diff --git a/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py b/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py
index fa9be86912..dd7bfa9210 100644
--- a/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py
+++ b/bin/contentctl_project/contentctl_core/application/factory/utils/new_content_questions.py
@@ -245,6 +245,18 @@ class NewContentQuestions():
                 {
                     'name': 'sysmon_linux.log'
                 },
+                {
+                    'name': 'xml-windows-security.log'
+                },
+                {
+                    'name': 'xml-windows-system.log'
+                },
+                {
+                    'name': 'xml-windows-application.log'
+                },
+                {
+                    'name': 'xml-windows-directory-service.log'
+                },
                 ],
             },
             {
diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py
index d1ce82ed96..6378702689 100644
--- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_attackdata_yml_adapter.py
@@ -26,7 +26,11 @@ class ObjToAttackDataYmlAdapter(Adapter):
         'github.json' : 'aws:firehose:json',
         'kubernetes_nginx.json' :'kube:container:controller',
         'circleci.json' :'circleci',
-        'sysmon_linux.log' :'Syslog:Linux-Sysmon/Operational'                               
+        'sysmon_linux.log' :'Syslog:Linux-Sysmon/Operational',
+        'xml-windows-security.log': 'XmlWinEventLog:Security',
+        'xml-windows-system.log': 'XmlWinEventLog:System', 
+        'xml-windows-application.log': 'XmlWinEventLog:Application',                              
+        'xml-windows-directory-service.log': 'XmlWinEventLog:Directory Service'
         }
         return