WindowsAzureGuestAgent
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Event ID 1 | Unknown | N | N |
| 2 | Event ID 2 | Unknown | N | N |
| 3 | Event ID 3 | Unknown | N | N |
| 4 | Event ID 4 | Unknown | N | N |
| 5 | Event ID 5 | Unknown | N | N |
| 6 | Event ID 6 | Unknown | N | N |
| 7 | Event ID 7 | Unknown | N | N |
| 8 | Event ID 8 | Unknown | N | N |
| 9 | Event ID 9 | Unknown | N | N |
| 3000 | Event ID 3000 | Unknown | N | N |
| 3001 | Event ID 3001 | Unknown | N | N |
| 3002 | Event ID 3002 | Unknown | N | N |
| 3003 | Event ID 3003 | Unknown | N | N |
| 3004 | Event ID 3004 | Unknown | N | N |
| 3005 | Event ID 3005 | Unknown | N | N |
| 3006 | Event ID 3006 | Unknown | N | N |
| 3007 | Event ID 3007 | Unknown | N | N |
| 3008 | Event ID 3008 | Unknown | N | N |
| 3009 | Event ID 3009 | Unknown | N | N |
| 3010 | Event ID 3010 | Unknown | N | N |
| 3011 | Event ID 3011 | Unknown | N | N |
| 3012 | Event ID 3012 | Unknown | N | N |
| 3013 | Event ID 3013 | Unknown | N | N |
| 3014 | Event ID 3014 | Unknown | N | N |
| 3015 | Event ID 3015 | Unknown | N | N |
| 3016 | Event ID 3016 | Unknown | N | N |
| 3017 | Event ID 3017 | Unknown | N | N |
| 3018 | Event ID 3018 | Unknown | N | N |
| 3019 | Event ID 3019 | Unknown | N | N |
| 3020 | Event ID 3020 | Unknown | N | N |
| 4000 | Event ID 4000 | Unknown | N | N |
Event ID 1
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 2
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 4
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 5
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 6
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 7
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 8
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 9
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3000
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3001
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3002
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3003
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3004
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3005
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3006
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3007
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3008
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3009
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3010
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3011
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3012
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3013
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3014
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3015
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3016
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3017
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3018
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |
Event ID 3019
#Fields #
| Name | Description |
|---|---|
Timestamp100ns Int64 | |
EventPid Int32 | |
EventTid Int32 | |
Payload UnicodeString |