MSSQL$SQLEXPRESS

63 events across 1 channel

Event	Title	Channel	Sample
1	Event ID 1	Application	Y
852	Event ID 852	Application	Y
873	Event ID 873	Application	Y
894	Event ID 894	Application	Y
944	Event ID 944	Application	Y
951	Event ID 951	Application	Y
958	Event ID 958	Application	Y
1486	Event ID 1486	Application	Y
3408	Event ID 3408	Application	Y
5084	Event ID 5084	Application	Y
5701	Event ID 5701	Application	Y
5703	Event ID 5703	Application	Y
6253	Event ID 6253	Application	Y
6527	Event ID 6527	Application	Y
8128	Event ID 8128	Application	Y
9048	Event ID 9048	Application	Y
9666	Event ID 9666	Application	Y
9688	Event ID 9688	Application	Y
15268	Event ID 15268	Application	Y
15281	Event ID 15281	Application	Y
15457	Event ID 15457	Application	Y
17069	Event ID 17069	Application	Y
17101	Event ID 17101	Application	Y
17103	Event ID 17103	Application	Y
17104	Event ID 17104	Application	Y
17107	Event ID 17107	Application	Y
17108	Event ID 17108	Application	Y
17110	Event ID 17110	Application	Y
17111	Event ID 17111	Application	Y
17115	Event ID 17115	Application	Y
17118	Event ID 17118	Application	Y
17125	Event ID 17125	Application	Y
17126	Event ID 17126	Application	Y
17136	Event ID 17136	Application	Y
17137	Event ID 17137	Application	Y
17148	Event ID 17148	Application	Y
17152	Event ID 17152	Application	Y
17162	Event ID 17162	Application	Y
17164	Event ID 17164	Application	Y
17176	Event ID 17176	Application	Y
17199	Event ID 17199	Application	Y
17264	Event ID 17264	Application	Y
17656	Event ID 17656	Application	Y
17658	Event ID 17658	Application	Y
17663	Event ID 17663	Application	Y
17811	Event ID 17811	Application	Y
18496	Event ID 18496	Application	Y
19030	Event ID 19030	Application	Y
19032	Event ID 19032	Application	Y
25753	Event ID 25753	Application	Y
25754	Event ID 25754	Application	Y
26018	Event ID 26018	Application	Y
26048	Event ID 26048	Application	Y
26067	Event ID 26067	Application	Y
26076	Event ID 26076	Application	Y
33090	Event ID 33090	Application	Y
33217	Event ID 33217	Application	Y
33218	Event ID 33218	Application	Y
49903	Event ID 49903	Application	Y
49904	Event ID 49904	Application	Y
49910	Event ID 49910	Application	Y
49916	Event ID 49916	Application	Y
49917	Event ID 49917	Application	Y

Event ID 1

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 19:00:20.982807+00:00",
    "event_record_id": 1727,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>SqlCeip started  pid: 7416 instance: SQLEXPRESS CPEFlag: True</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 852

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 852,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1364,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "VAMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 873

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 873,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.021164+00:00",
    "event_record_id": 1367,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "aQMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 894

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 894,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.927385+00:00",
    "event_record_id": 1365,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>4194304</string>\n<string>2406268</string>\n",
    "Binary": "fgMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 944

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 944,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.974766+00:00",
    "event_record_id": 1380,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>master</string>\n<string>927</string>\n<string>957</string>\n",
    "Binary": "sAMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 951

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 951,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.974766+00:00",
    "event_record_id": 1381,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>master</string>\n<string>927</string>\n<string>928</string>\n",
    "Binary": "twMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 958

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 958,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.584597+00:00",
    "event_record_id": 1420,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>16.00.1000</string>\n",
    "Binary": "vgMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 1486

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 1486,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.521643+00:00",
    "event_record_id": 1374,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "zgUAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 3408

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 3408,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:45.084618+00:00",
    "event_record_id": 1492,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "UA0AAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 5084

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 5084,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:45.241428+00:00",
    "event_record_id": 1495,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1000"
    }
  },
  "event_data": {
    "Data_0": "<string>RECOVERY</string>\n<string>SIMPLE</string>\n<string>model</string>\n",
    "Binary": "3BMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 5701

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 5701,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:45.163353+00:00",
    "event_record_id": 1493,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1000"
    }
  },
  "event_data": {
    "Data_0": "<string>master</string>\n",
    "Binary": "RRYAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 5703

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 5703,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:45.163353+00:00",
    "event_record_id": 1494,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1000"
    }
  },
  "event_data": {
    "Data_0": "<string>us_english</string>\n",
    "Binary": "RxYAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 6253

