MSSQL$MICROSOFT##WID

50 events across 1 channel

Event	Title	Channel	Sample
833	Event ID 833	Application	Y
852	Event ID 852	Application	Y
958	Event ID 958	Application	Y
3406	Event ID 3406	Application	Y
3407	Event ID 3407	Application	Y
3408	Event ID 3408	Application	Y
3454	Event ID 3454	Application	Y
5084	Event ID 5084	Application	Y
5602	Event ID 5602	Application	Y
5604	Event ID 5604	Application	Y
6253	Event ID 6253	Application	Y
9645	Event ID 9645	Application	Y
9666	Event ID 9666	Application	Y
9688	Event ID 9688	Application	Y
10981	Event ID 10981	Application	Y
15268	Event ID 15268	Application	Y
17069	Event ID 17069	Application	Y
17101	Event ID 17101	Application	Y
17103	Event ID 17103	Application	Y
17104	Event ID 17104	Application	Y
17108	Event ID 17108	Application	Y
17110	Event ID 17110	Application	Y
17111	Event ID 17111	Application	Y
17115	Event ID 17115	Application	Y
17117	Event ID 17117	Application	Y
17118	Event ID 17118	Application	Y
17125	Event ID 17125	Application	Y
17126	Event ID 17126	Application	Y
17136	Event ID 17136	Application	Y
17137	Event ID 17137	Application	Y
17147	Event ID 17147	Application	Y
17152	Event ID 17152	Application	Y
17162	Event ID 17162	Application	Y
17164	Event ID 17164	Application	Y
17199	Event ID 17199	Application	Y
17663	Event ID 17663	Application	Y
17811	Event ID 17811	Application	Y
18100	Event ID 18100	Application	Y
18401	Event ID 18401	Application	Y
18456	Event ID 18456	Application	Y
18496	Event ID 18496	Application	Y
19030	Event ID 19030	Application	Y
26048	Event ID 26048	Application	Y
33217	Event ID 33217	Application	Y
33218	Event ID 33218	Application	Y
49903	Event ID 49903	Application	Y
49904	Event ID 49904	Application	Y
49910	Event ID 49910	Application	Y
49916	Event ID 49916	Application	Y
49917	Event ID 49917	Application	Y

Event ID 833

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 833,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 10:35:02.057701+00:00",
    "event_record_id": 8083,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>1</string>\n<string>15</string>\n<string>C:\\Windows\\WID\\Data\\SUSDB_log.ldf</string>\n<string>5</string>\n<string>0000000000000E34</string>\n<string>0x000000000b4600</string>\n",
    "Binary": "QQMAAAoAAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAAAAAAAA=="
  },
  "message": ""
}

Event ID 852

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 852,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3837,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "540300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 958

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 958,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.965650+00:00",
    "event_record_id": 3858,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "12.00.5214",
    "Binary": "BE0300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3406

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3406,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.371381+00:00",
    "event_record_id": 4448,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "93",
    "Data_1": "master",
    "Data_2": "1",
    "Data_3": "0",
    "Binary": "4E0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 3407

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3407,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.376773+00:00",
    "event_record_id": 4449,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "master",
    "Data_2": "1",
    "Data_3": "0",
    "Binary": "4F0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3408

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3408,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.844490+00:00",
    "event_record_id": 3867,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "500D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3454

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3454,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.377321+00:00",
    "event_record_id": 4450,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "master",
    "Data_1": "1",
    "Binary": "7E0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 5084

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5084,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:59:21.544087+00:00",
    "event_record_id": 3869,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "SINGLE_USER",
    "Data_1": "ON",
    "Data_2": "IPAM",
    "Binary": "DC1300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000050000004900500041004D000000"
  },
  "message": ""
}

Event ID 5602

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5602,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.954518+00:00",
    "event_record_id": 3853,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E21500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 5604

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5604,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.900346+00:00",
    "event_record_id": 3846,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E41500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 6253

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 6253,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.780901+00:00",
    "event_record_id": 3845,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "v4.0.30319",
    "Data_1": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\",
    "Binary": "6D1800000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 9645

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Error

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9645,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T23:13:40.001635+00:00",
    "event_record_id": 4285,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "3602",
    "Data_1": "32",
    "Binary": "AD250000100000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 9666

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9666,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.374725+00:00",
    "event_record_id": 3863,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Service Broker",
    "Binary": "C22500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 9688

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9688,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.385838+00:00",
    "event_record_id": 3865,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "D82500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 10981

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 10981,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.910047+00:00",
    "event_record_id": 3847,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E52A00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 15268

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 15268,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3829,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "WINDOWS-ONLY",
    "Binary": "A43B00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17069

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17069,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3823,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Microsoft SQL Server 2014 (SP2-GDR) (KB4057120) - 12.0.5214.6 (X64) \n\tJan  9 2018 15:03:12 \n\tCopyright (c) Microsoft Corporation\n\tWindows Internal Database (64-bit) on Windows NT 6.3 <X64> (Build 20348: ) (Hypervisor)\n",
    "Binary": "AD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17101

