USNJournal2EventLog/maps/FileSystem_USNJournalMonitor_105.map at main · OnyxOmega/USNJournal2EventLog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
Author: YASDC, Inc.
Description: "USN: Other Change"
EventId: 105
Channel: "FileSystem"
Provider: "USNJournalMonitor"
Maps:
  -
    Property: PayloadData1
    PropertyValue: "%targetfilename%"
    Values:
      -
        Name: targetfilename
        Value: "/Event/EventData/Data[2]"
  -
    Property: PayloadData2
    PropertyValue: "%utctime%"
    Values:
      -
        Name: utctime
        Value: "/Event/EventData/Data[3]"
  -
    Property: PayloadData3
    PropertyValue: "%machineguid%"
    Values:
      -
        Name: machineguid
        Value: "/Event/EventData/Data[4]"
  -
    Property: PayloadData4
    PropertyValue: "HW: %hwserial% | VSN: %vsn%"
    Values:
      -
        Name: hwserial
        Value: "/Event/EventData/Data[5]"
      -
        Name: vsn
        Value: "/Event/EventData/Data[6]"
  -
    Property: PayloadData5
    PropertyValue: "VolSerial: %volserial% | Host: %hostname%"
    Values:
      -
        Name: volserial
        Value: "/Event/EventData/Data[7]"
      -
        Name: hostname
        Value: "/Event/EventData/Data[8]"
  -
    Property: PayloadData6
    PropertyValue: "%category% | Reason: %reason% | Usn: %usn% | Jrnl: %journalid%"
    Values:
      -
        Name: category
        Value: "/Event/EventData/Data[11]"
      -
        Name: reason
        Value: "/Event/EventData/Data[12]"
      -
        Name: usn
        Value: "/Event/EventData/Data[13]"
      -
        Name: journalid
        Value: "/Event/EventData/Data[14]"