diff --git a/TimberWinR/mdocs/WindowsEvents.md b/TimberWinR/mdocs/WindowsEvents.md index 386f95a..7f155d2 100644 --- a/TimberWinR/mdocs/WindowsEvents.md +++ b/TimberWinR/mdocs/WindowsEvents.md @@ -30,4 +30,22 @@ Example Input: } } } -``` \ No newline at end of file +``` +## Fields +After a successful parse of an event, the following fields are added: +|Name|Type Description| +|EventLog|STRING Name of the Event Log or Event Log backup file containing this event +|RecordNumber|INTEGER|Index of this event in the Event Log or Event Log backup file containing this event +|TimeGenerated|TIMESTAMP|The date and time at which the event was generated (local time) +|TimeWritten|TIMESTAMP|The date and time at which the event was logged (local time) +|EventID|INTEGER|The ID of the event +|EventType|INTEGER|The numeric type of the event +|EventTypeName|STRING|The descriptive type of the event +|EventCategory|INTEGER|The numeric category of the event +|EventCategoryName|STRING|The descriptive category of the event +|SourceName|STRING|The source that generated the event +|Strings|STRING|The textual data associated with the event +|ComputerName|STRING|The name of the computer on which the event was generated +|SID|STRING|The Security Identifier associated with the event +|Message|STRING|The full event message +|Data|STRING|The binary data associated with the event diff --git a/foo.mkd.txt b/foo.mkd.txt deleted file mode 100644 index e69de29..0000000