security-windows2016-logoff.evtx.golden.json

[
  {
    "@timestamp": "2019-05-17T11:06:58.210768Z",
    "event": {
      "action": "Logoff",
      "code": 4634,
      "kind": "event"
    },
    "log": {
      "level": "information"
    },
    "message": "An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-1000\n\tAccount Name:\t\taudittest\n\tAccount Domain:\t\tWIN-41OB2LO92CR\n\tLogon ID:\t\t0x767A77\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.",
    "user": {
      "domain": "WIN-41OB2LO92CR",
      "id": "S-1-5-21-101361758-2486510592-3018839910-1000",
      "name": "audittest"
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Security",
      "computer_name": "WIN-41OB2LO92CR",
      "event_data": {
        "LogonType": "3",
        "TargetLogonId": "0x767a77"
      },
      "event_id": 4634,
      "keywords": [
        "Audit Success"
      ],
      "logon": {
        "type": "Network"
      },
      "opcode": "Info",
      "process": {
        "pid": 776,
        "thread": {
          "id": 540
        }
      },
      "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
      "provider_name": "Microsoft-Windows-Security-Auditing",
      "record_id": 485,
      "task": "Logoff"
    }
  },
  {
    "@timestamp": "2019-05-19T16:15:38.542273Z",
    "event": {
      "action": "Logoff",
      "code": 4634,
      "kind": "event"
    },
    "log": {
      "level": "information"
    },
    "message": "An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-101361758-2486510592-3018839910-500\n\tAccount Name:\t\tAdministrator\n\tAccount Domain:\t\tWIN-41OB2LO92CR\n\tLogon ID:\t\t0x104A4A6\n\nLogon Type:\t\t\t3\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.",
    "user": {
      "domain": "WIN-41OB2LO92CR",
      "id": "S-1-5-21-101361758-2486510592-3018839910-500",
      "name": "Administrator"
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Security",
      "computer_name": "WIN-41OB2LO92CR",
      "event_data": {
        "LogonType": "3",
        "TargetLogonId": "0x104a4a6"
      },
      "event_id": 4634,
      "keywords": [
        "Audit Success"
      ],
      "logon": {
        "type": "Network"
      },
      "opcode": "Info",
      "process": {
        "pid": 780,
        "thread": {
          "id": 820
        }
      },
      "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
      "provider_name": "Microsoft-Windows-Security-Auditing",
      "record_id": 747,
      "task": "Logoff"
    }
  }
]