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 6253,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.490841+00:00",
    "event_record_id": 1411,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>v4.0.30319</string>\n<string>C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\</string>\n",
    "Binary": "bRgAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 6527

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 6527,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:46.538504+00:00",
    "event_record_id": 1508,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "fxkAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 8128

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 8128,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:49.961617+00:00",
    "event_record_id": 1669,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1000"
    }
  },
  "event_data": {
    "Data_0": "<string>xpstar.dll</string>\n<string>2022.160.1000</string>\n<string>xp_sqlagent_is_starting</string>\n",
    "Binary": "wB8AAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 9048

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 9048,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.521643+00:00",
    "event_record_id": 1375,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>clflush</string>\n",
    "Binary": "WCMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 9666

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 9666,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:55.870483+00:00",
    "event_record_id": 1714,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Service Broker</string>\n",
    "Binary": "wiUAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 9688

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 9688,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:55.886095+00:00",
    "event_record_id": 1716,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "2CUAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 15268

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 15268,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1356,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>WINDOWS-ONLY</string>\n",
    "Binary": "pDsAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 15281

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: Informational

Fields #

Name	Description
`Data`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 15281,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2020-08-03T08:11:51.057019+00:00",
    "event_record_id": 37899,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAPTOP-JU4M3I0E",
    "security": {
      "user_id": "S-1-5-21-1586556212-2165235939-1437495523-1001"
    }
  },
  "event_data": {
    "Data": [
      "procedure",
      "sys.xp_cmdshell",
      "xp_cmdshell",
      "xp_cmdshell",
      "xp_cmdshell",
      "xp_cmdshell"
    ],
    "Binary": "sTsAAAoAAAAbAAAATABBAFAAVABPAFAALQBKAFUANABNADMASQAwAEUAXABTAFEATABFAFgAUABSAEUAUwBTAAAABwAAAG0AYQBzAHQAZQByAAAA"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 15457

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 15457,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:45.288338+00:00",
    "event_record_id": 1496,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1000"
    }
  },
  "event_data": {
    "Data_0": "<string>show advanced options</string>\n<string>0</string>\n<string>1</string>\n",
    "Binary": "YTwAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 17069

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17069,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1350,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Microsoft SQL Server 2022 (RTM) - 16.0.1000.6 (X64) \n\tOct  8 2022 05:58:25 \n\tCopyright (C) 2022 Microsoft Corporation\n\tExpress Edition (64-bit) on Windows Server 2022 Standard Evaluation 10.0 <X64> (Build 20348: ) (Hypervisor)\n</string>\n",
    "Binary": "rUIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17101

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17101,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1352,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "zUIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17103

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17103,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1353,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "z0IAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17104

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17104,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1354,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>8832</string>\n",
    "Binary": "0EIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17107

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17107,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.287275+00:00",
    "event_record_id": 1369,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "00IAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17108

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17108,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.553381+00:00",
    "event_record_id": 1417,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "1EIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17110

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17110,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1359,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>\n\t -d C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\DATA\\master.mdf\n\t -e C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\ERRORLOG\n\t -l C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\DATA\\mastlog.ldf</string>\n",
    "Binary": "1kIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17111

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17111,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1357,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Log\\ERRORLOG</string>\n",
    "Binary": "10IAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17115

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17115,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1360,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>\n\t -s \"SQLEXPRESS\"\n\t -m \"SqlSetup\"\n\t -Q\n\t -q \"SQL_Latin1_General_CP1_CI_AS\"\n\t -T 4022\n\t -T 4010\n\t -T 3659\n\t -T 3610\n\t -T 8015\n\t -d \"C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Template Data\\master.mdf\"\n\t -l \"C:\\Program Files\\Microsoft SQL Server\\MSSQL16.SQLEXPRESS\\MSSQL\\Template Data\\mastlog.ldf\"</string>\n",
    "Binary": "20IAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17118

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17118,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.506020+00:00",
    "event_record_id": 1373,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>disabled</string>\n",
    "Binary": "3kIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17125

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17125,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.427896+00:00",
    "event_record_id": 1372,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>2500</string>\n<string>5000</string>\n",
    "Binary": "5UIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17126

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17126,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.943968+00:00",
    "event_record_id": 1488,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "5kIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17136

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17136,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.912714+00:00",
    "event_record_id": 1481,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "8EIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 17137

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17137,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.521643+00:00",
    "event_record_id": 1379,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>master</string>\n",
    "Binary": "8UIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17148

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17148,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:46.538504+00:00",
    "event_record_id": 1507,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "/EIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 17152

