MSSQL$MICROSOFT##WID

50 events across 1 channel

Event	Title	Channel
833	Event ID 833	Application
852	Event ID 852	Application
958	Event ID 958	Application
3406	Event ID 3406	Application
3407	Event ID 3407	Application
3408	Event ID 3408	Application
3454	Event ID 3454	Application
5084	Event ID 5084	Application
5602	Event ID 5602	Application
5604	Event ID 5604	Application
6253	Event ID 6253	Application
9645	Event ID 9645	Application
9666	Event ID 9666	Application
9688	Event ID 9688	Application
10981	Event ID 10981	Application
15268	Event ID 15268	Application
17069	Event ID 17069	Application
17101	Event ID 17101	Application
17103	Event ID 17103	Application
17104	Event ID 17104	Application
17108	Event ID 17108	Application
17110	Event ID 17110	Application
17111	Event ID 17111	Application
17115	Event ID 17115	Application
17117	Event ID 17117	Application
17118	Event ID 17118	Application
17125	Event ID 17125	Application
17126	Event ID 17126	Application
17136	Event ID 17136	Application
17137	Event ID 17137	Application
17147	Event ID 17147	Application
17152	Event ID 17152	Application
17162	Event ID 17162	Application
17164	Event ID 17164	Application
17199	Event ID 17199	Application
17663	Event ID 17663	Application
17811	Event ID 17811	Application
18100	Event ID 18100	Application
18401	Event ID 18401	Application
18456	Event ID 18456	Application
18496	Event ID 18496	Application
19030	Event ID 19030	Application
26048	Event ID 26048	Application
33217	Event ID 33217	Application
33218	Event ID 33218	Application
49903	Event ID 49903	Application
49904	Event ID 49904	Application
49910	Event ID 49910	Application
49916	Event ID 49916	Application
49917	Event ID 49917	Application

Event ID 833:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 833,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 10:35:02.057701+00:00",
    "event_record_id": 8083,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>1</string>\n<string>15</string>\n<string>C:\\Windows\\WID\\Data\\SUSDB_log.ldf</string>\n<string>5</string>\n<string>0000000000000E34</string>\n<string>0x000000000b4600</string>\n",
    "Binary": "QQMAAAoAAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAAAAAAAA=="
  },
  "message": ""
}

Event ID 852:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 852,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3837,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "540300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 958:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 958,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.965650+00:00",
    "event_record_id": 3858,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "12.00.5214",
    "Binary": "BE0300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3406:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3406,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.371381+00:00",
    "event_record_id": 4448,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "93",
    "Data_1": "master",
    "Data_2": "1",
    "Data_3": "0",
    "Binary": "4E0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 3407:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3407,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.376773+00:00",
    "event_record_id": 4449,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "master",
    "Data_2": "1",
    "Data_3": "0",
    "Binary": "4F0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3408:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3408,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.844490+00:00",
    "event_record_id": 3867,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "500D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 3454:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 3454,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-14T00:03:15.377321+00:00",
    "event_record_id": 4450,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "master",
    "Data_1": "1",
    "Binary": "7E0D00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 5084:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5084,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:59:21.544087+00:00",
    "event_record_id": 3869,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "SINGLE_USER",
    "Data_1": "ON",
    "Data_2": "IPAM",
    "Binary": "DC1300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000050000004900500041004D000000"
  },
  "message": ""
}

Event ID 5602:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5602,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.954518+00:00",
    "event_record_id": 3853,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E21500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 5604:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 5604,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.900346+00:00",
    "event_record_id": 3846,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E41500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 6253:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 6253,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.780901+00:00",
    "event_record_id": 3845,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "v4.0.30319",
    "Data_1": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\",
    "Binary": "6D1800000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 9645:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Error

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9645,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T23:13:40.001635+00:00",
    "event_record_id": 4285,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "3602",
    "Data_1": "32",
    "Binary": "AD250000100000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 9666:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9666,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.374725+00:00",
    "event_record_id": 3863,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Service Broker",
    "Binary": "C22500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 9688:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 9688,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.385838+00:00",
    "event_record_id": 3865,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "D82500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 10981:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 10981,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.910047+00:00",
    "event_record_id": 3847,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E52A00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 15268:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 15268,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3829,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "WINDOWS-ONLY",
    "Binary": "A43B00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17069:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17069,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3823,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Microsoft SQL Server 2014 (SP2-GDR) (KB4057120) - 12.0.5214.6 (X64) \n\tJan  9 2018 15:03:12 \n\tCopyright (c) Microsoft Corporation\n\tWindows Internal Database (64-bit) on Windows NT 6.3 <X64> (Build 20348: ) (Hypervisor)\n",
    "Binary": "AD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17101:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17101,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3825,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "CD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17103:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17103,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3826,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "CF4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17104:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17104,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3827,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "900",
    "Binary": "D04200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17108:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17108,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.944534+00:00",
    "event_record_id": 3852,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "D44200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17110:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17110,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3832,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\r\n\t -d C:\\Windows\\WID\\Data\\master.mdf\r\n\t -l C:\\Windows\\WID\\Data\\mastlog.ldf\r\n\t -e C:\\Windows\\WID\\Log\\error.log\r\n\t -K\r\n\t -T 1617\r\n\t -w 65535",
    "Binary": "D64200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17111:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17111,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3830,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "C:\\Windows\\WID\\Log\\error.log",
    "Binary": "D74200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17115:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17115,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3833,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\r\n\t -S \"MSWIN8.SQLWID\"\r\n\t -s \"MICROSOFT##WID\"",
    "Binary": "DB4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17117:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17117,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.281003+00:00",
    "event_record_id": 3862,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Binary": "DD4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000007000000740065006D007000640062000000"
  },
  "message": ""
}

