| Microsoft-Windows-Security-Auditing | 426 | 222 | 133 |
| Microsoft-Windows-Sysmon | 30 | 30 | 29 |
| Microsoft-Windows-PowerShell | 189 | 48 | 2 |
| Microsoft-Windows-Windows Defender | 94 | 31 | 25 |
| Microsoft-Windows-TaskScheduler | 148 | 38 | 6 |
| Microsoft-Windows-WMI-Activity | 25 | 17 | 4 |
| Microsoft-Windows-TerminalServices-LocalSessionManager | 47 | 16 | 3 |
| Microsoft-Windows-DNS-Server-Service | 497 | 35 | 4 |
| Microsoft-Windows-ActiveDirectory_DomainService | 41 | 41 | 0 |
| Microsoft-Windows-Kernel-Process | 27 | 13 | 0 |
| Service Control Manager | 91 | 36 | 7 |
| Microsoft-Windows-Bits-Client | 114 | 29 | 3 |
| Microsoft-Windows-Windows Firewall With Advanced Security | 171 | 65 | 25 |
| Microsoft-Windows-AppLocker | 49 | 19 | 12 |
| Microsoft-Windows-NTLM | 24 | 5 | 3 |
| Microsoft-Windows-Security-Kerberos | 90 | 14 | 0 |
| Microsoft-Windows-CertificationAuthority | 355 | 38 | 2 |
| Microsoft-Office-Word2 | 976 | 955 | 0 |
| Microsoft-Office-Word | 886 | 886 | 0 |
| OfficeAirSpace | 470 | 470 | 0 |
| Microsoft-Office-Word3 | 450 | 417 | 0 |
| Microsoft-Windows-Shell-Core | 2380 | 355 | 1 |
| Microsoft-Windows-XAML | 571 | 187 | 0 |
| Microsoft-IE | 1379 | 166 | 0 |
| Microsoft-Windows-TCPIP | 624 | 155 | 0 |
| Microsoft-Windows-AppXDeployment-Server | 2020 | 128 | 10 |
| Microsoft-Windows-Dwm-Core | 334 | 120 | 0 |
| Microsoft-Windows-Security-SPP | 326 | 117 | 0 |
| Microsoft-Windows-Hyper-V-VMMS | 7057 | 113 | 0 |
| Microsoft-Windows-WebIO | 156 | 110 | 0 |
| Microsoft-Windows-DxgKrnl | 707 | 93 | 0 |
| Microsoft-Office-Events | 91 | 91 | 0 |
| Microsoft-WindowsPhone-CoreMessaging | 141 | 86 | 0 |
| AD FS | 562 | 80 | 0 |
| Microsoft-Windows-Win32k | 358 | 80 | 0 |
| Microsoft-Windows-WinRM | 327 | 80 | 0 |
| Microsoft-Windows-Application Server-Applications | 481 | 78 | 0 |
| Microsoft-IEFRAME | 873 | 77 | 0 |
| Microsoft-Quic | 181 | 69 | 0 |
| Defender-DeviceEvents | 219 | 67 | 26 |
| Microsoft-Windows-MediaFoundation-Performance | 532 | 67 | 0 |
| Microsoft-JScript | 258 | 66 | 0 |
| Microsoft-Windows-DotNETRuntime | 145 | 66 | 0 |
| Microsoft-Windows-ServerManager-MultiMachine | 333 | 66 | 0 |
| Microsoft-Windows-GroupPolicy | 177 | 65 | 0 |
| Microsoft-Windows-WinINet | 330 | 65 | 0 |
| Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider | 996 | 64 | 0 |
| Microsoft-Windows-Kernel-PnP | 196 | 64 | 0 |
| Microsoft-Windows-PushNotifications-Platform | 412 | 64 | 0 |
| MSSQL$SQLEXPRESS | 63 | 63 | 0 |