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17101,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3825,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "CD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17103

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17103,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3826,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "CF4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17104

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17104,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3827,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "900",
    "Binary": "D04200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17108

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17108,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.944534+00:00",
    "event_record_id": 3852,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "D44200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17110

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17110,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3832,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\r\n\t -d C:\\Windows\\WID\\Data\\master.mdf\r\n\t -l C:\\Windows\\WID\\Data\\mastlog.ldf\r\n\t -e C:\\Windows\\WID\\Log\\error.log\r\n\t -K\r\n\t -T 1617\r\n\t -w 65535",
    "Binary": "D64200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17111

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17111,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3830,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "C:\\Windows\\WID\\Log\\error.log",
    "Binary": "D74200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17115

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17115,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3833,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\r\n\t -S \"MSWIN8.SQLWID\"\r\n\t -s \"MICROSOFT##WID\"",
    "Binary": "DB4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17117

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17117,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.281003+00:00",
    "event_record_id": 3862,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Binary": "DD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000007000000740065006D007000640062000000"
  },
  "message": ""
}

Event ID 17118

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17118,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.561268+00:00",
    "event_record_id": 3842,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "disabled",
    "Binary": "DE4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17125

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17125,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.561268+00:00",
    "event_record_id": 3841,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "2500",
    "Data_1": "5000",
    "Binary": "E54200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17126

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17126,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.844490+00:00",
    "event_record_id": 3866,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E64200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17136

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17136,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.098199+00:00",
    "event_record_id": 3860,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "F04200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17137

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17137,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.608551+00:00",
    "event_record_id": 3844,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "master",
    "Binary": "F14200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17147

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17147,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:03:33.524248+00:00",
    "event_record_id": 533,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "+0IAAAoAAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAAAAAAAA=="
  },
  "message": ""
}

Event ID 17152

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17152,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.545412+00:00",
    "event_record_id": 3840,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "0000000000003fff",
    "Data_2": "0",
    "Data_3": "0000000000003fff",
    "Data_4": "0",
    "Binary": "004300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17162

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17162,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3835,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "0A4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17164

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17164,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3834,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Data_1": "14",
    "Data_2": "14",
    "Data_3": "14",
    "Data_4": "14",
    "Binary": "0C4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17199

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17199,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.956870+00:00",
    "event_record_id": 3856,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "7806",
    "Binary": "2F4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17663

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17663,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.937659+00:00",
    "event_record_id": 3851,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "LAB-DC01\\MICROSOFT##WID",
    "Binary": "FF4400000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17811

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17811,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.539307+00:00",
    "event_record_id": 3839,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Binary": "934500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 18100

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18100,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:59:32.654855+00:00",
    "event_record_id": 3875,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "51",
    "Data_1": "LAB-DC01",
    "Data_2": "8676",
    "Binary": "B44600000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 18401

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18401,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:04:35.258327+00:00",
    "event_record_id": 599,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Data_0": "<string>NT AUTHORITY\\NETWORK SERVICE</string>\n<string> [CLIENT: <named pipe>]</string>\n",
    "Binary": "4UcAAA4AAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAABwAAAG0AYQBzAHQAZQByAAAA"
  },
  "message": ""
}

Event ID 18456

Provider: MSSQL$MICROSOFT##WID
Channel: Application

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18456,
    "version": 0,
    "level": 0,
    "task": 4,
    "opcode": 0,
    "keywords": 40532396646334464,
    "time_created": "2026-03-13T23:03:32.326011+00:00",
    "event_record_id": 4187,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ludus\\svc_adfs",
    "Data_1": " Reason: Could not find a login matching the name provided.",
    "Data_2": " [CLIENT: <named pipe>]",
    "Binary": "184800000E0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 18496

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18496,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3828,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "QEMU",
    "Data_1": "Standard PC (i440FX + PIIX, 1996)",
    "Binary": "404800000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 19030

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 19030,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.936544+00:00",
    "event_record_id": 3850,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Data_1": "sa",
    "Binary": "564A00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 26048

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 26048,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.956268+00:00",
    "event_record_id": 3855,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\\\\.\\pipe\\MICROSOFT##WID\\tsql\\query",
    "Binary": "C06500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 33217

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 33217,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.910648+00:00",
    "event_record_id": 3848,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "C18100000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 33218

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 33218,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.911163+00:00",
    "event_record_id": 3849,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "C28100000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 49903

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49903,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3836,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "51199",
    "Binary": "EFC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49904

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49904,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3831,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "NT SERVICE\\MSSQL$MICROSOFT##WID",
    "Binary": "F0C200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49910

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49910,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.608551+00:00",
    "event_record_id": 3843,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "F6C200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49916

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49916,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3824,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "00",
    "Binary": "FCC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49917

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49917,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.462396+00:00",
    "event_record_id": 3838,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "SQL_Latin1_General_CP1_CI_AS",
    "Data_1": "us_english",
    "Data_2": "1033",
    "Binary": "FDC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)