MSSQL$MICROSOFT##WID

Event	Title	Channel	Sample	Rule
833	Event ID 833	Application	Y	N
852	Event ID 852	Application	Y	N
958	Event ID 958	Application	Y	N
3406	Event ID 3406	Application	Y	N
3407	Event ID 3407	Application	Y	N
3408	Event ID 3408	Application	Y	N
3454	Event ID 3454	Application	Y	N
5084	Event ID 5084	Application	Y	N
5602	Event ID 5602	Application	Y	N
5604	Event ID 5604	Application	Y	N
6253	Event ID 6253	Application	Y	N
9645	Event ID 9645	Application	Y	N
9666	Event ID 9666	Application	Y	N
9688	Event ID 9688	Application	Y	N
10981	Event ID 10981	Application	Y	N
15268	Event ID 15268	Application	Y	N
17069	Event ID 17069	Application	Y	N
17101	Event ID 17101	Application	Y	N
17103	Event ID 17103	Application	Y	N
17104	Event ID 17104	Application	Y	N
17108	Event ID 17108	Application	Y	N
17110	Event ID 17110	Application	Y	N
17111	Event ID 17111	Application	Y	N
17115	Event ID 17115	Application	Y	N
17117	Event ID 17117	Application	Y	N
17118	Event ID 17118	Application	Y	N
17125	Event ID 17125	Application	Y	N
17126	Event ID 17126	Application	Y	N
17136	Event ID 17136	Application	Y	N
17137	Event ID 17137	Application	Y	N
17147	Event ID 17147	Application	Y	N
17152	Event ID 17152	Application	Y	N
17162	Event ID 17162	Application	Y	N
17164	Event ID 17164	Application	Y	N
17199	Event ID 17199	Application	Y	N
17663	Event ID 17663	Application	Y	N
17811	Event ID 17811	Application	Y	N
18100	Event ID 18100	Application	Y	N
18401	Event ID 18401	Application	Y	N
18456	Event ID 18456	Application	Y	N
18496	Event ID 18496	Application	Y	N
19030	Event ID 19030	Application	Y	N
26048	Event ID 26048	Application	Y	N
33217	Event ID 33217	Application	Y	N
33218	Event ID 33218	Application	Y	N
49903	Event ID 49903	Application	Y	N
49904	Event ID 49904	Application	Y	N
49910	Event ID 49910	Application	Y	N
49916	Event ID 49916	Application	Y	N
49917	Event ID 49917	Application	Y	N

Event ID 833

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 833,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 10:35:02.057701+00:00",
    "event_record_id": 8083,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>1</string>\n<string>15</string>\n<string>C:\\Windows\\WID\\Data\\SUSDB_log.ldf</string>\n<string>5</string>\n<string>0000000000000E34</string>\n<string>0x000000000b4600</string>\n",
    "Binary": "QQMAAAoAAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAAAAAAAA=="
  },
  "message": ""
}

Event ID 852

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 852,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3837,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "540300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 958

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 958,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.965650+00:00",
    "event_record_id": 3858,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "12.00.5214",
    "Binary": "BE0300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3406

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3406,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.371381+00:00",
    "event_record_id": 4448,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "93",
    "Data_1": "master",
    "Data_2": "1",
    "Data_3": "0",
    "Binary": "4E0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 3407

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3407,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.376773+00:00",
    "event_record_id": 4449,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "master",
    "Data_2": "1",
    "Data_3": "0",
    "Binary": "4F0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3408

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3408,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.844490+00:00",
    "event_record_id": 3867,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "500D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3454

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3454,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.377321+00:00",
    "event_record_id": 4450,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "master",
    "Data_1": "1",
    "Binary": "7E0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 5084

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5084,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:59:21.544087+00:00",
    "event_record_id": 3869,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "SINGLE_USER",
    "Data_1": "ON",
    "Data_2": "IPAM",
    "Binary": "DC1300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000050000004900500041004D000000"
  },
  "message": ""
}

Event ID 5602

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5602,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.954518+00:00",
    "event_record_id": 3853,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E21500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 5604

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5604,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.900346+00:00",
    "event_record_id": 3846,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E41500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 6253

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 6253,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.780901+00:00",
    "event_record_id": 3845,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "v4.0.30319",
    "Data_1": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\",
    "Binary": "6D1800000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 9645

Channel: Application
Level: Error

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9645,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T23:13:40.001635+00:00",
    "event_record_id": 4285,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "3602",
    "Data_1": "32",
    "Binary": "AD250000100000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 9666

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9666,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.374725+00:00",
    "event_record_id": 3863,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Service Broker",
    "Binary": "C22500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 9688

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9688,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.385838+00:00",
    "event_record_id": 3865,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "D82500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 10981

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 10981,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.910047+00:00",
    "event_record_id": 3847,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E52A00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 15268

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 15268,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3829,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "WINDOWS-ONLY",
    "Binary": "A43B00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17069

