSid': 'target_id'},
    4719: {'AuditPolicyChanges': 'policy',
           'CategoryId': 'category',
           'SubcategoryGuid': 'sub_category_guid',
           'SubcategoryId': 'sub_category',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4720: {'AccountExpires': 'account_expire',
           'AllowedToDelegateTo': 'allowed_to_delegate',
           'DisplayName': 'display_name',
           'HomeDirectory': 'home_directory',
           'HomePath': 'home_path',
           'LogonHours': 'logon_hour',
           'NewUacValue': 'new_value',
           'OldUacValue': 'old_value',
           'PasswordLastSet': 'password_last_set_ts',
           'PrimaryGroupId': 'group_id',
           'PrivilegeList': 'privilege',
           'ProfilePath': 'path',
           'SamAccountName': 'sam_account_name',
           'ScriptPath': 'script_path',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user',
           'UserAccountControl': 'user_account_control',
           'UserParameters': 'parameter',
           'UserPrincipalName': 'user_principal_name',
           'UserWorkstations': 'workstation'},
    4722: {'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user'},
    4723: {'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user'},
    4724: {'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user'},
    4725: {'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user'},
    4726: {'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user',
           'TaskValue': 'task_value'},
    4727: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4728: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4729: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4730: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4731: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4732: {'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group',
           'TaskValue': 'task_value'},
    4733: {'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4734: {'GroupTypeChange': 'group_type',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4735: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4737: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4738: {'AccountExpires': 'account_expire',
           'AllowedToDelegateTo': 'allowed_to_delegate',
           'DisplayName': 'display_name',
           'Dummy': 'dummy',
           'HomeDirectory': 'home_directory',
           'HomePath': 'home_path',
           'LogonHours': 'logon_hour',
           'NewUacValue': 'new_value',
           'OldUacValue': 'old_value',
           'PasswordLastSet': 'password_last_set_ts',
           'PrimaryGroupId': 'group_id',
           'PrivilegeList': 'privilege',
           'ProfilePath': 'path',
           'SamAccountName': 'sam_account_name',
           'ScriptPath': 'script_path',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user',
           'UserAccountControl': 'user_account_control',
           'UserParameters': 'parameter',
           'UserPrincipalName': 'user_principal_name',
           'UserWorkstations': 'workstation'},
    4739: {'DomainBehaviorVersion': 'domain_behavior_version',
           'DomainName': 'domain',
           'DomainPolicyChanged': 'policy',
           'DomainSid': 'domain_id',
           'ForceLogoff': 'force_logoff',
           'LockoutDuration': 'lockout_duration',
           'LockoutObservationWindow': 'observation_window',
           'LockoutThreshold': 'lockout_threshold',
           'MachineAccountQuota': 'account_quota',
           'MaxPasswordAge': 'max_password_age',
           'MinPasswordAge': 'min_password_age',
           'MinPasswordLength': 'min_password_length',
           'MixedDomainMode': 'mixed_domain_mode',
           'OemInformation': 'oem_information',
           'PasswordHistoryLength': 'password_history_length',
           'PasswordProperties': 'properties',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'caller_domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4740: {'SubjectDomainName': 'caller_domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'caller_user',
           'SubjectUserSid': 'caller_id',
           'TargetDomainName': 'workstation',
           'TargetSid': 'user_id',
           'TargetUserName': 'user'},
    4741: {'AccountExpires': 'account_expire',
           'AllowedToDelegateTo': 'allowed_to_delegate',
           'DisplayName': 'display_name',
           'DnsHostName': 'dns_host',
           'HomeDirectory': 'home_directory',
           'HomePath': 'home_path',
           'LogonHours': 'logon_hour',
           'NewUacValue': 'new_value',
           'OldUacValue': 'old_value',
           'PasswordLastSet': 'password_last_set_ts',
           'PrimaryGroupId': 'group_id',
           'PrivilegeList': 'privilege',
           'ProfilePath': 'path',
           'SamAccountName': 'sam_account_name',
           'ScriptPath': 'script_path',
           'ServicePrincipalNames': 'service',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'computer_domain',
           'TargetSid': 'computer_id',
           'TargetUserName': 'computer',
           'UserAccountControl': 'user_account_control',