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17152,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.412270+00:00",
    "event_record_id": 1371,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>0</string>\n<string>000000000000000f</string>\n<string>0</string>\n<string>000000000000000f</string>\n<string>0</string>\n",
    "Binary": "AEMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17162

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17162,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1362,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "CkMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17164

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17164,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1361,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>1</string>\n<string>12</string>\n<string>12</string>\n<string>12</string>\n<string>4</string>\n",
    "Binary": "DEMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17176

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17176,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:48.242029+00:00",
    "event_record_id": 1531,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>8832</string>\n<string>5/8/2026 6:54:46 PM</string>\n<string>5/8/2026 6:54:46 PM</string>\n",
    "Binary": "GEMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17199

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17199,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.928343+00:00",
    "event_record_id": 1486,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>7806</string>\n",
    "Binary": "L0MAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17264

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17264,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.271646+00:00",
    "event_record_id": 1368,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>SSE SSE2 SSE3 SSSE3 SSE41 SSE42 AVX AVX2 POPCNT BMI1 BMI2</string>\n",
    "Binary": "cEMAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17656

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17656,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.521643+00:00",
    "event_record_id": 1377,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "+EQAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17658

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17658,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.521643+00:00",
    "event_record_id": 1378,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "+kQAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 17663

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17663,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.553381+00:00",
    "event_record_id": 1416,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>tel2-DC01-2022\\SQLEXPRESS</string>\n",
    "Binary": "/0QAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 17811

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 17811,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.412270+00:00",
    "event_record_id": 1370,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>1</string>\n",
    "Binary": "k0UAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 18496

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 18496,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1355,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>QEMU</string>\n<string>Standard PC (i440FX + PIIX, 1996)</string>\n",
    "Binary": "QEgAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 19030

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 19030,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.553381+00:00",
    "event_record_id": 1415,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>1</string>\n<string>sa</string>\n",
    "Binary": "VkoAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 19032

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 19032,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:46.569784+00:00",
    "event_record_id": 1509,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>1</string>\n",
    "Binary": "WEoAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 25753

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 25753,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.537764+00:00",
    "event_record_id": 1414,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>system_health</string>\n",
    "Binary": "mWQAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 25754

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 25754,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 19:05:52.967579+00:00",
    "event_record_id": 1734,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-80-1985561900-798682989-2213159822-1904180398-3434236965"
    }
  },
  "event_data": {
    "Data_0": "<string>telemetry_xevents</string>\n",
    "Binary": "mmQAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 26018

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 26018,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.928343+00:00",
    "event_record_id": 1484,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "omUAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 26048

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 26048,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.928343+00:00",
    "event_record_id": 1485,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>\\\\.\\pipe\\SQLLocal\\SQLEXPRESS</string>\n",
    "Binary": "wGUAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 26067

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 26067,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.959593+00:00",
    "event_record_id": 1490,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>MSSQLSvc/tel2-DC01-2022.ludus.domain:SQLEXPRESS</string>\n<string>0x2098</string>\n<string>15</string>\n",
    "Binary": "02UAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 26076

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 26076,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.943968+00:00",
    "event_record_id": 1487,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "3GUAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 33090

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 33090,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:49.914743+00:00",
    "event_record_id": 1668,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1000"
    }
  },
  "event_data": {
    "Data_0": "<string>xpstar.dll</string>\n",
    "Binary": "QoEAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 33217

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 33217,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.522095+00:00",
    "event_record_id": 1412,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "wYEAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 33218

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 33218,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:44.522095+00:00",
    "event_record_id": 1413,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "woEAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAcAAABtAGEAcwB0AGUAcgAAAA=="
  },
  "message": ""
}

Event ID 49903

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 49903,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1363,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>16383</string>\n",
    "Binary": "78IAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 49904

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 49904,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1358,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>NT Service\\MSSQL$SQLEXPRESS</string>\n",
    "Binary": "8MIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 49910

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 49910,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:43.521643+00:00",
    "event_record_id": 1376,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "9sIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 49916

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 49916,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.864870+00:00",
    "event_record_id": 1351,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>0</string>\n<string>00</string>\n",
    "Binary": "/MIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

Event ID 49917

Provider: MSSQL$SQLEXPRESS
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$SQLEXPRESS",
    "guid": "",
    "event_source_name": "",
    "event_id": 49917,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:54:42.974264+00:00",
    "event_record_id": 1366,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>SQL_Latin1_General_CP1_CI_AS</string>\n<string>us_english</string>\n<string>1033</string>\n",
    "Binary": "/cIAAAoAAAAaAAAAdABlAGwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwAUwBRAEwARQBYAFAAUgBFAFMAUwAAAAAAAAA="
  },
  "message": ""
}

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)