logpoint_windows_sysmon_variable_mappings = {
    "Image": (
        ("category", "process_creation", "process"),
        ("category", "network_connection", "process"),
        ("category", "process_termination", "process"),
        ("category", "raw_access_read", "process"),
        ("category", "image_load", "process"),
        ("category", "file_event", "process"),
        ("category", "registry_delete", "process"),
        ("category", "registry_add", "process"),
        ("category", "registry_set", "process"),
        ("category", "registry_rename", "process"),
        ("category", "registry_event", "process"),
        ("category", "dns_query", "process"),
        ("category", "file_delete", "process"),
        ("category", "clipboard_capture", "process"),
        ("category", "process_tampering", "process"),
        ("category", "file_block", "process"),
        ("category", "file_change", "source_image"),
        ("category", "create_stream_hash", "source_image"),
        ("category", "pipe_created", "source_image"),
    ),
    "ImageLoaded": (
        ("category", "driver_load", "image"),
        ("category", "image_load", "image"),
    ),
    "SourceImage": (
        ("category", "process_access", "process"),
        ("category", "create_remote_thread", "process"),
    ),
    "TargetImage": (
        ("category", "process_access", "image"),
        ("category", "create_remote_thread", "image"),
    ),
}

logpoint_windows_sysmon_mapping = {
    "AccountName": "user",
    "AccountType": "account_type",
    "ActivityID": "activity_id",
    "Category": "event_category",
    "CategoryId": "category_id",
    "ClientAddress": "source_address",
    "ClientIP": "source_address",
    "ClientUserName": "user",
    "CommandLine": "command",
    "Company": "vendor",
    "Conditions": "condition",
    "CreationUtcTime": "creation_ts",
    "DestAddress": "destination_address",
    "DestPort": "destination_port",
    "DestinationHostname": "destination_host",
    "DestinationIp": "destination_address",
    "DestinationIsIpv6": "destination_is_ipv6",
    "DestinationPort": "destination_port",
    "Details": "detail",
    "DomainName": "domain",
    "EngineVersion": "engine_version",
    "ErrorCode": "error_code",
    "Event": "event",
    "Archived": "is_archived",
    "CommandLine": "command",
    "Company": "vendor",
    "Configuration": "file",
    "CreationUtcTime": "creation_ts",
    "CurrentDirectory": "path",
    "Description": "message",
    "DestinationHostname": "destination_host",
    "DestinationIp": "destination_address",
    "DestinationIsIpv6": "is_destination_ipv6",
    "DestinationPort": "destination_port",
    "DestinationPortName": "destination_service",
    "EventType": "event_type",
    "FileVersion": "file_version",
    "Image": "image",
    "Initiated": "is_initiated",
    "IntegrityLevel": "integrity_level",
    "IsExecutable": "is_executable",
    "LogonGuid": "logon_guid",
    "LogonId": "logon_id",
    "OriginalFileName": "file",
    "ParentCommandLine": "parent_command",
    "ParentImage": "parent_process",
    "ParentProcessGuid": "parent_process_guid",
    "ParentProcessId": "parent_process_id",
    "ParentUser": "parent_user",
    "ProcessGuid": "process_guid",
    "ProcessId": "process_id",
    "Product": "application",
    "Protocol": "protocol",
    "RuleName": "rule",
    "SchemaVersion": "schema_version",
    "SourceHostname": "source_host",
    "SourceIp": "source_address",
    "SourceIsIpv6": "is_source_ipv6",
    "SourcePort": "source_port",
    "SourcePortName": "source_service",
    "State": "state",
    "TargetFilename": "target_file",
    "TargetObject": "target_object",
    "TerminalSessionId": "session_id",
    "User": "user",
    "UtcTime": "utc_ts",
    "Version": "version",
    "EventID": "event_id",
    "EventReceivedTime": "event_ts",
    "EventTime": "log_ts",
    "EventType": "event_type",
    "ExecutionProcessID": "execution_process_id",
    "ExecutionThreadID": "execution_thread_id",
    "FailureReason": "reason",
    "FileVersion": "file_version",
    "HostApplication": "application",
    "HostId": "host_id",
    "Hostname": "host",
    "IsExecutable": "is_executable",
    "KeyLength": "key_length",
    "Keywords": "keyword",
    "LogonGuid": "logon_guid",
    "LogonID": "logon_id",
    "LogonId": "logon_id",
    "ObjectName": "object",
    "OpcodeValue": "opcode_value",
    "OriginalFileName": "file",
    "PackageName": "package",
    "ParentProcessGuid": "parent_process_guid",
    "ParentProcessId": "parent_process_id",
    "PreviousCreationUtcTime": "previous_creation_ts",
    "ProcessGuid": "process_guid",
    "ProcessID": "process_id",
    "ProcessId": "process_id",
    "ProcessName": "process",
    "ProviderGuid": "guid",
    "ProviderKey": "provider_key",
    "ProviderName": "provider",
    "QueryName": "query",
    "QueryResults": "result",
    "RecordNumber": "record",
    "RequestType": "request_type",
    "ResourceManager": "resource_manager",
    "RuleAttr": "rule_attribute",
    "RuleId": "rule_id",
    "RuleName": "rule",
    "SequenceNumber": "sequence_number",
    "ServiceName": "service",
    "ServicePrincipalNames": "service_principal_name",
    "ServiceSid": "service_id",
    "SessionId": "session_id",
    "SessionName": "session",
    "Severity": "log_level",
    "SeverityValue": "severity",
    "SourceAddress": "source_address",
    "SourceHostname": "source_host",
    "SourceImage": "source_image",
    "SourceIp": "source_address",
    "SourceIsIpv6": "source_is_ipv6",
    "SourceModuleName": "source_module",
    "SourceModuleType": "source_module_type",
    "SourceName": "event_source",
    "SourcePort": "source_port",
    "SourceProcessGUID": "source_process_guid",
    "SourceProcessId": "source_process_id",
    "SourceThreadId": "source_thread_id",
    "SourceUser": "source_user",
    "System_Channel": "channel",
    "System_Computer": "host",
    "System_EventID": "event_id",
    "System_EventRecordID": "record_id",
    "System_Execution_ProcessID": "execution_process_id",
    "System_Execution_ThreadID": "execution_thread_id",
    "System_Keywords": "keyword",
    "System_Level": "severity",
    "System_Opcode": "opcode",
    "System_Provider_Guid": "guid",
    "System_Provider_Name": "event_source",
    "System_Security_UserID": "user_id",
    "System_Security_UserId": "user_id",
    "System_Task": "task_value",
    "System_TimeCreated_SystemTime": "event_ts",
    "System_Version": "version",
    "TargetProcessGUID": "target_process_guid",
    "TargetProcessId": "target_process_id",
    "TargetUser": "target_user",
    "TaskValue": "task_value",
    "ThreadID": "thread_id",
    "UrlAbsolutePath": "path",
    "UserAgent": "user_agent",
    "UserID": "user_id",
    "UserId": "user_id",
    "UtcTime": "utc_ts",
    "client_request_id": "request_id",
    "GrantedAccess": "access",
    "MD5": "hash",
    "SHA1": "hash_sha1",
    "SHA256": "hash_sha256",
    "IMPHASH": "hash_import",
}

logpoint_windows_security_audit_mapping = {
    4610: {"AuthenticationPackageName": "package"},
    4611: {
        "LogonProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4614: {"NotificationPackageName": "package"},
    4616: {
        "NewTime": "new_ts",
        "PreviousTime": "old_ts",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4622: {"SecurityPackageName": "package"},
    4624: {
        "AuthenticationPackageName": "package",
        "ElevatedToken": "elevated_token",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "ImpersonationLevel": "impersonation_level",
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "LmPackageName": "lm_package",
        "LogonGuid": "logon_guid",
        "LogonProcessName": "logon_process",
        "LogonType": "logon_type",
        "ProcessId": "process_id",
        "ProcessName": "process",
        "SubjectDomainName": "caller_domain",
        "SubjectLogonId": "caller_logon_id",
        "SubjectUserName": "caller_user",
        "SubjectUserSid": "caller_id",
        "TargetDomainName": "domain",
        "TargetLinkedLogonId": "target_linked_logon_id",