Event ID 17118:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17118,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.561268+00:00",
    "event_record_id": 3842,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "disabled",
    "Binary": "DE4200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17125:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17125,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.561268+00:00",
    "event_record_id": 3841,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "2500",
    "Data_1": "5000",
    "Binary": "E54200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17126:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17126,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.844490+00:00",
    "event_record_id": 3866,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "E64200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17136:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17136,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:56.098199+00:00",
    "event_record_id": 3860,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "F04200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17137:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17137,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.608551+00:00",
    "event_record_id": 3844,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "master",
    "Binary": "F14200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17147:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17147,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:03:33.524248+00:00",
    "event_record_id": 533,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "+0IAAAoAAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAAAAAAAA=="
  },
  "message": ""
}

Event ID 17152:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17152,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.545412+00:00",
    "event_record_id": 3840,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "0000000000003fff",
    "Data_2": "0",
    "Data_3": "0000000000003fff",
    "Data_4": "0",
    "Binary": "004300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17162:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17162,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3835,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "0A4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17164:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Data_3`
`Data_4`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17164,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3834,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Data_1": "14",
    "Data_2": "14",
    "Data_3": "14",
    "Data_4": "14",
    "Binary": "0C4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17199:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17199,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.956870+00:00",
    "event_record_id": 3856,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "7806",
    "Binary": "2F4300000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 17663:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17663,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.937659+00:00",
    "event_record_id": 3851,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "LAB-DC01\\MICROSOFT##WID",
    "Binary": "FF4400000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 17811:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 17811,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.539307+00:00",
    "event_record_id": 3839,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Binary": "934500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 18100:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18100,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:59:32.654855+00:00",
    "event_record_id": 3875,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "51",
    "Data_1": "LAB-DC01",
    "Data_2": "8676",
    "Binary": "B44600000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 18401:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18401,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:04:35.258327+00:00",
    "event_record_id": 599,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Data_0": "<string>NT AUTHORITY\\NETWORK SERVICE</string>\n<string> [CLIENT: <named pipe>]</string>\n",
    "Binary": "4UcAAA4AAAAeAAAAVABFAEwAMgAtAEQAQwAwADEALQAyADAAMgAyAFwATQBJAEMAUgBPAFMATwBGAFQAIwAjAFcASQBEAAAABwAAAG0AYQBzAHQAZQByAAAA"
  },
  "message": ""
}

Event ID 18456:

Provider: MSSQL$MICROSOFT##WID
Channel: Application

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18456,
    "version": 0,
    "level": 0,
    "task": 4,
    "opcode": 0,
    "keywords": 40532396646334464,
    "time_created": "2026-03-13T23:03:32.326011+00:00",
    "event_record_id": 4187,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1283"
    }
  },
  "event_data": {
    "Data_0": "ludus\\svc_adfs",
    "Data_1": " Reason: Could not find a login matching the name provided.",
    "Data_2": " [CLIENT: <named pipe>]",
    "Binary": "184800000E0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 18496:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 18496,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3828,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "QEMU",
    "Data_1": "Standard PC (i440FX + PIIX, 1996)",
    "Binary": "404800000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 19030:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 19030,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.936544+00:00",
    "event_record_id": 3850,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "1",
    "Data_1": "sa",
    "Binary": "564A00000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 26048:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 26048,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.956268+00:00",
    "event_record_id": 3855,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "\\\\.\\pipe\\MICROSOFT##WID\\tsql\\query",
    "Binary": "C06500000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 33217:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 33217,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.910648+00:00",
    "event_record_id": 3848,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "C18100000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 33218:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 33218,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.911163+00:00",
    "event_record_id": 3849,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "C28100000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F0046005400230023005700490044000000070000006D00610073007400650072000000"
  },
  "message": ""
}

Event ID 49903:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49903,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3836,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "51199",
    "Binary": "EFC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49904:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49904,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3831,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "NT SERVICE\\MSSQL$MICROSOFT##WID",
    "Binary": "F0C200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49910:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49910,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.608551+00:00",
    "event_record_id": 3843,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": "F6C200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49916:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49916,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.201509+00:00",
    "event_record_id": 3824,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "0",
    "Data_1": "00",
    "Binary": "FCC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

Event ID 49917:

Provider: MSSQL$MICROSOFT##WID
Channel: Application
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSSQL$MICROSOFT##WID",
    "guid": "",
    "event_source_name": "",
    "event_id": 49917,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T21:58:55.462396+00:00",
    "event_record_id": 3838,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "SQL_Latin1_General_CP1_CI_AS",
    "Data_1": "us_english",
    "Data_2": "1033",
    "Binary": "FDC200000A0000001C0000004A0044002D0044004300300031002D0032003000320032005C004D004900430052004F0053004F004600540023002300570049004400000000000000"
  },
  "message": ""
}

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)