V 2.0 : EVID 1-2 : Cmdlet Succeeded

V 2.0 : EVID 1-2 : Cmdlet Succeeded

Base Rule

Operation Succeeded

Information

V 2.0 : Cmdlet Set Succeeded

Sub Rule

Object Set

Information

V 2.0 : Cmdlet Get Succeeded

Sub Rule

Process Completed

Information

V 2.0 : Cmdlet Add Succeeded

Sub Rule

Object Added

Access Success

V 2.0 : Cmdlet Remove Succeeded

Sub Rule

Object Deleted/Removed

Access Success

V 2.0 : Cmdlet Disable Succeeded

Sub Rule

Object Enabled Or Disabled

Information

V 2.0 : Cmdlet Enable Succeeded

Sub Rule

Object Enabled Or Disabled

Information

V 2.0 : Cmdlet Send Succeeded

Sub Rule

Send Information

Information

V 2.0 : Cmdlet Move Succeeded

Sub Rule

Object Moved

Access Success

V 2.0 : Cmdlet Update Succeeded

Sub Rule

Object Modified

Access Success

V 2.0 : Cmdlet New Succeeded

Sub Rule

Process Completed

Information

V 2.0 : Cmdlet Compare Succeeded

Sub Rule

Process Completed

Information

V 2.0 : Cmdlet Search Succeeded

Sub Rule

Search

Information

V 2.0 : Cmdlet Connect Succeeded

Sub Rule

Connected

Information

V 2.0 : Cmdlet Mount Succeeded

Sub Rule

Process Completed

Information

Provider

N/A

N/A

Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

The version number of the event's definition.

Level

<severity>

Text/String

The severity level defined in the event.

Task

N/A

N/A

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

N/A

N/A

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

<session>

Number

The record number assigned to the event when it was logged.

Channel

<vendorinfo>

Text/String

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

EventData

<action>
<command>
<tag1>
<domainorigin>
<login>
<result>

Text/String

N/A