        "TargetLogonId": "logon_id",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
        "TaskValue": "task_value",
        "TransmittedServices": "transmitted_service",
        "VirtualAccount": "virtual_account",
    },
    4625: {
        "AuthenticationPackageName": "package",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "FailureReason": "reason",
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "LmPackageName": "lm_package",
        "LogonProcessName": "logon_process",
        "LogonType": "logon_type",
        "ProcessId": "process_id",
        "ProcessName": "process",
        "Status": "status_code",
        "SubStatus": "sub_status_code",
        "SubjectDomainName": "caller_domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "caller_user",
        "SubjectUserSid": "caller_id",
        "TargetDomainName": "domain",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
        "TransmittedServices": "transmitted_service",
    },
    4627: {
        "EventCountTotal": "event_count",
        "EventIdx": "event_idx",
        "GroupMembership": "group_membership",
        "LogonType": "logon_type",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "caller_logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "domain",
        "TargetLogonId": "logon_id",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
    },
    4634: {
        "LogonType": "logon_type",
        "TargetDomainName": "domain",
        "TargetLogonId": "logon_id",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
    },
    4647: {
        "TargetDomainName": "domain",
        "TargetLogonId": "logon_id",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
    },
    4648: {
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "LogonGuid": "logon_guid",
        "ProcessName": "process",
        "SubjectDomainName": "caller_domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "caller_user",
        "SubjectUserSid": "caller_id",
        "TargetDomainName": "domain",
        "TargetInfo": "information",
        "TargetLogonGuid": "logon_guid",
        "TargetServerName": "server",
        "TargetUserName": "user",
    },
    4653: {
        "EventReceivedTime": "event_ts",
        "FailurePoint": "failure_point",
        "FailureReason": "reason",
        "InitiatorCookie": "initiator_cookie",
        "KeyModName": "module_name",
        "Keywords": "keyword",
        "LocalAddress": "source_address",
        "LocalKeyModPort": "source_port",
        "LocalMMPrincipalName": "local_principal_name",
        "MMAuthMethod": "authentication_method",
        "MMFilterID": "filter_id",
        "MMImpersonationState": "impersonation_state",
        "RemoteAddress": "destination_address",
        "RemoteKeyModPort": "destination_port",
        "RemoteMMPrincipalName": "remote_principal_name",
        "ResponderCookie": "responder_cookie",
        "Role": "role",
        "State": "state",
        "Task": "task",
    },
    4656: {
        "AccessList": "access",
        "AccessMask": "access_mask",
        "AccessReason": "reason",
        "HandleId": "handle_id",
        "ObjectName": "object_name",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "PrivilegeList": "privilege",
        "ProcessName": "process",
        "RestrictedSidCount": "restricted_id_count",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TransactionId": "transaction_id",
    },
    4657: {
        "HandleId": "handle_id",
        "NewValue": "new_value",
        "NewValueType": "new_value_type",
        "ObjectName": "object_name",
        "ObjectValueName": "object_value",
        "OldValue": "old_value",
        "OldValueType": "old_value_type",
        "OperationType": "operation_type",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4658: {
        "HandleId": "handle_id",
        "ObjectServer": "object_server",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4659: {
        "AccessList": "access",
        "AccessMask": "access_mask",
        "HandleId": "handle_id",
        "ObjectName": "object_name",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TransactionId": "transaction_id",
    },
    4660: {
        "HandleId": "handle_id",
        "ObjectServer": "object_server",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TransactionId": "transaction_id",
    },
    4661: {
        "AccessList": "access",
        "AccessMask": "access_mask",
        "AccessReason": "reason",
        "HandleId": "handle_id",
        "ObjectName": "object",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "PrivilegeList": "privilege",
        "ProcessName": "process",
        "Properties": "properties",
        "RestrictedSidCount": "restricted_id_count",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TransactionId": "transaction_id",
    },
    4662: {
        "AccessList": "access",
        "AccessMask": "access_mask",
        "AdditionalInfo": "additional_information",
        "AdditionalInfo2": "additional_information_2",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "HandleId": "handle_id",
        "ObjectName": "object_name",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "OperationType": "operation_type",
        "Properties": "properties",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TaskValue": "task_value",
    },
    4663: {
        "AccessList": "access",
        "AccessMask": "access_mask",
        "HandleId": "handle_id",
        "ObjectName": "object_name",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "ProcessName": "process",
        "ResourceAttributes": "attributes",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4664: {
        "FileName": "file",
        "LinkName": "link",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TransactionId": "transaction_id",
    },
    4670: {
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "HandleId": "handle_id",
        "NewSD": "new_sd",
        "NewSd": "new_sd",
        "ObjectName": "object_name",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "OldSD": "old_sd",
        "OldSd": "old_sd",
        "ProcessId": "process_id",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TaskValue": "task_value",
    },
    4672: {
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4673: {
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "ObjectServer": "object_server",
        "PrivilegeList": "privilege",
        "ProcessId": "process_id",
        "ProcessName": "process",
        "Service": "service",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TaskValue": "task_value",
    },
    4674: {
        "AccessMask": "access_mask",
        "HandleId": "handle_id",
        "ObjectName": "object",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "PrivilegeList": "privilege",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4675: {
        "SidList": "id_list",
        "TargetDomainName": "domain",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
        "TdoAttributes": "trust_attribute",
        "TdoDirection": "trust_direction",
        "TdoSid": "trust_id",
        "TdoType": "trust_type",
    },
    4688: {
        "Creator_Process_ID": "parent_process_id",
        "MandatoryLabel": "integrity_sid",
        "NewProcessId": "target_process_id",
        "NewProcessName": "process",
        "New_Process_Name": "process",
        "Process_Command_Line": "command",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetLogonId": "target_logon_id",
        "TargetUserName": "target_user",
        "TargetUserSid": "target_id",
        "TokenElevationType": "token_elevation_type",
    },
    4689: {
        "ProcessName": "process",
        "Status": "status_code",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4690: {
        "SourceHandleId": "handle_id",
        "SourceProcessId": "source_process_id",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetHandleId": "new_handle_id",
        "TargetProcessId": "target_process_id",
    },
    4692: {
        "EventReceivedTime": "event_ts",
        "FailureReason": "reason",