           'UserParameters': 'parameter',
           'UserPrincipalName': 'user_principal_name',
           'UserWorkstations': 'workstation'},
    4742: {'AccountExpires': 'account_expire',
           'AllowedToDelegateTo': 'allowed_to_delegate',
           'ComputerAccountChange': 'computer_account_change',
           'DisplayName': 'display_name',
           'DnsHostName': 'dns_host',
           'HomeDirectory': 'home_directory',
           'HomePath': 'home_path',
           'LogonHours': 'logon_hour',
           'NewUacValue': 'new_value',
           'OldUacValue': 'old_value',
           'PasswordLastSet': 'password_last_set_ts',
           'PrimaryGroupId': 'group_id',
           'PrivilegeList': 'privilege',
           'ProfilePath': 'path',
           'SamAccountName': 'sam_account_name',
           'ScriptPath': 'script_path',
           'ServicePrincipalNames': 'service',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'computer_domain',
           'TargetSid': 'computer_id',
           'TargetUserName': 'computer',
           'UserAccountControl': 'user_account_control',
           'UserParameters': 'parameter',
           'UserPrincipalName': 'user_principal_name',
           'UserWorkstations': 'workstation'},
    4743: {'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'computer_domain',
           'TargetSid': 'computer_id',
           'TargetUserName': 'computer'},
    4744: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4745: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4746: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4747: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4748: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4749: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4750: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4751: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4752: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4753: {'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4754: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4755: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4756: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4757: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4758: {'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4759: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4760: {'PrivilegeList': 'privilege',
           'SamAccountName': 'sam_account_name',
           'SidHistory': 'sid_history',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4761: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4762: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4763: {'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4764: {'GroupTypeChange': 'group_type',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4767: {'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user'},
    4768: {'CertIssuerName': 'certificate_issuer',
           'CertSerialNumber': 'certificate_serial_number',
           'CertThumbprint': 'certificate_hash',
           'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'PreAuthType': 'pre_authentication_type',
           'ServiceName': 'service',
           'ServiceSid': 'service_id',
           'Status': 'status_code',
           'TargetDomainName': 'domain',
           'TargetSid': 'user_id',
           'TargetUserName': 'user',
           'TicketEncryptionType': 'encryption_type',
           'TicketOptions': 'ticket_option'},
    4769: {'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'LogonGuid': 'logon_guid',
           'ServiceName': 'service',
           'ServiceSid': 'service_id',
           'Status': 'status_code',
           'TargetDomainName': 'domain',
           'TargetUserName': 'user',
           'TicketEncryptionType': 'encryption_type',
           'TicketOptions': 'ticket_option',
           'TransmittedServices': 'transmitted_service'},
    4770: {'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'ServiceName': 'service',
           'ServiceSid': 'service_id',
           'TargetDomainName': 'domain',
           'TargetUserName': 'user',
           'TicketEncryptionType': 'encryption_type',
           'TicketOptions': 'ticket_option'},
    4771: {'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'PreAuthType': 'pre_authentication_type',
           'ServiceName': 'service',
           'Status': 'status_code',
           'TargetSid': 'user_id',
           'TargetUserName': 'user',
           'TicketOptions': 'ticket_option'},
    4774: {'ClientUserName': 'user',
           'MappedName': 'mapped_name',
           'MappingBy': 'mapping_by',
           'SourceModuleName': 'source_module',
           'Version': 'version'},
    4776: {'PackageName': 'package',
           'Status': 'status_code',
           'TargetUserName': 'user',
           'Workstation': 'workstation'},
    4778: {'AccountDomain': 'domain',
           'AccountName': 'user',
           'ClientAddress': 'source_address',
           'ClientName': 'workstation',
           'LogonID': 'logon_id',
           'SessionName': 'session'},
    4779: {'AccountDomain': 'domain',
