EricZimmerman · AndrewRathbun · Dec 19, 2020 · Dec 19, 2020
diff --git a/evtx/Maps/!!!!README.md b/evtx/Maps/!!!!README.md
@@ -88,21 +88,23 @@ It is that simple! Be sure to surround things in double quotes and/or escape quo
 
 NOTE! The filenames for maps should be in the following format:
 
-Channel_EventID.map
+Channel-Name_Provider-Name_EventID.map
 
-Where Channel is EXACTLY what is in the XML <Channel> element with any '/' characters replaced with an underscore.
+Where Channel is EXACTLY what is in the XML <Channel> element with any '/' characters, hyphens, or spaces replaced with a hyphen. Hyphens are the catch all for each element of the map filename. 
 
-For example, for Event ID '201' and Channel 'Microsoft-Windows-TaskScheduler/Operational' the file should be named:
+Only underscores should separate each element (Channel Name, Provider Name, EventID). Hyphens separates words. Underscores separate elements. 
 
-`Microsoft-Windows-TaskScheduler_Operational_201.map`
+For example, for Event ID '201' and Channel 'Microsoft-Windows-TaskScheduler/Operational' the file should be named:
 
-As of v06 or so, you can also add optional properties `Provider` and `Lookups`
+`Microsoft-Windows-TaskScheduler-Operational_Microsoft-Windows-TaskScheduler_201.map`
 
-Provider is used at the header level and looks like this:
+`Provider` is now mandatory. Provider is used at the header level and looks like this:
 
 `Provider: "Microsoft-Windows-Power-Troubleshooter"`
 
-This lets you further narrow down when a map will be used. See System_1.map for an example.
+This lets you further narrow down when a map will be used. Every map will have a working example of this now.
+
+As of v06 or so, you can also add optional properties such as `Lookups`.
 
 Lookups allow you to define lookup tables that match one value and replace them with another. Here is an example, also from System_1.map:
 
@@ -211,4 +213,4 @@ This also allows you to update default maps without having your customizations b
 
 TIPS:
 