        "Keywords": "keyword",
        "MasterKeyId": "master_key_id",
        "RecoveryKeyId": "recover_id",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "Task": "task",
    },
    4695: {
        "CryptoAlgorithms": "cipher",
        "DataDescription": "data_description",
        "FailureReason": "reason",
        "MasterKeyId": "master_key_id",
        "ProtectedDataFlags": "protected_data_flag",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4697: {
        "ServiceAccount": "service_account",
        "ServiceFileName": "file",
        "ServiceName": "service",
        "ServiceStartType": "start_type",
        "ServiceType": "object_type",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4698: {
        "RandomDelay": "random_delay",
        "Source": "source",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "SubjectUserSidName": "subject_user_id",
        "TaskContent": "task_content",
        "TaskName": "task",
        "WeeksInterval": "weeks_interval",
    },
    4699: {
        "DisallowStartIfOnBatteries": "disallow_start_if_on_batteries",
        "ExecutionTimeLimit": "execution_time_limit",
        "LogonType": "logon_type",
        "RestartOnIdle": "restart_on_idle",
        "RunLevel": "run_level",
        "RunOnlyIfIdle": "run_only_if_idle",
        "StartBoundary": "start_boundry",
        "StopIfGoingOnBatteries": "stop_if_going_on_batteries",
        "StopOnIdleEnd": "stop_on_idle_end",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TaskContent": "task_content",
        "TaskName": "task",
        "UserId": "target_user",
        "WaitTimeout": "wait_timeout",
        "WakeToRun": "wake_to_run",
    },
    4700: {
        "AllowHardTerminate": "allow_hard_terminate",
        "AllowStartOnDemand": "allow_start_on_demand",
        "ClassId": "class_id",
        "DisallowStartIfOnBatteries": "disallow_start_if_on_batteries",
        "DisallowStartOnRemoteAppSession": "disallow_start_on_remote_app_session",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "ExecutionTimeLimit": "execution_time_limit",
        "GroupId": "group_id",
        "MultipleInstancesPolicy": "multiple_instances_policy",
        "RestartOnIdle": "restart_on_idle",
        "RunOnlyIfIdle": "run_only_if_idle",
        "RunOnlyIfNetworkAvailable": "run_only_if_network_available",
        "SecurityDescriptor": "sd",
        "Source": "source",
        "StopIfGoingOnBatteries": "stop_if_going_on_batteries",
        "StopOnIdleEnd": "stop_on_idle_end",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TaskContent": "content",
        "TaskName": "task",
        "TaskValue": "task_value",
        "URI": "url",
        "UseUnifiedSchedulingEngine": "use_unified_scheduling_engine",
        "UserId": "user_id",
        "WakeToRun": "wake_to_run",
    },
    4701: {
        "AllowHardTerminate": "allow_hard_terminate",
        "AllowStartOnDemand": "allow_start_on_demand",
        "Author": "author",
        "ClassId": "class_id",
        "ComHandler": "com_handler",
        "Count": "count",
        "Data": "data",
        "Description": "description",
        "DisallowStartIfOnBatteries": "disallow_start_on_Batteries",
        "DisallowStartOnRemoteAppSession": "disallow_start_on_remote_session",
        "Enabled": "enabled",
        "EventTrigger": "event_trigger",
        "ExecutionTimeLimit": "execution_time_limit",
        "Hidden": "hidden",
        "Interval": "interval",
        "MultipleInstancesPolicy": "multiple_instance_policy",
        "Principal": "principle",
        "Priority": "priority",
        "RestartOnFailure": "restart_on_failure",
        "RunOnlyIfIdle": "run_only_if_idle",
        "RunOnlyIfNetworkAvailable": "run_only_if_network_available",
        "SecurityDescriptor": "sd",
        "Source": "source",
        "StopIfGoingOnBatteries": "stop_if_going_on_batteries",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "Subscription": "subscription",
        "TaskContent": "task_content",
        "TaskName": "task",
        "URI": "url",
        "UseUnifiedSchedulingEngine": "user_unified_scheduling_engine",
        "UserId": "user_id",
        "WakeToRun": "wake_to_run",
    },
    4702: {
        "AllowHardTerminate": "allow_hard_terminate",
        "AllowStartOnDemand": "allow_start_on_demand",
        "Category": "event_category",
        "ClassId": "class_id",
        "DaysInterval": "days_interval",
        "DisallowStartIfOnBatteries": "disallow_start_if_on_batteries",
        "DisallowStartOnRemoteAppSession": "disallow_start_on_remote_app_session",
        "ExecutionTimeLimit": "execution_time_limit",
        "Hidden": "hidden",
        "LogonType": "logon_type",
        "MultipleInstancesPolicy": "multiple_instance_policy",
        "RandomDelay": "random_delay",
        "RestartOnIdle": "restart_on_idle",
        "RunLevel": "run_level",
        "RunOnlyIfIdle": "run_only_if_idle",
        "RunOnlyIfNetworkAvailable": "run_only_if_network_available",
        "SecurityDescriptor": "sd",
        "Source": "source",
        "StartBoundary": "start_boundry",
        "StartWhenAvailable": "start_when_available",
        "StopIfGoingOnBatteries": "stop_if_going_on_batteries",
        "StopOnIdleEnd": "stop_on_idle_end",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "Task": "task",
        "TaskContentNew": "content",
        "TaskName": "task",
        "URI": "url",
        "UseUnifiedSchedulingEngine": "use_unified_scheduling_engine",
        "UserId": "user_id",
        "WaitTimeout": "wait_timeout",
        "WakeToRun": "wake_to_run",
        "file_extension": "file_type",
    },
    4703: {
        "DisabledPrivilegeList": "disabled_privilege_list",
        "EnabledPrivilegeList": "enabled_privilege_list",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "caller_logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "domain",
        "TargetLogonId": "logon_id",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
    },
    4704: {
        "PrivilegeList": "privilege",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
    },
    4705: {
        "PrivilegeList": "privilege",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
    },
    4713: {
        "KerberosPolicyChange": "policy",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4714: {"EventReceivedTime": "event_ts", "Keywords": "keyword", "Task": "task"},
    4716: {
        "DomainName": "domain",
        "DomainSid": "domain_id",
        "SidFilteringEnabled": "sid_filtering_enabled",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "caller_domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TdoAttributes": "tdo_attributes",
        "TdoDirection": "tdo_direction",
        "TdoType": "tdo_type",
    },
    4717: {
        "AccessGranted": "privilege",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
        "TaskValue": "task_value",
    },
    4718: {
        "AccessRemoved": "privilege",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id ",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "caller_id",
        "TargetSid": "target_id",
    },
    4719: {
        "AuditPolicyChanges": "policy",
        "CategoryId": "category",
        "SubcategoryGuid": "sub_category_guid",
        "SubcategoryId": "sub_category",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4720: {
        "AccountExpires": "account_expire",
        "AllowedToDelegateTo": "allowed_to_delegate",
        "DisplayName": "display_name",
        "HomeDirectory": "home_directory",
        "HomePath": "home_path",
        "LogonHours": "logon_hour",
        "NewUacValue": "new_value",
        "OldUacValue": "old_value",
        "PasswordLastSet": "password_last_set_ts",
        "PrimaryGroupId": "group_id",
        "PrivilegeList": "privilege",
        "ProfilePath": "path",
        "SamAccountName": "sam_account_name",
        "ScriptPath": "script_path",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
        "UserAccountControl": "user_account_control",
        "UserParameters": "parameter",
        "UserPrincipalName": "user_principal_name",
