Загрузка данных

*[System[Channel='Security' and (EventID=1102 or (EventID>=4624 and EventID<=4625) or EventID=4648 or EventID=4663 or EventID=4672 or EventID=4688 or EventID=4719 or EventID=4720 or EventID=4728 or EventID=4732 or EventID=4738 or EventID=4740 or EventID=4756 or (EventID>=4768 and EventID<=4771) or EventID=5136)]]

*[System[Channel='Microsoft-Windows-Sysmon/Operational' and (EventID=1 or EventID=3 or EventID=7 or EventID=11 or EventID=22)]]

*[System[((Channel='System' and (EventID=104 or EventID=7045)) or (Channel='Microsoft-Windows-PowerShell/Operational' and (EventID=4103 or EventID=4104)) or (Channel='Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational' and (EventID=21 or EventID=25)))]]