           'AccountName': 'user',
           'ClientAddress': 'source_address',
           'ClientName': 'workstation',
           'LogonID': 'logon_id',
           'SessionName': 'session'},
    4780: {'PrivilegeList': 'privilege',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'domain',
           'TargetSid': 'target_id',
           'TargetUserName': 'target_user',
           'Version': 'version'},
    4781: {'NewTargetUserName': 'new_user',
           'OldTargetUserName': 'target_user',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'target_domain',
           'TargetSid': 'target_id'},
    4785: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4786: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4787: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4788: {'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4793: {'EventReceivedTime': 'event_ts',
           'Keywords': 'keyword',
           'Status': 'status_code',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetUserName': 'target_user',
           'Task': 'task',
           'Workstation': 'workstation'},
    4798: {'CallerProcessId': 'process_id',
           'CallerProcessName': 'process',
           'MemberSid': 'target_id',
           'PrivilegeList': 'privilege',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4799: {'CallerProcessId': 'process_id',
           'CallerProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetDomainName': 'group_domain',
           'TargetSid': 'group_id',
           'TargetUserName': 'group'},
    4800: {'SessionId': 'session_id',
           'TargetDomainName': 'domain',
           'TargetLogonId': 'logon_id',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id'},
    4801: {'SessionId': 'session_id',
           'TargetDomainName': 'domain',
           'TargetLogonId': 'logon_id',
           'TargetUserName': 'user',
           'TargetUserSid': 'user_id'},
    4817: {'NewSD': 'new_sd',
           'NewSd': 'new_sd',
           'ObjectName': 'object_name',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'OldSD': 'old_sd',
           'OldSd': 'old_sd',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4902: {'PuaCount': 'pua_count', 'PuaPolicyId': 'policy_id'},
    4904: {'AuditSourceName': 'audit_source',
           'EventSourceId': 'source_id',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4905: {'AuditSourceName': 'audit_source',
           'EventSourceId': 'source_id',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4907: {'HandleId': 'handle_id',
           'NewSD': 'new_sd',
           'NewSd': 'new_sd',
           'ObjectName': 'object_name',
           'ObjectServer': 'object_server',
           'ObjectType': 'object_type',
           'OldSD': 'old_sd',
           'OldSd': 'old_sd',
           'ProcessName': 'process',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    4912: {'AuditPolicyChanges': 'policy',
           'CategoryId': 'category_id',
           'SourceModuleName': 'source_module',
           'SubcategoryGuid': 'sub_category_guid',
           'SubcategoryId': 'sub_category',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TargetUserSid': 'target_id'},
    4928: {'DestinationDRA': 'destination_dra',
           'EventReceivedTime': 'event_ts',
           'Keywords': 'keyword',
           'NamingContext': 'naming_context',
           'Options': 'options',
           'SourceAddr': 'workstation',
           'SourceDRA': 'source_dra',
           'StatusCode': 'status_code',
           'Task': 'task'},
    4929: {'DestinationDRA': 'destination_dra',
           'EventReceivedTime': 'event_ts',
           'Keywords': 'keyword',
           'NamingContext': 'naming_context',
           'Options': 'options',
           'SourceAddr': 'workstation',
           'SourceDRA': 'source_dra',
           'StatusCode': 'status_code',
           'Task': 'task'},
    4930: {'DestinationDRA': 'destination_dra',
           'EventReceivedTime': 'event_ts',
           'Keywords': 'keyword',
           'NamingContext': 'naming_context',
           'Options': 'options',
           'SourceAddr': 'workstation',
           'SourceDRA': 'source_dra',
           'StatusCode': 'status_code',
           'Task': 'task'},
    4931: {'DestinationDRA': 'destination_dra',
           'NamingContext': 'naming_context',
           'Options': 'options',
           'SourceAddr': 'source_address',
           'SourceDRA': 'source_dra',
           'SourceModuleName': 'source_module',
           'StatusCode': 'status_code',
           'Version': 'version'},
    4932: {'DestinationDRA': 'destination_dra',
           'NamingContext': 'naming_context',
           'Options': 'options',
           'SessionID': 'session_id',
           'SourceDRA': 'source_dra',
           'SourceModuleName': 'source_module',
           'StartUSN': 'start_user_sequence_number',
           'Version': 'version'},
    4933: {'DestinationDRA': 'destination_dra',
           'EndUSN': 'end_user_sequence_number',
           'NamingContext': 'naming_context',
           'Options': 'options',
           'SessionID': 'session_id',