        "UserWorkstations": "workstation",
    },
    4722: {
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
    },
    4723: {
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
    },
    4724: {
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
    },
    4725: {
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
    },
    4726: {
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
        "TaskValue": "task_value",
    },
    4727: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4728: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4729: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4730: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4731: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4732: {
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
        "TaskValue": "task_value",
    },
    4733: {
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4734: {
        "GroupTypeChange": "group_type",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4735: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4737: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4738: {
        "AccountExpires": "account_expire",
        "AllowedToDelegateTo": "allowed_to_delegate",
        "DisplayName": "display_name",
        "Dummy": "dummy",
        "HomeDirectory": "home_directory",
        "HomePath": "home_path",
        "LogonHours": "logon_hour",
        "NewUacValue": "new_value",
        "OldUacValue": "old_value",
        "PasswordLastSet": "password_last_set_ts",
        "PrimaryGroupId": "group_id",
        "PrivilegeList": "privilege",
        "ProfilePath": "path",
        "SamAccountName": "sam_account_name",
        "ScriptPath": "script_path",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
        "UserAccountControl": "user_account_control",
        "UserParameters": "parameter",
        "UserPrincipalName": "user_principal_name",
        "UserWorkstations": "workstation",
    },
    4739: {
        "DomainBehaviorVersion": "domain_behavior_version",
        "DomainName": "domain",
        "DomainPolicyChanged": "policy",
        "DomainSid": "domain_id",
        "ForceLogoff": "force_logoff",
        "LockoutDuration": "lockout_duration",
        "LockoutObservationWindow": "observation_window",
        "LockoutThreshold": "lockout_threshold",
        "MachineAccountQuota": "account_quota",
        "MaxPasswordAge": "max_password_age",
        "MinPasswordAge": "min_password_age",
        "MinPasswordLength": "min_password_length",
        "MixedDomainMode": "mixed_domain_mode",
        "OemInformation": "oem_information",
        "PasswordHistoryLength": "password_history_length",
        "PasswordProperties": "properties",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "caller_domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4740: {
        "SubjectDomainName": "caller_domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "caller_user",
        "SubjectUserSid": "caller_id",
        "TargetDomainName": "workstation",
        "TargetSid": "user_id",
        "TargetUserName": "user",
    },
    4741: {
        "AccountExpires": "account_expire",
        "AllowedToDelegateTo": "allowed_to_delegate",
        "DisplayName": "display_name",
        "DnsHostName": "dns_host",
        "HomeDirectory": "home_directory",
        "HomePath": "home_path",
        "LogonHours": "logon_hour",
        "NewUacValue": "new_value",
        "OldUacValue": "old_value",
        "PasswordLastSet": "password_last_set_ts",
        "PrimaryGroupId": "group_id",
        "PrivilegeList": "privilege",
        "ProfilePath": "path",
        "SamAccountName": "sam_account_name",
        "ScriptPath": "script_path",
        "ServicePrincipalNames": "service",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "computer_domain",
        "TargetSid": "computer_id",
        "TargetUserName": "computer",
        "UserAccountControl": "user_account_control",
        "UserParameters": "parameter",
        "UserPrincipalName": "user_principal_name",
        "UserWorkstations": "workstation",
    },
    4742: {
        "AccountExpires": "account_expire",
        "AllowedToDelegateTo": "allowed_to_delegate",
        "ComputerAccountChange": "computer_account_change",
        "DisplayName": "display_name",
        "DnsHostName": "dns_host",
        "HomeDirectory": "home_directory",
        "HomePath": "home_path",
        "LogonHours": "logon_hour",
        "NewUacValue": "new_value",
        "OldUacValue": "old_value",
        "PasswordLastSet": "password_last_set_ts",
        "PrimaryGroupId": "group_id",
        "PrivilegeList": "privilege",
        "ProfilePath": "path",
        "SamAccountName": "sam_account_name",
        "ScriptPath": "script_path",
        "ServicePrincipalNames": "service",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "computer_domain",
        "TargetSid": "computer_id",
        "TargetUserName": "computer",
        "UserAccountControl": "user_account_control",
        "UserParameters": "parameter",
        "UserPrincipalName": "user_principal_name",
        "UserWorkstations": "workstation",
    },
    4743: {
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "computer_domain",
        "TargetSid": "computer_id",
        "TargetUserName": "computer",
    },
    4744: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4745: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4746: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4747: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4748: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4749: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4750: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4751: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4752: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4753: {
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4754: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4755: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4756: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4757: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4758: {
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4759: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4760: {
        "PrivilegeList": "privilege",
        "SamAccountName": "sam_account_name",
        "SidHistory": "sid_history",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4761: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4762: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4763: {
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4764: {
        "GroupTypeChange": "group_type",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4767: {
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
    },
    4768: {
        "CertIssuerName": "certificate_issuer",
        "CertSerialNumber": "certificate_serial_number",
        "CertThumbprint": "certificate_hash",
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "PreAuthType": "pre_authentication_type",
        "ServiceName": "service",
        "ServiceSid": "service_id",
        "Status": "status_code",
        "TargetDomainName": "domain",
        "TargetSid": "user_id",
        "TargetUserName": "user",
        "TicketEncryptionType": "encryption_type",
        "TicketOptions": "ticket_option",
    },
    4769: {
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "LogonGuid": "logon_guid",
        "ServiceName": "service",
        "ServiceSid": "service_id",
        "Status": "status_code",
        "TargetDomainName": "domain",
        "TargetUserName": "user",
        "TicketEncryptionType": "encryption_type",
        "TicketOptions": "ticket_option",
        "TransmittedServices": "transmitted_service",
    },
    4770: {
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "ServiceName": "service",
        "ServiceSid": "service_id",
        "TargetDomainName": "domain",
        "TargetUserName": "user",
        "TicketEncryptionType": "encryption_type",
        "TicketOptions": "ticket_option",
    },
