WEFTools

0.2.4

Configuration/Definitions/OSStartupShutdownDetailed.json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 {
    "SearchDefinition": {
        "OSStartupShutdownDetailed": {
            "Events": {
                "Fields": {
                    "Computer": "Computer",
                    "StartTime": "Date",
                    "MachineName": "ObjectAffected",
                    "UserId": "SubjectUserSid",
                    "NoNameB3":"EventLevel",
                    "NoNameB4":"ShutdownDescription",
                    "NoNameB6": "EventActionDetails",
                    "EventAction": "EventAction",
                    "NoNameB5": "ShutdownCode",
                    "NoNameB7":"ShutdownComment",
                    "ID": "Event ID",
                    "RecordID": "Record ID",
                    "GatheredFrom": "Gathered From",
                    "GatheredLogName": "Gathered LogName"
                },
                "Overwrite": {
                    "EventAction#1": [
                        "Event ID",
                         1001,
                        "Application crash"
                    ],
                    "EventAction#2": [
                        "Event ID",
                         1074,
                        "Shutdown initiated"
                    ]

                },
                "Ignore": {},
                "Events": [
                    1001,
                    1074
                ],
                "IgnoreWords": {},
                "LogName": "System",
                "Enabled": true
            },
            "Enabled": true
        }
    },
    "LogName": "WEC5-Operating-System"
}