           'SourceDRA': 'source_dra',
           'SourceModuleName': 'source_module',
           'StatusCode': 'status_code',
           'Version': 'version'},
    4944: {'GroupPolicyApplied': 'policy',
           'LogDroppedPacketsEnabled': 'log_dropped_packet',
           'LogSuccessfulConnectionsEnabled': 'log_successful_connection',
           'MulticastFlowsEnabled': 'multicast_flow',
           'OperationMode': 'operation_mode',
           'Profile': 'profile',
           'RemoteAdminEnabled': 'remote_administration'},
    4945: {'ProfileUsed': 'profile', 'RuleId': 'rule_id', 'RuleName': 'rule'},
    4946: {'ProfileChanged': 'profile', 'RuleId': 'rule_id', 'RuleName': 'rule'},
    4947: {'ProfileChanged': 'profile', 'RuleId': 'rule_id', 'RuleName': 'rule'},
    4948: {'ProfileChanged': 'profile', 'RuleId': 'rule_id', 'RuleName': 'rule'},
    4950: {'ProfileChanged': 'profile',
           'SettingType': 'setting_type',
           'SettingValue': 'setting_value'},
    4953: {'EventReceivedTime': 'event_ts',
           'Keywords': 'keyword',
           'Profile': 'profile',
           'ReasonForRejection': 'reason',
           'RuleId': 'rule_id',
           'RuleName': 'rule',
           'Task': 'task'},
    4956: {'ActiveProfile': 'profile'},
    4957: {'RuleAttr': 'attribute', 'RuleId': 'rule_id', 'RuleName': 'rule'},
    4985: {'NewState': 'new_value',
           'ProcessName': 'process',
           'ResourceManager': 'resource_manager',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TransactionId': 'transaction_id'},
    5031: {'Application': 'application', 'Profiles': 'profile'},
    5038: {'EventReceivedTime': 'event_ts',
           'Keywords': 'keyword',
           'Task': 'task',
           'param1': 'file'},
    5056: {'EventReceivedTime': 'event_ts',
           'Keywords': 'keyword',
           'Module': 'module',
           'ReturnCode': 'status_code',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'Task': 'task'},
    5058: {'AlgorithmName': 'cipher',
           'KeyFilePath': 'path',
           'KeyName': 'key',
           'KeyType': 'key_type',
           'Operation': 'action',
           'ProviderName': 'provider',
           'ReturnCode': 'status_code',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5059: {'AlgorithmName': 'cipher',
           'KeyName': 'key',
           'KeyType': 'key_type',
           'Operation': 'action',
           'ProviderName': 'provider',
           'ReturnCode': 'status_code',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5061: {'AlgorithmName': 'cipher',
           'KeyName': 'key',
           'KeyType': 'key_type',
           'Operation': 'action',
           'ProviderName': 'provider',
           'ReturnCode': 'status_code',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5136: {'AppCorrelationID': 'application_id',
           'AttributeLDAPDisplayName': 'ldap_display',
           'AttributeSyntaxOID': 'attribute_id',
           'AttributeValue': 'attribute_value',
           'DSName': 'service',
           'DSType': 'service_type',
           'ObjectClass': 'class',
           'ObjectDN': 'object',
           'ObjectGUID': 'service_guid',
           'OpCorrelationID': 'operation_id',
           'OperationType': 'operation_type',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5137: {'AppCorrelationID': 'application_id',
           'DSName': 'service',
           'DSType': 'service_type',
           'ObjectClass': 'class',
           'ObjectDN': 'object',
           'ObjectGUID': 'service_guid',
           'OpCorrelationID': 'operation_id',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5139: {'AppCorrelationID': 'application_id',
           'DSName': 'service',
           'DSType': 'service_type',
           'NewObjectDN': 'new_object',
           'ObjectClass': 'class',
           'ObjectGUID': 'object_guid',
           'OldObjectDN': 'object',
           'OpCorrelationID': 'operation_id',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5140: {'AccessList': 'access',
           'AccessMask': 'access_mask',
           'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'ObjectType': 'object_type',
           'ShareName': 'share_name',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5141: {'AppCorrelationID': 'application_id',
           'DSName': 'service',
           'DSType': 'service_type',
           'ObjectClass': 'class',
           'ObjectDN': 'object',
           'ObjectGUID': 'object_guid',
           'OpCorrelationID': 'operation_id',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'TreeDelete': 'tree_delete'},
    5142: {'ShareLocalPath': 'share_path',
           'ShareName': 'share_name',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5143: {'NewMaxUsers': 'new_max_user',
           'NewRemark': 'new_remark',
           'NewSD': 'new_sd',
           'NewSd': 'new_sd',
           'NewShareFlags': 'new_flag',
           'ObjectType': 'object_type',
           'OldMaxUsers': 'old_max_user',
           'OldRemark': 'old_remark',
           'OldSD': 'old_sd',
           'OldSd': 'old_sd',
           'OldShareFlags': 'old_flag',