    4771: {
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "PreAuthType": "pre_authentication_type",
        "ServiceName": "service",
        "Status": "status_code",
        "TargetSid": "user_id",
        "TargetUserName": "user",
        "TicketOptions": "ticket_option",
    },
    4774: {
        "ClientUserName": "user",
        "MappedName": "mapped_name",
        "MappingBy": "mapping_by",
        "SourceModuleName": "source_module",
        "Version": "version",
    },
    4776: {
        "PackageName": "package",
        "Status": "status_code",
        "TargetUserName": "user",
        "Workstation": "workstation",
    },
    4778: {
        "AccountDomain": "domain",
        "AccountName": "user",
        "ClientAddress": "source_address",
        "ClientName": "workstation",
        "LogonID": "logon_id",
        "SessionName": "session",
    },
    4779: {
        "AccountDomain": "domain",
        "AccountName": "user",
        "ClientAddress": "source_address",
        "ClientName": "workstation",
        "LogonID": "logon_id",
        "SessionName": "session",
    },
    4780: {
        "PrivilegeList": "privilege",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "domain",
        "TargetSid": "target_id",
        "TargetUserName": "target_user",
        "Version": "version",
    },
    4781: {
        "NewTargetUserName": "new_user",
        "OldTargetUserName": "target_user",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "target_domain",
        "TargetSid": "target_id",
    },
    4785: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4786: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4787: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4788: {
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4793: {
        "EventReceivedTime": "event_ts",
        "Keywords": "keyword",
        "Status": "status_code",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetUserName": "target_user",
        "Task": "task",
        "Workstation": "workstation",
    },
    4798: {
        "CallerProcessId": "process_id",
        "CallerProcessName": "process",
        "MemberSid": "target_id",
        "PrivilegeList": "privilege",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4799: {
        "CallerProcessId": "process_id",
        "CallerProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetDomainName": "group_domain",
        "TargetSid": "group_id",
        "TargetUserName": "group",
    },
    4800: {
        "SessionId": "session_id",
        "TargetDomainName": "domain",
        "TargetLogonId": "logon_id",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
    },
    4801: {
        "SessionId": "session_id",
        "TargetDomainName": "domain",
        "TargetLogonId": "logon_id",
        "TargetUserName": "user",
        "TargetUserSid": "user_id",
    },
    4817: {
        "NewSD": "new_sd",
        "NewSd": "new_sd",
        "ObjectName": "object_name",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "OldSD": "old_sd",
        "OldSd": "old_sd",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4902: {"PuaCount": "pua_count", "PuaPolicyId": "policy_id"},
    4904: {
        "AuditSourceName": "audit_source",
        "EventSourceId": "source_id",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4905: {
        "AuditSourceName": "audit_source",
        "EventSourceId": "source_id",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4907: {
        "HandleId": "handle_id",
        "NewSD": "new_sd",
        "NewSd": "new_sd",
        "ObjectName": "object_name",
        "ObjectServer": "object_server",
        "ObjectType": "object_type",
        "OldSD": "old_sd",
        "OldSd": "old_sd",
        "ProcessName": "process",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    4912: {
        "AuditPolicyChanges": "policy",
        "CategoryId": "category_id",
        "SourceModuleName": "source_module",
        "SubcategoryGuid": "sub_category_guid",
        "SubcategoryId": "sub_category",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TargetUserSid": "target_id",
    },
    4928: {
        "DestinationDRA": "destination_dra",
        "EventReceivedTime": "event_ts",
        "Keywords": "keyword",
        "NamingContext": "naming_context",
        "Options": "options",
        "SourceAddr": "workstation",
        "SourceDRA": "source_dra",
        "StatusCode": "status_code",
        "Task": "task",
    },
    4929: {
        "DestinationDRA": "destination_dra",
        "EventReceivedTime": "event_ts",
        "Keywords": "keyword",
        "NamingContext": "naming_context",
        "Options": "options",
        "SourceAddr": "workstation",
        "SourceDRA": "source_dra",
        "StatusCode": "status_code",
        "Task": "task",
    },
    4930: {
        "DestinationDRA": "destination_dra",
        "EventReceivedTime": "event_ts",
        "Keywords": "keyword",
        "NamingContext": "naming_context",
        "Options": "options",
        "SourceAddr": "workstation",
        "SourceDRA": "source_dra",
        "StatusCode": "status_code",
        "Task": "task",
    },
    4931: {
        "DestinationDRA": "destination_dra",
        "NamingContext": "naming_context",
        "Options": "options",
        "SourceAddr": "source_address",
        "SourceDRA": "source_dra",
        "SourceModuleName": "source_module",
        "StatusCode": "status_code",
        "Version": "version",
    },
    4932: {
        "DestinationDRA": "destination_dra",
        "NamingContext": "naming_context",
        "Options": "options",
        "SessionID": "session_id",
        "SourceDRA": "source_dra",
        "SourceModuleName": "source_module",
        "StartUSN": "start_user_sequence_number",
        "Version": "version",
    },
    4933: {
        "DestinationDRA": "destination_dra",
        "EndUSN": "end_user_sequence_number",
        "NamingContext": "naming_context",
        "Options": "options",
        "SessionID": "session_id",
        "SourceDRA": "source_dra",
        "SourceModuleName": "source_module",
        "StatusCode": "status_code",
        "Version": "version",
    },
    4944: {
        "GroupPolicyApplied": "policy",
        "LogDroppedPacketsEnabled": "log_dropped_packet",
        "LogSuccessfulConnectionsEnabled": "log_successful_connection",
        "MulticastFlowsEnabled": "multicast_flow",
        "OperationMode": "operation_mode",
        "Profile": "profile",
        "RemoteAdminEnabled": "remote_administration",
    },
    4945: {"ProfileUsed": "profile", "RuleId": "rule_id", "RuleName": "rule"},
    4946: {"ProfileChanged": "profile", "RuleId": "rule_id", "RuleName": "rule"},
    4947: {"ProfileChanged": "profile", "RuleId": "rule_id", "RuleName": "rule"},
    4948: {"ProfileChanged": "profile", "RuleId": "rule_id", "RuleName": "rule"},
    4950: {
        "ProfileChanged": "profile",
        "SettingType": "setting_type",
        "SettingValue": "setting_value",
    },
    4953: {
        "EventReceivedTime": "event_ts",
        "Keywords": "keyword",
        "Profile": "profile",
        "ReasonForRejection": "reason",
        "RuleId": "rule_id",
        "RuleName": "rule",
        "Task": "task",
    },
    4956: {"ActiveProfile": "profile"},
    4957: {"RuleAttr": "attribute", "RuleId": "rule_id", "RuleName": "rule"},
    4985: {
        "NewState": "new_value",
        "ProcessName": "process",
        "ResourceManager": "resource_manager",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TransactionId": "transaction_id",
    },
    5031: {"Application": "application", "Profiles": "profile"},
    5038: {
        "EventReceivedTime": "event_ts",
        "Keywords": "keyword",
        "Task": "task",
        "param1": "file",
    },
    5056: {
        "EventReceivedTime": "event_ts",
        "Keywords": "keyword",
        "Module": "module",
        "ReturnCode": "status_code",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "Task": "task",
    },
    5058: {
        "AlgorithmName": "cipher",
        "KeyFilePath": "path",