-If you are looking to make an Application.evtx map, please includence a Provider as they are many instances where the same event ID number is used for multiple providers. I've personally observed 4 Providers use Event ID 1 which without a Provider being listed for that map it made all 4 events, regardless of Provider, be mapped incorrectly. When in doubt, add a Provider to your map. Follow a template from a previously created map to ensure it's made correctly.add
+If you are looking to make an Application.evtx map, please include a Provider as they are many instances where the same event ID number is used for multiple providers. I've personally observed 4 Providers use Event ID 1 which without a Provider being listed for that map it made all 4 events, regardless of Provider, be mapped incorrectly. When in doubt, add a Provider to your map. Follow a template from a previously created map to ensure it's made correctly.add
diff --git a/evtx/Maps/Application_1002.map → ...aps/Application_Application-Hang_1002.map b/evtx/Maps/Application_1002.map → ...aps/Application_Application-Hang_1002.map
diff --git a/.../Maps/Application-HitmanPro-Alert_911.map → .../Maps/Application_HitmanPro-Alert_911.map b/.../Maps/Application-HitmanPro-Alert_911.map → .../Maps/Application_HitmanPro-Alert_911.map
diff --git a/evtx/Maps/Application_Audit-CVE_1.map → ...ication_Microsoft-Windows-Audit-CVE_1.map b/evtx/Maps/Application_Audit-CVE_1.map → ...ication_Microsoft-Windows-Audit-CVE_1.map
diff --git a/evtx/Maps/Application_10002.map → evtx/Maps/Application_MsiInstaller_10002.map b/evtx/Maps/Application_10002.map → evtx/Maps/Application_MsiInstaller_10002.map
diff --git a/evtx/Maps/Application_1033.map → evtx/Maps/Application_MsiInstaller_1033.map b/evtx/Maps/Application_1033.map → evtx/Maps/Application_MsiInstaller_1033.map
diff --git a/evtx/Maps/Application_1034.map → evtx/Maps/Application_MsiInstaller_1034.map b/evtx/Maps/Application_1034.map → evtx/Maps/Application_MsiInstaller_1034.map
diff --git a/evtx/Maps/Application_11707.map → evtx/Maps/Application_MsiInstaller_11707.map b/evtx/Maps/Application_11707.map → evtx/Maps/Application_MsiInstaller_11707.map
diff --git a/evtx/Maps/Application_11708.map → evtx/Maps/Application_MsiInstaller_11708.map b/evtx/Maps/Application_11708.map → evtx/Maps/Application_MsiInstaller_11708.map
diff --git a/evtx/Maps/Application_11724.map → evtx/Maps/Application_MsiInstaller_11724.map b/evtx/Maps/Application_11724.map → evtx/Maps/Application_MsiInstaller_11724.map
diff --git a/evtx/Maps/Application-Sophos-Alert_32.map → ...Maps/Application_Sophos-Anti-Virus_32.map b/evtx/Maps/Application-Sophos-Alert_32.map → ...Maps/Application_Sophos-Anti-Virus_32.map
diff --git a/evtx/Maps/Application-Sophos-Alert_42.map → ...plication_Sophos-System-Protection_42.map b/evtx/Maps/Application-Sophos-Alert_42.map → ...plication_Sophos-System-Protection_42.map
diff --git a/...nyConnect-Secure-Mobility-Client-2048.map → ...ecure-Mobility-Client_acvpnagent_2048.map b/...nyConnect-Secure-Mobility-Client-2048.map → ...ecure-Mobility-Client_acvpnagent_2048.map
@@ -1,37 +1,37 @@
-Author: Mike Brewer 
-Description: Cisco AnyConnect VPN encrypted connection type
-EventId: 2048
-Channel: "Cisco AnyConnect Secure Mobility Client"
-Provider: acvpnagent
-Maps: 
-  - 
-    Property: PayloadData1
-    PropertyValue: "%PayloadData1%"
-    Values: 
-      - 
-        Name: PayloadData1
-        Value: "/Event/EventData/Data"
-        Refine: "(?<=, )[^,\\d]+(?=,)"
-
-# Valid properties include:
-# 
-# PayloadData1
-
-# <Event>
-  # <System>
-    # <Provider Name="acvpnagent" />
-    # <EventID Qualifiers="25600">2048</EventID>
-    # <Level>4</Level>
-    # <Task>0</Task>
-    # <Keywords>0x80000000000000</Keywords>
-    # <TimeCreated SystemTime="2020-04-14 15:35:05.9153410" />
-    # <EventRecordID>32685</EventRecordID>
-    # <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
-    # <Computer>My-Laptop123.domain.local</Computer>
-    # <Security />
-  # </System>
-    # <EventData>
-      #<Data>A SSL connection has been established using cipher AES256-SHA256</Data>
-        # <Binary></Binary>
-        # </EventData>
-    # </Event>
+Author: Mike Brewer 
+Description: Cisco AnyConnect VPN encrypted connection type
+EventId: 2048
+Channel: "Cisco AnyConnect Secure Mobility Client"
+Provider: acvpnagent
+Maps: 
+  - 
+    Property: PayloadData1
+    PropertyValue: "%PayloadData1%"
+    Values: 
+      - 
+        Name: PayloadData1
+        Value: "/Event/EventData/Data"
+        Refine: "(?<=, )[^,\\d]+(?=,)"
+
+# Valid properties include:
+# 
+# PayloadData1
+
+# <Event>
+  # <System>
+    # <Provider Name="acvpnagent" />
+    # <EventID Qualifiers="25600">2048</EventID>
+    # <Level>4</Level>
+    # <Task>0</Task>
+    # <Keywords>0x80000000000000</Keywords>