           'ShareLocalPath': 'share_path',
           'ShareName': 'share_name',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5144: {'ShareLocalPath': 'share_path',
           'ShareName': 'share_name',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5145: {'AccessList': 'access',
           'AccessMask': 'access_mask',
           'AccessReason': 'reason',
           'IpAddress': 'source_address',
           'IpPort': 'source_port',
           'ObjectType': 'object_type',
           'RelativeTargetName': 'relative_target',
           'ShareLocalPath': 'share_path',
           'ShareName': 'share_name',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5152: {'Application': 'application',
           'DestAddress': 'destination_address',
           'DestPort': 'destination_port',
           'Direction': 'direction',
           'FilterRTID': 'filter_id',
           'LayerName': 'layer',
           'LayerRTID': 'layer_id',
           'SourceAddress': 'source_address',
           'SourcePort': 'source_port',
           'protocol': 'protocol'},
    5154: {'Application': 'application',
           'FilterRTID': 'filter_id',
           'LayerName': 'layer',
           'LayerRTID': 'layer_id',
           'SourceAddress': 'source_address',
           'SourcePort': 'source_port'},
    5156: {'Application': 'application',
           'DestAddress': 'destination_address',
           'DestPort': 'destination_port',
           'Direction': 'direction',
           'FilterRTID': 'filter_id',
           'LayerName': 'layer',
           'LayerRTID': 'layer_id',
           'RemoteMachineID': 'machine_id',
           'RemoteUserID': 'user_id',
           'SourceAddress': 'source_address',
           'SourcePort': 'source_port',
           'protocol': 'protocol'},
    5157: {'Application': 'application',
           'DestAddress': 'destination_address',
           'DestPort': 'destination_port',
           'Direction': 'direction',
           'FilterRTID': 'filter_id',
           'LayerName': 'layer',
           'LayerRTID': 'layer_id',
           'RemoteMachineID': 'machine_id',
           'RemoteUserID': 'user_id',
           'SourceAddress': 'source_address',
           'SourcePort': 'source_port',
           'protocol': 'protocol'},
    5158: {'Application': 'application',
           'FilterRTID': 'filter_id',
           'LayerName': 'layer',
           'LayerRTID': 'layer_id',
           'SourceAddress': 'source_address',
           'SourcePort': 'source_port'},
    5169: {'AppCorrelationID': 'application_id',
           'AttributeLDAPDisplayName': 'ldap_display',
           'AttributeSyntaxOID': 'attribute_id',
           'AttributeValue': 'attribute_value',
           'DSName': 'service',
           'DSType': 'service_type',
           'ExecutionProcessID': 'execution_process_id',
           'ObjectClass': 'class',
           'ObjectDN': 'object',
           'ObjectGUID': 'service_guid',
           'OpCorrelationID': 'operation_id',
           'OperationType': 'operation_type',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5170: {'AppCorrelationID': 'application_id',
           'AttributeLDAPDisplayName': 'ldap_display',
           'AttributeSyntaxOID': 'attribute_id',
           'AttributeValue': 'attribute_value',
           'DSName': 'service',
           'DSType': 'service_type',
           'ExecutionProcessID': 'execution_process_id',
           'ExpirationTime': 'exipre_ts',
           'ObjectClass': 'class',
           'ObjectDN': 'object',
           'ObjectGUID': 'service_guid',
           'OpCorrelationID': 'operation_id',
           'OperationType': 'operation_type',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    5379: {'CountOfCredentialsReturned': 'credential_returned_count',
           'ProcessCreationTime': 'process_creation_ts',
           'ReadOperation': 'read_operation',
           'ReturnCode': 'return_code',
           'TargetName': 'target'},
    5440: {'CalloutId': 'callout_id',
           'CalloutKey': 'callout_key',
           'CalloutName': 'callout',
           'CalloutType': 'callout_type',
           'LayerId': 'layer_id',
           'LayerKey': 'layer_key',
           'LayerName': 'layer',
           'ProviderKey': 'provider_key',
           'ProviderName': 'provider'},
    5441: {'CalloutKey': 'callout_key',
           'CalloutName': 'callout',
           'Conditions': 'condition',
           'FilterId': 'filter_id',
           'FilterKey': 'filter_key',
           'FilterName': 'filter',
           'FilterType': 'filter_type',
           'LayerId': 'layer_id',
           'LayerKey': 'layer_key',
           'LayerName': 'layer',
           'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'Weight': 'weight'},
    5442: {'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'ProviderType': 'provider_type'},
    5444: {'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'SubLayerKey': 'layer_key',
           'SubLayerName': 'layer',
           'SubLayerType': 'layer_type',
           'Weight': 'weight'},
    5446: {'CalloutId': 'callout_id',
           'CalloutKey': 'callout_key',