| Microsoft-Windows-SMBServer | 207 | 61 | 2 |
| Microsoft.Windows.Defender | 60 | 60 | 0 |
| Microsoft-Windows-Kernel-Power | 353 | 58 | 0 |
| Microsoft-Windows-Hyper-V-VmSwitch | 534 | 55 | 0 |
| Microsoft-Windows-Search-Core | 365 | 53 | 0 |
| MSSQL$MICROSOFT##WID | 50 | 50 | 0 |
| Microsoft-Windows-Dhcp-Client | 164 | 48 | 0 |
| Microsoft-Windows-DeviceManagement-Pushrouter | 107 | 46 | 0 |
| Microsoft-Windows-ESE | 140 | 46 | 0 |
| Microsoft-Windows-SMBClient | 181 | 46 | 5 |
| Microsoft-Antimalware-Engine | 110 | 45 | 0 |
| Microsoft-Windows-DirectComposition | 75 | 43 | 0 |
| Microsoft-Windows-Time-Service | 178 | 43 | 0 |
| Microsoft-Windows-SENSE | 214 | 42 | 0 |
| Microsoft-Windows-DHCP-Server | 565 | 38 | 4 |
| ESENT | 36 | 36 | 4 |
| Microsoft-Windows-AppReadiness | 174 | 35 | 0 |
| Microsoft-Windows-DeviceSetupManager | 102 | 34 | 0 |
| Microsoft-Windows-RemoteDesktopServices-RdpCoreTS | 89 | 34 | 2 |
| Microsoft-Windows-FailoverClustering | 762 | 32 | 0 |
| Microsoft-Windows-Ntfs | 73 | 31 | 1 |
| Microsoft-Windows-HttpService | 132 | 30 | 0 |
| Microsoft-Windows-DXGI | 212 | 29 | 0 |
| Microsoft-Windows-TSF-msctf | 95 | 29 | 0 |
| Microsoft-Windows-USB-USBHUB | 106 | 29 | 0 |
| Microsoft-Windows-User Device Registration | 220 | 29 | 0 |
| Microsoft-Windows-CAPI2 | 74 | 28 | 2 |
| Microsoft-Windows-PrintService | 219 | 28 | 5 |
| Microsoft-Windows-ShellCommon-StartLayoutPopulation | 126 | 28 | 0 |
| Microsoft-Windows-Threat-Intelligence | 34 | 28 | 0 |
| Microsoft-Windows-DHCPv6-Client | 127 | 27 | 0 |
| Microsoft-Windows-Immersive-Shell-API | 74 | 27 | 0 |
| Microsoft-Windows-VHDMP | 84 | 27 | 0 |
| Microsoft-Windows-Winlogon | 151 | 27 | 0 |
| Microsoft-Windows-Winsock-AFD | 96 | 27 | 0 |
| Microsoft-Windows-DNS-Client | 107 | 26 | 1 |
| Microsoft-Windows-DNSServer | 167 | 26 | 2 |
| Microsoft-Windows-Documents | 497 | 26 | 0 |
| Microsoft-Windows-Immersive-Shell | 899 | 26 | 0 |
| Microsoft-Windows-Search | 258 | 26 | 0 |
| Microsoft-Windows-StorPort | 362 | 26 | 0 |
| AD FS Auditing | 25 | 25 | 1 |
| Microsoft-Windows-AppModel-Runtime | 131 | 25 | 1 |
| Microsoft-Windows-COM-Perf | 55 | 25 | 0 |
| Microsoft-Windows-DriverFrameworks-UserMode | 77 | 25 | 3 |
| OfficeLoggingLiblet | 25 | 25 | 0 |
| Microsoft-Windows-Kernel-File | 25 | 24 | 0 |
| Microsoft-Windows-LiveId | 235 | 24 | 0 |
| Microsoft-Windows-Hyper-V-Worker | 1669 | 23 | 0 |
| Microsoft-Windows-Kernel-Registry | 45 | 23 | 0 |