name: Sysmon EventID
id: 4e1d2852-0311-45fa-9162-0316fc39d2da
author: Patrick Bareiss, Splunk
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
separator: EventID
supported_TA:
  name: Splunk Add-on for Sysmon
  version: 4.0.0
  url: https://splunkbase.splunk.com/app/5709/
event_names:
- event_name: Sysmon EventID 22
  data_source: data_sources/network/event_sources/Sysmon_EventID_22.yml