{
"Event": {
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event",
"System": {
"Provider": {
"Name": "Microsoft-Windows-Sysmon",
"Guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}"
},
"EventID": "4",
"Version": "3",
"Level": "4",
"Task": "4",
"Opcode": "0",
"Keywords": "0x8000000000000000",
"TimeCreated": {
"SystemTime": "2017-12-21T10:49:07.186582400Z"
},
"EventRecordID": "44666661",
"Correlation": null,
"Execution": {
"ProcessID": "37328",
"ThreadID": "52352"
},
"Channel": "Microsoft-Windows-Sysmon/Operational",
"Computer": "hostname.domain.com",
"Security": {
"UserID": "S-1-5-18"
}
},
"EventData": {
"Data": [{
"text": "2017-12-21 10:49:07.170",
"Name": "UtcTime"
},
{
"text": "Started",
"Name": "State"
},
{
"text": "6.03",
"Name": "Version"
},
{
"text": "3.30",
"Name": "SchemaVersion"
}]
}
}
}