           'CalloutName': 'callout',
           'CalloutType': 'callout_type',
           'ChangeType': 'action',
           'LayerId': 'layer_id',
           'LayerKey': 'layer_key',
           'LayerName': 'layer',
           'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'UserName': 'user',
           'UserSid': 'user_id'},
    5447: {'CalloutKey': 'callout_key',
           'CalloutName': 'callout',
           'ChangeType': 'action',
           'Conditions': 'condition',
           'FilterId': 'filter_id',
           'FilterKey': 'filter_key',
           'FilterName': 'filter',
           'FilterType': 'filter_type',
           'LayerId': 'layer_id',
           'LayerKey': 'layer_key',
           'LayerName': 'layer',
           'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'UserName': 'user',
           'UserSid': 'user_id',
           'Weight': 'weight'},
    5448: {'ChangeType': 'action',
           'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'ProviderType': 'provider_type',
           'UserName': 'user',
           'UserSid': 'user_id'},
    5449: {'ChangeType': 'action',
           'ProviderContextKey': 'context_key',
           'ProviderContextName': 'context',
           'ProviderContextType': 'context_type',
           'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'UserName': 'user',
           'UserSid': 'user_id'},
    5450: {'ChangeType': 'action',
           'ProviderKey': 'provider_key',
           'ProviderName': 'provider',
           'SubLayerKey': 'layer_key',
           'SubLayerName': 'layer',
           'SubLayerType': 'layer_type',
           'UserName': 'user',
           'UserSid': 'user_id',
           'Weight': 'weight'},
    6144: {'ErrorCode': 'status_code'},
    6272: {'AccountSessionIdentifier': 'account_session_id',
           'AuthenticationProvider': 'authentication_provider',
           'AuthenticationServer': 'authentication_server',
           'AuthenticationType': 'authentication_type',
           'CalledStationID': 'called_station_id',
           'CallingStationID': 'calling_station_id',
           'ClientIPAddress': 'source_address',
           'ClientName': 'target_user',
           'EAPType': 'eap_type',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'FullyQualifiedSubjectMachineName': 'machine_name',
           'FullyQualifiedSubjectUserName': 'username',
           'LoggingResult': 'result',
           'NASIPv4Address': 'nas_address',
           'NASIPv6Address': 'nas_ipv6_address',
           'NASIdentifier': 'nas_id',
           'NASPort': 'nas_port',
           'NASPortType': 'nas_port_type',
           'NetworkPolicyName': 'policy',
           'ProxyPolicyName': 'proxy_policy',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'domain',
           'SubjectMachineName': 'machine',
           'SubjectMachineSID': 'machine_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    6273: {'AccountSessionIdentifier': 'account_session_id',
           'AuthenticationProvider': 'authentication_provider',
           'AuthenticationServer': 'authentication_server',
           'AuthenticationType': 'authentication_type',
           'CalledStationID': 'called_station_id',
           'CallingStationID': 'calling_station_id',
           'ClientIPAddress': 'source_address',
           'ClientName': 'target_user',
           'EAPType': 'eap_type',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'FullyQualifiedSubjectMachineName': 'machine_name',
           'FullyQualifiedSubjectUserName': 'username',
           'LoggingResult': 'result',
           'NASIPv4Address': 'nas_address',
           'NASIPv6Address': 'nas_ipv6_address',
           'NASIdentifier': 'nas_id',
           'NASPort': 'nas_port',
           'NASPortType': 'nas_port_type',
           'NetworkPolicyName': 'policy',
           'ProxyPolicyName': 'proxy_policy',
           'Reason': 'reason',
           'ReasonCode': 'status_code',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'domain',
           'SubjectMachineName': 'machine',
           'SubjectMachineSID': 'machine_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    6274: {'AccountSessionIdentifier': 'account_session_id',
           'AuthenticationProvider': 'authentication_provider',
           'AuthenticationServer': 'authentication_server',
           'AuthenticationType': 'authentication_type',
           'CalledStationID': 'called_station_id',
           'CallingStationID': 'calling_station_id',
           'ClientIPAddress': 'source_address',
           'ClientName': 'target_user',
           'EAPType': 'eap_type',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'FullyQualifiedSubjectMachineName': 'machine_name',
           'FullyQualifiedSubjectUserName': 'username',
           'NASIPv4Address': 'nas_address',
           'NASIPv6Address': 'nas_ipv6_address',
           'NASIdentifier': 'nas_id',
           'NASPort': 'nas_port',
           'NASPortType': 'nas_port_type',
           'NetworkPolicyName': 'policy',
           'ProxyPolicyName': 'proxy_policy',
           'Reason': 'reason',
