| Standard Name | Field Name | Type | Description | Sample Value |
| ---------------- | ---------------- | ---------------- | ---------------- | ---------------- |
| powershell\_new_engine\_state | NewEngineState | string |  | Available |
| powershell\_previous\_engine\_state | PreviousEngineState | string |  | None |
| powershell\_sequence\_number | SequenceNumber | integer | | 13 |
| powershell\_host\_name | HostName | string | | ConsoleHost |
| powershell\_host\_version | HostVersion | string | | 5.1.16299.251 |
| powershell\_host\_id | HostId | string | | f90b931a-dc4d-488a-b1b8-e0b7dbcdc0c7 |
| powershell\_host\_application | HostApplication | string | | powershell.exe |
| powershell\_engine\_version | EngineVersion | string | | 5.1.16299.251 |
| powershell\_runspace\_id | RunspaceId | string | | 0dfc1f10-3bce-4885-8dbf-58ed28eba179 |
| powershell\_pipeline\_id | PipelineId | integer | | |
| powershell\_command\_name | CommandName | string | | |
| powershell\_command\_type | CommandType | string | | |
| powershell\_script\_name | ScriptName | string | | |
| powershell\_command\_path | CommandPath | string | | |
| powershell\_command\_line | CommandLine | string | | |
| powershell\_command\_invocation | CommandInvocation | string | | Get-ChildItem |
| powershell\_parameter\_binding | ParameterBinding | string | | Filter |
| powershell\_severity | Severity | string | | Informational |
| powershell\_sequence\_number | Sequence Number | string | | 88 |
| user\_name | User | string | | wardog |
| user\_domain | User | string | | DESKTOP-WARDOG |
| powershell\_connected\_user | Connected User | string | | |
| powershell\_shell\_id | Shell ID | string | | Microsoft.PowerShell |
| powershell\_message\_number | MessageNumber | integer | | 1 |
| powershell\_parameter\_binding | MessageTotal | integer | | 1 |
| powershell\_scriptblock\_text | ScriptBlockText | string |  | function Invoke-ATTACKAPI.. |
| powershell\_scriptblock\_id | ScriptBlockId | string | | 1c97482f-51a2-4cf9-8abd-df9769b6e373 |
| powershell\_Path | Path | string |  | C:\Tools\Invoke-ATTACKAPI-master\Invoke-ATTACKAPI.ps1 |
| event\_provider\_name | ProviderName | string | | Variable |
| powershell\_new\_provider\_state | NewProviderState | string | | Started |