Description

Each row represents a record parsed from a legacy Windows EVT log, with provider, event identifier, severity, record number, host, user, timestamps, message data, and recovery state. Use provider and event semantics to reconstruct system or security activity. Logs may be cleared, overwritten, filtered, or partially recovered, and event meaning depends on the provider schema.

Timeline

Timeline Field	Data Field
Description	provider_name
	event_id
Additional Description	event_data

Fields

Output Name	Data Type	Description
provider_name	String	Name of the source that generated the event.
event_id	Int	Identifier of the event (lower 16 bits of the record identifier).
event_type	Int	Event type (e.g. error, warning, information).
record_number	Int	Sequential number of the event record in the EVT file.
offset	Int	Byte offset of the record from the start of the EVT file.
recovered	Bool	True if the record was recovered (partially overwritten).
facility	Int	Facility code extracted from the event identifier.
severity	Int	Severity level extracted from the event identifier.
message_identifier	Int	Full 32‑bit message identifier.
event_category	Int	Category of the event.
computer_name	String	Computer name stored in the event record.
user_sid	String	User security identifier (SID) associated with the event.
event_data[]	Array[String]	Array of strings attached to the event.
creation_time	DateTime	Timestamp when the event record was created.
written_time	DateTime	Timestamp when the event record was written to the log.