           'ReasonCode': 'status_code',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'domain',
           'SubjectMachineName': 'machine',
           'SubjectMachineSID': 'machine_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    6278: {'AccountSessionIdentifier': 'account_session_id',
           'AuthenticationProvider': 'authentication_provider',
           'AuthenticationServer': 'authentication_server',
           'AuthenticationType': 'authentication_type',
           'CalledStationID': 'called_station_id',
           'CallingStationID': 'calling_station_id',
           'ClientIPAddress': 'source_address',
           'ClientName': 'target_user',
           'EAPType': 'eap_type',
           'ExecutionProcessID': 'execution_process_id',
           'ExecutionThreadID': 'execution_thread_id',
           'ExtendedQuarantineState': 'extended_quarantine_state',
           'FullyQualifiedSubjectMachineName': 'machine_name',
           'FullyQualifiedSubjectUserName': 'username',
           'MachineInventory': 'machine_inventory',
           'NASIPv4Address': 'nas_address',
           'NASIPv6Address': 'nas_ipv6_address',
           'NASIdentifier': 'nas_id',
           'NASPort': 'nas_port',
           'NASPortType': 'nas_port_type',
           'NetworkPolicyName': 'policy',
           'ProxyPolicyName': 'proxy_policy',
           'QuarantineHelpURL': 'quarantine_help_url',
           'QuarantineSessionID': 'quarantine_session_id',
           'QuarantineState': 'quarantine_state',
           'QuarantineSystemHealthResult': 'quarantine_system_health_result',
           'SourceModuleName': 'source_module',
           'SubjectDomainName': 'domain',
           'SubjectMachineName': 'machine',
           'SubjectMachineSID': 'machine_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id'},
    6416: {'ClassId': 'class_id',
           'ClassName': 'class',
           'CompatibleIds': 'compatible_id',
           'DeviceDescription': 'device_description',
           'DeviceId': 'device_id',
           'LocationInformation': 'location',
           'SubjectDomainName': 'domain',
           'SubjectLogonId': 'logon_id',
           'SubjectUserName': 'user',
           'SubjectUserSid': 'user_id',
           'VendorIds': 'vendor_id'}
}

logpoint_windows_service_control_manager_mapping = {
    7000: {'param1': 'service', 'param2': 'reason'},
    7001: {'Binary': 'event_data',
           'param1': 'service',
           'param2': 'caller_service',
           'param3': 'reason'},
    7002: {'Binary': 'event_data',
           'param1': 'service',
           'param2': 'group'},
    7003: {'param1': 'service', 'param2': 'caller_service'},
    7005: {'param1': 'function', 'param2': 'reason'},
    7006: {'param1': 'function', 'param2': 'registry', 'param3': 'reason'},
    7009: {'param1': 'duration', 'param2': 'service'},
    7010: {'param1': 'duration'},
    7011: {'param1': 'duration', 'param2': 'service'},
    7015: {'param1': 'driver'},
    7016: {'param1': 'service', 'param2': 'status'},
    7017: {'param1': 'service'},
    7019: {'param1': 'service'},
    7020: {'param1': 'service'},
    7021: {'param1': 'service'},
    7022: {'param1': 'service'},
    7023: {'param1': 'service', 'param2': 'reason'},
    7024: {'Binary': 'event_data',
           'param1': 'service',
           'param2': 'reason'},
    7026: {'param1': 'driver'},
    7028: {'param1': 'registry_key'},
    7030: {'param1': 'service'},
    7031: {'Binary': 'event_data',
           'param1': 'service',
           'param2': 'count',
           'param3': 'duration',
           'param5': 'action'},
    7032: {'param2': 'action', 'param3': 'service', 'param4': 'reason'},
    7033: {'param1': 'reason'},
    7034: {'Binary': 'event_data',
           'param1': 'service',
           'param2': 'count'},
    7035: {'param1': 'service', 'param2': 'control'},
    7036: {'Binary': 'event_data',
           'param1': 'service',
           'param2': 'status'},
    7037: {'param1': 'service', 'param2': 'configuration'},
    7038: {'param1': 'service', 'param2': 'user', 'param3': 'reason'},
    7039: {'param1': 'service',
           'param2': 'target_process_id',
           'param3': 'process_id'},
    7040: {'param1': 'service', 'param2': 'old_value', 'param3': 'new_value'},
    7041: {'param1': 'service', 'param2': 'user'},
    7042: {'param1': 'service',
           'param2': 'control',
           'param3': 'error_code',
           'param4': 'reason',
           'param5': 'comment'},
    7043: {'Binary': 'event_data', 'param1': 'service'},
    7045: {'ImagePath': 'path',
           'ServiceName': 'service',
           'ServiceType': 'service_type',
           'StartType': 'start_type'}
}

logpoint_windows_common_taxonomy = {
    "Provider_Name": "event_source",
    "ComputerName": "workstation",
    "Binary": "binary_data",
    "ProcessGuid": "process_guid",
    "Image": "image",
    "CurrentDirectory": "path",
    "CommandLine": "command",
    "ParentProcessGuid": "parent_process_guid",
    "ParentImage": "parent_process",
    "ParentCommandLine": "parent_command",
    "TargetFilename": "target_file",
    "SourceIp": "source_address",