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17069,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3823,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Microsoft SQL Server 2014 (SP2-GDR) (KB4057120) - 12.0.5214.6 (X64) \n\tJan  9 2018 15:03:12 \n\tCopyright (c) Microsoft Corporation\n\tWindows Internal Database (64-bit) on Windows NT 6.3 <X64> (Build 20348: ) (Hypervisor)\n",
    "Binary": "AD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17101

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17101,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3825,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "CD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17103

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17103,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3826,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "CF4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17104

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17104,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3827,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "900",
    "Binary": "D04200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17108

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17108,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.944534+00:00",
    "event_record_id": 3852,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "D44200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17110

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17110,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3832,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\r\n\t -d C:\\Windows\\WID\\Data\\master.mdf\r\n\t -l C:\\Windows\\WID\\Data\\mastlog.ldf\r\n\t -e C:\\Windows\\WID\\Log\\error.log\r\n\t -K\r\n\t -T 1617\r\n\t -w 65535",
    "Binary": "D64200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17111

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17111,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3830,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "C:\\Windows\\WID\\Log\\error.log",
    "Binary": "D74200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17115

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17115,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3833,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\r\n\t -S \"MSWIN8.SQLWID\"\r\n\t -s \"MICROSOFT##WID\"",
    "Binary": "DB4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17117

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17117,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.281003+00:00",
    "event_record_id": 3862,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Binary": "DD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000007000000740065006D007000640062000000"
  },
  "message": ""
}

Event ID 17118

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17118,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.561268+00:00",
    "event_record_id": 3842,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "disabled",
    "Binary": "DE4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17125

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17125,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.561268+00:00",
    "event_record_id": 3841,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "2500",
    "Data_1": "5000",
    "Binary": "E54200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17126

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17126,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.844490+00:00",
    "event_record_id": 3866,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E64200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17136

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17136,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.098199+00:00",
    "event_record_id": 3860,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "F04200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17137

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17137,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.608551+00:00",
    "event_record_id": 3844,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "master",
    "Binary": "F14200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17147

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17147,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:03:33.524248+00:00",
    "event_record_id": 533,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "+0IAAAoAAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAAAAAAAA=="
  },
  "message": ""
}

Event ID 17152

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17152,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.545412+00:00",
    "event_record_id": 3840,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "0000000000003fff",
    "Data_2": "0",
    "Data_3": "0000000000003fff",
    "Data_4": "0",
    "Binary": "004300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17162

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17162,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3835,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "0A4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17164

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17164,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3834,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Data_1": "14",
    "Data_2": "14",
    "Data_3": "14",
    "Data_4": "14",
    "Binary": "0C4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17199

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17199,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.956870+00:00",
    "event_record_id": 3856,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "7806",
    "Binary": "2F4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17663

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17663,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.937659+00:00",
    "event_record_id": 3851,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "LAB-DC01\\MICROSOFT##WID",
    "Binary": "FF4400000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17811

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17811,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.539307+00:00",
    "event_record_id": 3839,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Binary": "934500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 18100

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18100,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:59:32.654855+00:00",
    "event_record_id": 3875,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "51",
    "Data_1": "LAB-DC01",
    "Data_2": "8676",
    "Binary": "B44600000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 18401

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18401,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:04:35.258327+00:00",
    "event_record_id": 599,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Data_0": "<string>NT AUTHORITY\\NETWORK SERVICE</string>\n<string> [CLIENT: <named pipe>]</string>\n",
    "Binary": "4UcAAA4AAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAABwAAAG0AYQBzAHQAZQByAAAA"
  },
  "message": ""
}

Event ID 18456

Channel: Application

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18456,
    "version": 0,
    "level": 0,
    "task": 4,
    "opcode": 0,
    "keywords": 40532396646334464,
    "time_created": "2026-03-13T23:03:32.326011+00:00",
    "event_record_id": 4187,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ludus\\svc_adfs",
    "Data_1": " Reason: Could not find a login matching the name provided.",
    "Data_2": " [CLIENT: <named pipe>]",
    "Binary": "184800000E0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 18496

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18496,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3828,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "QEMU",
    "Data_1": "Standard PC (i440FX + PIIX, 1996)",
    "Binary": "404800000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 19030

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 19030,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.936544+00:00",
    "event_record_id": 3850,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Data_1": "sa",
    "Binary": "564A00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 26048

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 26048,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.956268+00:00",
    "event_record_id": 3855,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\\\\.\\pipe\\MICROSOFT##WID\\tsql\\query",
    "Binary": "C06500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 33217

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 33217,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.910648+00:00",
    "event_record_id": 3848,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "C18100000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 33218

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 33218,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.911163+00:00",
    "event_record_id": 3849,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "C28100000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 49903

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49903,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3836,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "51199",
    "Binary": "EFC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49904

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49904,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3831,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "NT SERVICE\\MSSQL$MICROSOFT##WID",
    "Binary": "F0C200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49910

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49910,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.608551+00:00",
    "event_record_id": 3843,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "F6C200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49916

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49916,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3824,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "00",
    "Binary": "FCC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49917

Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49917,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.462396+00:00",
    "event_record_id": 3838,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "SQL_Latin1_General_CP1_CI_AS",
    "Data_1": "us_english",
    "Data_2": "1033",
    "Binary": "FDC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}