        "KeyName": "key",
        "KeyType": "key_type",
        "Operation": "action",
        "ProviderName": "provider",
        "ReturnCode": "status_code",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5059: {
        "AlgorithmName": "cipher",
        "KeyName": "key",
        "KeyType": "key_type",
        "Operation": "action",
        "ProviderName": "provider",
        "ReturnCode": "status_code",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5061: {
        "AlgorithmName": "cipher",
        "KeyName": "key",
        "KeyType": "key_type",
        "Operation": "action",
        "ProviderName": "provider",
        "ReturnCode": "status_code",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5136: {
        "AppCorrelationID": "application_id",
        "AttributeLDAPDisplayName": "ldap_display",
        "AttributeSyntaxOID": "attribute_id",
        "AttributeValue": "attribute_value",
        "DSName": "service",
        "DSType": "service_type",
        "ObjectClass": "class",
        "ObjectDN": "object",
        "ObjectGUID": "service_guid",
        "OpCorrelationID": "operation_id",
        "OperationType": "operation_type",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5137: {
        "AppCorrelationID": "application_id",
        "DSName": "service",
        "DSType": "service_type",
        "ObjectClass": "class",
        "ObjectDN": "object",
        "ObjectGUID": "service_guid",
        "OpCorrelationID": "operation_id",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5139: {
        "AppCorrelationID": "application_id",
        "DSName": "service",
        "DSType": "service_type",
        "NewObjectDN": "new_object",
        "ObjectClass": "class",
        "ObjectGUID": "object_guid",
        "OldObjectDN": "object",
        "OpCorrelationID": "operation_id",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5140: {
        "AccessList": "access",
        "AccessMask": "access_mask",
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "ObjectType": "object_type",
        "ShareName": "share_name",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5141: {
        "AppCorrelationID": "application_id",
        "DSName": "service",
        "DSType": "service_type",
        "ObjectClass": "class",
        "ObjectDN": "object",
        "ObjectGUID": "object_guid",
        "OpCorrelationID": "operation_id",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "TreeDelete": "tree_delete",
    },
    5142: {
        "ShareLocalPath": "share_path",
        "ShareName": "share_name",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5143: {
        "NewMaxUsers": "new_max_user",
        "NewRemark": "new_remark",
        "NewSD": "new_sd",
        "NewSd": "new_sd",
        "NewShareFlags": "new_flag",
        "ObjectType": "object_type",
        "OldMaxUsers": "old_max_user",
        "OldRemark": "old_remark",
        "OldSD": "old_sd",
        "OldSd": "old_sd",
        "OldShareFlags": "old_flag",
        "ShareLocalPath": "share_path",
        "ShareName": "share_name",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5144: {
        "ShareLocalPath": "share_path",
        "ShareName": "share_name",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5145: {
        "AccessList": "access",
        "AccessMask": "access_mask",
        "AccessReason": "reason",
        "IpAddress": "source_address",
        "IpPort": "source_port",
        "ObjectType": "object_type",
        "RelativeTargetName": "relative_target",
        "ShareLocalPath": "share_path",
        "ShareName": "share_name",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5152: {
        "Application": "application",
        "DestAddress": "destination_address",
        "DestPort": "destination_port",
        "Direction": "direction",
        "FilterRTID": "filter_id",
        "LayerName": "layer",
        "LayerRTID": "layer_id",
        "SourceAddress": "source_address",
        "SourcePort": "source_port",
        "protocol": "protocol",
    },
    5154: {
        "Application": "application",
        "FilterRTID": "filter_id",
        "LayerName": "layer",
        "LayerRTID": "layer_id",
        "SourceAddress": "source_address",
        "SourcePort": "source_port",
    },
    5156: {
        "Application": "application",
        "DestAddress": "destination_address",
        "DestPort": "destination_port",
        "Direction": "direction",
        "FilterRTID": "filter_id",
        "LayerName": "layer",
        "LayerRTID": "layer_id",
        "RemoteMachineID": "machine_id",
        "RemoteUserID": "user_id",
        "SourceAddress": "source_address",
        "SourcePort": "source_port",
        "protocol": "protocol",
    },
    5157: {
        "Application": "application",
        "DestAddress": "destination_address",
        "DestPort": "destination_port",
        "Direction": "direction",
        "FilterRTID": "filter_id",
        "LayerName": "layer",
        "LayerRTID": "layer_id",
        "RemoteMachineID": "machine_id",
        "RemoteUserID": "user_id",
        "SourceAddress": "source_address",
        "SourcePort": "source_port",
        "protocol": "protocol",
    },
    5158: {
        "Application": "application",
        "FilterRTID": "filter_id",
        "LayerName": "layer",
        "LayerRTID": "layer_id",
        "SourceAddress": "source_address",
        "SourcePort": "source_port",
    },
    5169: {
        "AppCorrelationID": "application_id",
        "AttributeLDAPDisplayName": "ldap_display",
        "AttributeSyntaxOID": "attribute_id",
        "AttributeValue": "attribute_value",
        "DSName": "service",
        "DSType": "service_type",
        "ExecutionProcessID": "execution_process_id",
        "ObjectClass": "class",
        "ObjectDN": "object",
        "ObjectGUID": "service_guid",
        "OpCorrelationID": "operation_id",
        "OperationType": "operation_type",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5170: {
        "AppCorrelationID": "application_id",
        "AttributeLDAPDisplayName": "ldap_display",
        "AttributeSyntaxOID": "attribute_id",
        "AttributeValue": "attribute_value",
        "DSName": "service",
        "DSType": "service_type",
        "ExecutionProcessID": "execution_process_id",
        "ExpirationTime": "exipre_ts",
        "ObjectClass": "class",
        "ObjectDN": "object",
        "ObjectGUID": "service_guid",
        "OpCorrelationID": "operation_id",
        "OperationType": "operation_type",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    5379: {
        "CountOfCredentialsReturned": "credential_returned_count",
        "ProcessCreationTime": "process_creation_ts",
        "ReadOperation": "read_operation",
        "ReturnCode": "return_code",
        "TargetName": "target",
    },
    5440: {
        "CalloutId": "callout_id",
        "CalloutKey": "callout_key",
        "CalloutName": "callout",
        "CalloutType": "callout_type",
        "LayerId": "layer_id",
        "LayerKey": "layer_key",
        "LayerName": "layer",
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
    },
    5441: {
        "CalloutKey": "callout_key",
        "CalloutName": "callout",
        "Conditions": "condition",
        "FilterId": "filter_id",
        "FilterKey": "filter_key",
        "FilterName": "filter",
        "FilterType": "filter_type",
        "LayerId": "layer_id",
        "LayerKey": "layer_key",
        "LayerName": "layer",
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "Weight": "weight",
    },
    5442: {
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "ProviderType": "provider_type",
    },
    5444: {
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "SubLayerKey": "layer_key",
        "SubLayerName": "layer",
        "SubLayerType": "layer_type",
        "Weight": "weight",
    },
    5446: {
        "CalloutId": "callout_id",
        "CalloutKey": "callout_key",
        "CalloutName": "callout",
        "CalloutType": "callout_type",
        "ChangeType": "action",
        "LayerId": "layer_id",
