EVID 1 : Event Sequence Start

Vendor Documentation

https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-tasks--event-logs

Classification

Rule Name	Rule Type	Classification	Common Event
EVID 1 : Event Sequence Start	Base Rule	Information	Service Started

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Provider	N/A	N/A	Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID	<vmid>	Number	The identifier that the provider used to identify the event.
Version	N/A	N/A	The version number of the event's definition.
Level	<severity>	Number	The severity level defined in the event.
Task	<vendorinfo>	Number	The task defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged.
Opcode	N/A	N/A	The opcode defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged.
Keywords	<result>	Text/String	A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreated	N/A	N/A	The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordID	N/A	N/A	The record number assigned to the event when it was logged.
Correlation	N/A	N/A	The activity identifiers that consumers can use to group related events together.
Execution	N/A	N/A	Contains information about the process and thread that logged the event.
Channel	N/A	N/A	The channel to which the event was logged.
Computer	<dname>	Text/String	The name of the computer on which the event occurred.
Security	N/A	N/A	N/A
GroupOperationId	N/A	N/A	N/A
OperationId	N/A	N/A	N/A
Operation	<process>	N/A	N/A
ClientMachine	<sname>	N/A	N/A
User	<login>	N/A	N/A
ClientProcessId	<processid>	N/A	N/A
NamespaceName	N/A	N/A	N/A