    "SourceHostname": "source_host",
    "DestinationIp": "destination_address",
    "DestinationHostname": "destination_host",
    "DestinationPort": "destination_port",
    "DestinationPortName": "service",
    "ImageLoaded": "image_loaded",
    "Signed": "is_signed",
    "SignatureStatus": "status",
    "Imphash": "hash_import",
    "SourceProcessGuid": "source_process_guid",
    "SourceImage": "source_image",
    "SourceThreadId": "source_thread_id",
    "TargetObject": "target_object",
    "PipeName": "pipe",
    "Destination": "destination_address",
    "QueryName": "query",
    "QueryStatus": "status",
    "IsExecutable": "is_executable",
    "Archived": "is_archived",
    "HostName": "host",
    "Initiated": "is_initiated",
    "OriginalFileName": "original_file",
    "Company": "vendor",
    "FileVersion": "file_version",
    'ClientProcessId': 'process_id',
    'ClientProcessStartKey': 'process_start_key',
    'DomainBehaviorVersion': 'domain_behavior_version',
    'EngineVersion': 'engine_version',
    'ExtensionId': 'extension_id',
    'ExtensionName': 'extension_name',
    'HostVersion': 'host_version',
    'Host_Version': 'version',
    'RpcCallClientLocality': 'rpc_client_locality',
    'Volume_Name': 'volume',
    'Weight': 'weight',
    'X_MS_Endpoint_Absolute_Path': 'path',
    'X_MS_Forwarded_Client_IP': 'source_address',
    'X_MS_Proxy': 'proxy',
    'AccountDomain': 'domain',
    'AccountName': 'user',
    'Application': 'application',
    'AuthoritativeAnswer': 'answer',
    'Channel': 'channel',
    'ClientAddress': 'source_address',
    'ClientName': 'remote_user',
    'CommandName': 'command',
    'CommandPath': 'command_path',
    'CommandType': 'command_type',
    'DestAddress': 'destination_address',
    'DestPort': 'destination_port',
    'FileName': 'file',
    'FlagsHex': 'flag',
    'HostApplication': 'application',
    'HostId': 'host_id',
    'IpAddress': 'source_address',
    'IpPort': 'source_port',
    'MessageNumber': 'message_number',
    'MessageTotal': 'message_total',
    'NewEngineState': 'engine_state',
    'NewProcessId': 'target_process_id',
    'NewProcessName': 'new_process',
    'NewProviderState': 'provider_state',
    'ParentProcessName': 'parent_process',
    'PipelineId': 'pipeline_id',
    'PreviousEngineState': 'old_engine_state',
    'ProcessId': 'process_id',
    'ProcessName': 'process',
    'ProviderName': 'provider',
    'QueryResponseIndicator': 'action',
    'QuestionName': 'domain',
    'QuestionType': 'record_type',
    'RecursionAvailable': 'recursion_available',
    'RecursionDesired': 'recursion_desired',
    'RemoteIP': 'source_address',
    'ResponseCode': 'status_code',
    'ScriptBlockId': 'script_block_id',
    'ScriptBlockText': 'script_block',
    'ScriptName': 'script',
    'SendReceiveIndicator': 'direction',
    'SequenceNumber': 'sequence_number',
    'SourceAddress': 'source_address',
    'SourcePort': 'source_port',
    'SourceProcessId': 'process_id',
    'TargetDomainName': 'target_domain',
    'ThreadId': 'thread_id',
    'User': 'user',
    'WorkstationName': 'workstation'
}


windows_sysmon_label_mapping = {
    "process_creation": {
        "label": ("Process", "Create")
    },
    "file_change": {
        "label": ("File", "Create", "Time", "Change"),
    },
    "network_connection": {
        "label": ("Network", "Connection", "Detect")
    },
    "sysmon_status": {
        "label": ("Service", "State", "Change")
    },
    "process_termination": {
        "label": ("Process", "Terminate")
    },
    "driver_load": {
        "label": ("Driver", "Load")
    },
    "image_load": {
        "label": ("Image", "Load")
    },
    "create_remote_thread": {
        "label": ("Remote", "Thread", "Create")
    },
    "raw_access_thread": {
        "label": ("Raw", "Access", "Read")
    },
    "process_access": {
        "label": ("Process", "Access")
    },
    "registry_set": {
        "label": ("Registry", "Value", "Set")
    },
    "registry_event": {
        "norm_id": "WindowsSysmon",
        "event_id": [12, 13, 14]    # 12, 13, 14
    },
    "registry_rename": {
        "label": ("Registry", "Key", "Map")
    },
    "registry_delete": {
        "label": ("Registry", "Key", "Map")
    },
    "registry_add": {
        "label": ("Registry", "Key", "Map")
    },
    "create_stream_hash": {
        "label": ("File", "Create", "Stream", "Hash")
    },
    "pipe_created": {
        "norm_id": "WindowsSysmon",
        "event_id": [17, 18]
    },
    "wmi_event": {
        "norm_id": "WindowsSysmon",
        "event_id": [19, 20, 21]
    },
    "dns_query": {
        "label": ("DNS", "Query", "Execute")
    },
    "file_delete": {
        "label": ("File", "Delete")
    },
    "clipboard_capture": {
        "label": ("Clipboard", "Change", "Detect")
    },
    "process_tampering": {
        "label": ("Process", "Tamper")
    },
    "file_block": {
        "label": ("File", "Block", "Executable")
    },
    "sysmon_error": {
        "label": ("Service", "Error")
    },
    "file_event": {
        "label": ("File", "Create", "Overwrite")
    }
}