        "LayerKey": "layer_key",
        "LayerName": "layer",
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "UserName": "user",
        "UserSid": "user_id",
    },
    5447: {
        "CalloutKey": "callout_key",
        "CalloutName": "callout",
        "ChangeType": "action",
        "Conditions": "condition",
        "FilterId": "filter_id",
        "FilterKey": "filter_key",
        "FilterName": "filter",
        "FilterType": "filter_type",
        "LayerId": "layer_id",
        "LayerKey": "layer_key",
        "LayerName": "layer",
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "UserName": "user",
        "UserSid": "user_id",
        "Weight": "weight",
    },
    5448: {
        "ChangeType": "action",
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "ProviderType": "provider_type",
        "UserName": "user",
        "UserSid": "user_id",
    },
    5449: {
        "ChangeType": "action",
        "ProviderContextKey": "context_key",
        "ProviderContextName": "context",
        "ProviderContextType": "context_type",
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "UserName": "user",
        "UserSid": "user_id",
    },
    5450: {
        "ChangeType": "action",
        "ProviderKey": "provider_key",
        "ProviderName": "provider",
        "SubLayerKey": "layer_key",
        "SubLayerName": "layer",
        "SubLayerType": "layer_type",
        "UserName": "user",
        "UserSid": "user_id",
        "Weight": "weight",
    },
    6144: {"ErrorCode": "status_code"},
    6272: {
        "AccountSessionIdentifier": "account_session_id",
        "AuthenticationProvider": "authentication_provider",
        "AuthenticationServer": "authentication_server",
        "AuthenticationType": "authentication_type",
        "CalledStationID": "called_station_id",
        "CallingStationID": "calling_station_id",
        "ClientIPAddress": "source_address",
        "ClientName": "target_user",
        "EAPType": "eap_type",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "FullyQualifiedSubjectMachineName": "machine_name",
        "FullyQualifiedSubjectUserName": "username",
        "LoggingResult": "result",
        "NASIPv4Address": "nas_address",
        "NASIPv6Address": "nas_ipv6_address",
        "NASIdentifier": "nas_id",
        "NASPort": "nas_port",
        "NASPortType": "nas_port_type",
        "NetworkPolicyName": "policy",
        "ProxyPolicyName": "proxy_policy",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "domain",
        "SubjectMachineName": "machine",
        "SubjectMachineSID": "machine_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    6273: {
        "AccountSessionIdentifier": "account_session_id",
        "AuthenticationProvider": "authentication_provider",
        "AuthenticationServer": "authentication_server",
        "AuthenticationType": "authentication_type",
        "CalledStationID": "called_station_id",
        "CallingStationID": "calling_station_id",
        "ClientIPAddress": "source_address",
        "ClientName": "target_user",
        "EAPType": "eap_type",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "FullyQualifiedSubjectMachineName": "machine_name",
        "FullyQualifiedSubjectUserName": "username",
        "LoggingResult": "result",
        "NASIPv4Address": "nas_address",
        "NASIPv6Address": "nas_ipv6_address",
        "NASIdentifier": "nas_id",
        "NASPort": "nas_port",
        "NASPortType": "nas_port_type",
        "NetworkPolicyName": "policy",
        "ProxyPolicyName": "proxy_policy",
        "Reason": "reason",
        "ReasonCode": "status_code",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "domain",
        "SubjectMachineName": "machine",
        "SubjectMachineSID": "machine_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    6274: {
        "AccountSessionIdentifier": "account_session_id",
        "AuthenticationProvider": "authentication_provider",
        "AuthenticationServer": "authentication_server",
        "AuthenticationType": "authentication_type",
        "CalledStationID": "called_station_id",
        "CallingStationID": "calling_station_id",
        "ClientIPAddress": "source_address",
        "ClientName": "target_user",
        "EAPType": "eap_type",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "FullyQualifiedSubjectMachineName": "machine_name",
        "FullyQualifiedSubjectUserName": "username",
        "NASIPv4Address": "nas_address",
        "NASIPv6Address": "nas_ipv6_address",
        "NASIdentifier": "nas_id",
        "NASPort": "nas_port",
        "NASPortType": "nas_port_type",
        "NetworkPolicyName": "policy",
        "ProxyPolicyName": "proxy_policy",
        "Reason": "reason",
        "ReasonCode": "status_code",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "domain",
        "SubjectMachineName": "machine",
        "SubjectMachineSID": "machine_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    6278: {
        "AccountSessionIdentifier": "account_session_id",
        "AuthenticationProvider": "authentication_provider",
        "AuthenticationServer": "authentication_server",
        "AuthenticationType": "authentication_type",
        "CalledStationID": "called_station_id",
        "CallingStationID": "calling_station_id",
        "ClientIPAddress": "source_address",
        "ClientName": "target_user",
        "EAPType": "eap_type",
        "ExecutionProcessID": "execution_process_id",
        "ExecutionThreadID": "execution_thread_id",
        "ExtendedQuarantineState": "extended_quarantine_state",
        "FullyQualifiedSubjectMachineName": "machine_name",
        "FullyQualifiedSubjectUserName": "username",
        "MachineInventory": "machine_inventory",
        "NASIPv4Address": "nas_address",
        "NASIPv6Address": "nas_ipv6_address",
        "NASIdentifier": "nas_id",
        "NASPort": "nas_port",
        "NASPortType": "nas_port_type",
        "NetworkPolicyName": "policy",
        "ProxyPolicyName": "proxy_policy",
        "QuarantineHelpURL": "quarantine_help_url",
        "QuarantineSessionID": "quarantine_session_id",
        "QuarantineState": "quarantine_state",
        "QuarantineSystemHealthResult": "quarantine_system_health_result",
        "SourceModuleName": "source_module",
        "SubjectDomainName": "domain",
        "SubjectMachineName": "machine",
        "SubjectMachineSID": "machine_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
    },
    6416: {
        "ClassId": "class_id",
        "ClassName": "class",
        "CompatibleIds": "compatible_id",
        "DeviceDescription": "device_description",
        "DeviceId": "device_id",
        "LocationInformation": "location",
        "SubjectDomainName": "domain",
        "SubjectLogonId": "logon_id",
        "SubjectUserName": "user",
        "SubjectUserSid": "user_id",
        "VendorIds": "vendor_id",
    },
}

logpoint_windows_service_control_manager_mapping = {
    7000: {"param1": "service", "param2": "reason"},
    7001: {
        "Binary": "event_data",
        "param1": "service",
        "param2": "caller_service",
        "param3": "reason",
    },
    7002: {"Binary": "event_data", "param1": "service", "param2": "group"},
    7003: {"param1": "service", "param2": "caller_service"},
    7005: {"param1": "function", "param2": "reason"},
    7006: {"param1": "function", "param2": "registry", "param3": "reason"},
    7009: {"param1": "duration", "param2": "service"},
    7010: {"param1": "duration"},
    7011: {"param1": "duration", "param2": "service"},
    7015: {"param1": "driver"},
    7016: {"param1": "service", "param2": "status"},
    7017: {"param1": "service"},
    7019: {"param1": "service"},
    7020: {"param1": "service"},
    7021: {"param1": "service"},
    7022: {"param1": "service"},
    7023: {"param1": "service", "param2": "reason"},
    7024: {"Binary": "event_data", "param1": "service", "param2": "reason"},
    7026: {"param1": "driver"},
    7028: {"param1": "registry_key"},
    7030: {"param1": "service"},
    7031: {
        "Binary": "event_data",
