{
    "Event": {
        "EventData": {
            "Data": [
                {
                    "Name": "UtcTime",
                    "text": "2017-12-21 10:53:01.382"
                },
                {
                    "Name": "ProcessGuid",
                    "text": "{684DA293-FB47-5A2C-0000-0010AD310100}"
                },
                {
                    "Name": "ProcessId",
                    "text": "460"
                },
                {
                    "Name": "Image",
                    "text": "C:\\Windows\\System32\\svchost.exe"
                },
                {
                    "Name": "User",
                    "text": "NT AUTHORITY\\NETWORK SERVICE"
                },
                {
                    "Name": "Protocol",
                    "text": "udp"
                },
                {
                    "Name": "Initiated",
                    "text": "false"
                },
                {
                    "Name": "SourceIsIpv6",
                    "text": "true"
                },
                {
                    "Name": "SourceIp",
                    "text": "ff02:0:0:0:0:0:1:3"
                },
                {
                    "Name": "SourceHostname"
                },
                {
                    "Name": "SourcePort",
                    "text": "5355"
                },
                {
                    "Name": "SourcePortName",
                    "text": "llmnr"
                },
                {
                    "Name": "DestinationIsIpv6",
                    "text": "true"
                },
                {
                    "Name": "DestinationIp",
                    "text": "fe80:0:0:0:116b:fe91:1f2d:5bcd"
                },
                {
                    "Name": "DestinationHostname",
                    "text": "hostname.domain.com"
                },
                {
                    "Name": "DestinationPort",
                    "text": "63307"
                },
                {
                    "Name": "DestinationPortName"
                }
            ]
        },
        "System": {
            "Channel": "Microsoft-Windows-Sysmon/Operational",
            "Computer": "hostname.domain.com",
            "Correlation": null,
            "EventID": "3",
            "EventRecordID": "44679214",
            "Execution": {
                "ProcessID": "37328",
                "ThreadID": "70392"
            },
            "Keywords": "0x8000000000000000",
            "Level": "4",
            "Opcode": "0",
            "Provider": {
                "Guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
                "Name": "Microsoft-Windows-Sysmon"
            },
            "Security": {
                "UserID": "S-1-5-18"
            },
            "Task": "3",
            "TimeCreated": {
                "SystemTime": "2017-12-21T10:53:03.155207600Z"
            },
            "Version": "5"
        },
        "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    }
}