windows_events

Windows Event logs.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: windows_events

• Windows

Table schema

Name	Type	Description
time	BIGINT	Timestamp the event was received
datetime	TEXT	System time at which the event occurred
source	TEXT	Source or channel of the event
provider_name	TEXT	Provider name of the event
provider_guid	TEXT	Provider guid of the event
eventid	INTEGER	Event ID of the event
task	INTEGER	Task value associated with the event
level	INTEGER	The severity level associated with the event
keywords	BIGINT	A bitmask of the keywords defined in the event
data	TEXT	Data associated with the event
eid	TEXT	Event ID

Query examples

select * from windows_events where eventid=4104 and channel='Security'