        "param1": "service",
        "param2": "count",
        "param3": "duration",
        "param5": "action",
    },
    7032: {"param2": "action", "param3": "service", "param4": "reason"},
    7033: {"param1": "reason"},
    7034: {"Binary": "event_data", "param1": "service", "param2": "count"},
    7035: {"param1": "service", "param2": "control"},
    7036: {"Binary": "event_data", "param1": "service", "param2": "status"},
    7037: {"param1": "service", "param2": "configuration"},
    7038: {"param1": "service", "param2": "user", "param3": "reason"},
    7039: {"param1": "service", "param2": "target_process_id", "param3": "process_id"},
    7040: {"param1": "service", "param2": "old_value", "param3": "new_value"},
    7041: {"param1": "service", "param2": "user"},
    7042: {
        "param1": "service",
        "param2": "control",
        "param3": "error_code",
        "param4": "reason",
        "param5": "comment",
    },
    7043: {"Binary": "event_data", "param1": "service"},
    7045: {
        "ImagePath": "path",
        "ServiceName": "service",
        "ServiceType": "service_type",
        "StartType": "start_type",
    },
}

logpoint_windows_common_taxonomy = {
    "Provider_Name": "event_source",
    "ComputerName": "workstation",
    "Binary": "binary_data",
    "ProcessGuid": "process_guid",
    "Image": "image",
    "CurrentDirectory": "path",
    "CommandLine": "command",
    "ParentProcessGuid": "parent_process_guid",
    "ParentImage": "parent_process",
    "ParentCommandLine": "parent_command",
    "TargetFilename": "target_file",
    "SourceIp": "source_address",
    "SourceHostname": "source_host",
    "DestinationIp": "destination_address",
    "DestinationHostname": "destination_host",
    "DestinationPort": "destination_port",
    "DestinationPortName": "service",
    "ImageLoaded": "image_loaded",
    "Signed": "is_signed",
    "SignatureStatus": "status",
    "SourceProcessGuid": "source_process_guid",
    "SourceImage": "source_image",
    "SourceThreadId": "source_thread_id",
    "TargetObject": "target_object",
    "PipeName": "pipe",
    "Destination": "destination_address",
    "QueryName": "query",
    "QueryStatus": "status",
    "IsExecutable": "is_executable",
    "Archived": "is_archived",
    "HostName": "host",
    "Initiated": "is_initiated",
    "OriginalFileName": "original_file",
    "Company": "vendor",
    "FileVersion": "file_version",
    "ClientProcessId": "process_id",
    "ClientProcessStartKey": "process_start_key",
    "DomainBehaviorVersion": "domain_behavior_version",
    "EngineVersion": "engine_version",
    "ExtensionId": "extension_id",
    "ExtensionName": "extension_name",
    "HostVersion": "host_version",
    "Host_Version": "version",
    "RpcCallClientLocality": "rpc_client_locality",
    "Volume_Name": "volume",
    "Weight": "weight",
    "X_MS_Endpoint_Absolute_Path": "path",
    "X_MS_Forwarded_Client_IP": "source_address",
    "X_MS_Proxy": "proxy",
    "AccountDomain": "domain",
    "AccountName": "user",
    "Application": "application",
    "AuthoritativeAnswer": "answer",
    "Channel": "channel",
    "ClientAddress": "source_address",
    "ClientName": "remote_user",
    "CommandName": "command",
    "CommandPath": "command_path",
    "CommandType": "command_type",
    "DestAddress": "destination_address",
    "DestPort": "destination_port",
    "FileName": "file",
    "FlagsHex": "flag",
    "HostApplication": "application",
    "HostId": "host_id",
    "IpAddress": "source_address",
    "IpPort": "source_port",
    "MessageNumber": "message_number",
    "MessageTotal": "message_total",
    "NewEngineState": "engine_state",
    "NewProcessId": "target_process_id",
    "NewProcessName": "new_process",
    "NewProviderState": "provider_state",
    "ParentProcessName": "parent_process",
    "PipelineId": "pipeline_id",
    "PreviousEngineState": "old_engine_state",
    "ProcessId": "process_id",
    "ProcessName": "process",
    "ProviderName": "provider",
    "QueryResponseIndicator": "action",
    "QuestionName": "domain",
    "QuestionType": "record_type",
    "RecursionAvailable": "recursion_available",
    "RecursionDesired": "recursion_desired",
    "RemoteIP": "source_address",
    "ResponseCode": "status_code",
    "ScriptBlockId": "script_block_id",
    "ScriptBlockText": "script_block",
    "ScriptName": "script",
    "SendReceiveIndicator": "direction",
    "SequenceNumber": "sequence_number",
    "SourceAddress": "source_address",
    "SourcePort": "source_port",
    "SourceProcessId": "process_id",
    "TargetDomainName": "target_domain",
    "ThreadId": "thread_id",
    "User": "user",
    "WorkstationName": "workstation",
    "MD5": "hash",
    "SHA1": "hash_sha1",
    "SHA256": "hash_sha256",
    "IMPHASH": "hash_import",
    "md5": "hash",
    "sha1": "hash_sha1",
    "sha256": "hash_sha256",
    "Imphash": "hash_import",
}


windows_sysmon_label_mapping = {
    "process_creation": {"label": ("Process", "Create")},
    "file_change": {
        "label": ("File", "Create", "Time", "Change"),
    },
    "network_connection": {"label": ("Network", "Connection", "Detect")},
    "sysmon_status": {"label": ("Service", "State", "Change")},
    "process_termination": {"label": ("Process", "Terminate")},
    "driver_load": {"label": ("Driver", "Load")},
    "image_load": {"label": ("Image", "Load")},
    "create_remote_thread": {"label": ("Remote", "Thread", "Create")},
    "raw_access_thread": {"label": ("Raw", "Access", "Read")},
    "process_access": {"label": ("Process", "Access")},
    "registry_set": {"label": ("Registry", "Value", "Set")},
    "registry_event": {
        "norm_id": "WindowsSysmon",
        "event_id": [12, 13, 14],  # 12, 13, 14
    },
    "registry_rename": {"label": ("Registry", "Key", "Map")},
    "registry_delete": {"label": ("Registry", "Key", "Map")},
    "registry_add": {"label": ("Registry", "Key", "Map")},
    "create_stream_hash": {"label": ("File", "Create", "Stream", "Hash")},
    "pipe_created": {"norm_id": "WindowsSysmon", "event_id": [17, 18]},
    "wmi_event": {"norm_id": "WindowsSysmon", "event_id": [19, 20, 21]},
    "dns_query": {"label": ("DNS", "Query", "Execute")},
    "file_delete": {"label": ("File", "Delete")},
    "clipboard_capture": {"label": ("Clipboard", "Change", "Detect")},
    "process_tampering": {"label": ("Process", "Tamper")},
    "file_block": {"label": ("File", "Block", "Executable")},
    "sysmon_error": {"label": ("Service", "Error")},
    "file_event": {"label": ("File", "Create", "Overwrite")},
}

logpoint_m365_mapping = {
    "eventSource": "event_source",
    "eventName": "alert_name",
    "workload": "application",
    "Workload": "application",
    "ResultStatus": "status",
    "Operation": "operation",
}

# TODO: remove automatic snake conversions after pySigma framework is updated.
logpoint_azure_mapping = {
    "Status": "status",
    "Location": "region",
    "ResultStatus": "result_status",
    "AuthenticationRequirement": "authentication_requirement",
    "HomeTenantId": "home_tenant_id",
    "ResourceTenantId": "resource_tenant_id",
    "ResultType": "result_type",
    "AppId": "app_id",
    "userAgent": "user_agent",
    "ResourceDisplayName": "resource_display_name",
    "ConditionalAccessStatus": "conditional_access_status",
    "NetworkLocationDetails": "network_location_details",
    "ResultDescription": "description",
    "properties.message": "operation",  # TODO: doubt-full conversion
    "OperationName": "operation",
    "Category": "event_category",
    "ActivityDisplayName": "activity",
    "activityType": "activity_type",
    "targetResources.type": "target_type",
    "TargetResources.type": "target_type",
    "LoggedByService": "service",
}

logpoint_azure_activity_taxonomy = {
    "CategoryValue": "event_category",
    "ResourceProviderValue": "resource",
    "ResourceId": "resource_id",
    "OperationNameValue": "operation",
    "operationName": "operation",
    "OperationName": "operation",
    "OperationId": "operation_id",
    "Operation": "operation",
}