+    # <TimeCreated SystemTime="2020-04-14 15:35:05.9153410" />
+    # <EventRecordID>32685</EventRecordID>
+    # <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
+    # <Computer>My-Laptop123.domain.local</Computer>
+    # <Security />
+  # </System>
+    # <EventData>
+      #<Data>A SSL connection has been established using cipher AES256-SHA256</Data>
+        # <Binary></Binary>
+        # </EventData>
+    # </Event>
diff --git a/...nyConnect-Secure-Mobility-Client-2086.map → ...ecure-Mobility-Client_acvpnagent_2086.map b/...nyConnect-Secure-Mobility-Client-2086.map → ...ecure-Mobility-Client_acvpnagent_2086.map
@@ -1,37 +1,37 @@
-Author: Mike Brewer 
-Description: Cisco AnyConnect VPN reading host's IP 
-EventId: 2085
-Channel: "Cisco AnyConnect Secure Mobility Client"
-Provider: acvpnagent
-Maps: 
-  - 
-    Property: PayloadData1
-    PropertyValue: "%PayloadData1%"
-    Values: 
-      - 
-        Name: PayloadData1
-        Value: "/Event/EventData/Data"
-        Refine: "(?<=, )[^,\\d]+(?=,)"
-
-# Valid properties include:
-# 
-# PayloadData1
-
-# <Event>
-  # <System>
-    # <Provider Name="acvpnagent" />
-    # <EventID Qualifiers="25600">2085</EventID>
-    # <Level>4</Level>
-    # <Task>0</Task>
-    # <Keywords>0x80000000000000</Keywords>
-    # <TimeCreated SystemTime="2020-04-14 15:35:05.9153410" />
-    # <EventRecordID>32628</EventRecordID>
-    # <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
-    # <Computer>My-Laptop123.domain.local</Computer>
-    # <Security />
-  # </System>
-    # <EventData>
-      #<Data>The client's public address is now set to 192.168.1.235</Data>
-        # <Binary></Binary>
-        # </EventData>
-    # </Event>
+Author: Mike Brewer 
+Description: Cisco AnyConnect VPN reading host's IP 
+EventId: 2085
+Channel: "Cisco AnyConnect Secure Mobility Client"
+Provider: acvpnagent
+Maps: 
+  - 
+    Property: PayloadData1
+    PropertyValue: "%PayloadData1%"
+    Values: 
+      - 
+        Name: PayloadData1
+        Value: "/Event/EventData/Data"
+        Refine: "(?<=, )[^,\\d]+(?=,)"
+
+# Valid properties include:
+# 
+# PayloadData1
+
+# <Event>
+  # <System>
+    # <Provider Name="acvpnagent" />
+    # <EventID Qualifiers="25600">2085</EventID>
+    # <Level>4</Level>
+    # <Task>0</Task>
+    # <Keywords>0x80000000000000</Keywords>
+    # <TimeCreated SystemTime="2020-04-14 15:35:05.9153410" />
+    # <EventRecordID>32628</EventRecordID>
+    # <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
+    # <Computer>My-Laptop123.domain.local</Computer>
+    # <Security />
+  # </System>
+    # <EventData>
+      #<Data>The client's public address is now set to 192.168.1.235</Data>
+        # <Binary></Binary>
+        # </EventData>
+    # </Event>
diff --git a/...nyConnect-Secure-Mobility-Client-2127.map → ...ecure-Mobility-Client_acvpnagent_2127.map b/...nyConnect-Secure-Mobility-Client-2127.map → ...ecure-Mobility-Client_acvpnagent_2127.map
diff --git a/...nyConnect-Secure-Mobility-Client-5005.map → ...-Mobility-Client_acvpndownloader_5005.map b/...nyConnect-Secure-Mobility-Client-5005.map → ...-Mobility-Client_acvpndownloader_5005.map
@@ -1,37 +1,37 @@
-Author: Mike Brewer 
-Description: Cisco AnyConnect VPN connecting to target gateway X
-EventId: 5005
-Channel: "Cisco AnyConnect Secure Mobility Client"
-Provider: acvpndownloader
-Maps: 
-  - 
-    Property: PayloadData1
-    PropertyValue: "%PayloadData1%"
-    Values: 
-      - 
-        Name: PayloadData1
-        Value: "/Event/EventData/Data"
-        Refine: "(?<=, )[^,\\d]+(?=,)"
-
-# Valid properties include:
-# 
-# PayloadData1
-
-# <Event>
-  # <System>
-    # <Provider Name="acvpndownloader" />
-    # <EventID Qualifiers="25600">5005</EventID>
-    # <Level>4</Level>
-    # <Task>0</Task>
-    # <Keywords>0x80000000000000</Keywords>
-    # <TimeCreated SystemTime="2020-04-14 15:35:05.9153410" />
-    # <EventRecordID>32628</EventRecordID>
-    # <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
-    # <Computer>My-Laptop123.domain.local</Computer>
-    # <Security />
-  # </System>
-    # <EventData>
-      #<Data>Connecting to mdgegtwy1.acme.com.</Data>
-        # <Binary></Binary>
-        # </EventData>
+Author: Mike Brewer 
+Description: Cisco AnyConnect VPN connecting to target gateway X
+EventId: 5005
+Channel: "Cisco AnyConnect Secure Mobility Client"
+Provider: acvpndownloader
+Maps: 
+  - 
+    Property: PayloadData1
+    PropertyValue: "%PayloadData1%"
+    Values: 
+      - 
+        Name: PayloadData1
+        Value: "/Event/EventData/Data"
+        Refine: "(?<=, )[^,\\d]+(?=,)"
+
+# Valid properties include:
+# 
+# PayloadData1
+
+# <Event>
+  # <System>
+    # <Provider Name="acvpndownloader" />
+    # <EventID Qualifiers="25600">5005</EventID>
+    # <Level>4</Level>
+    # <Task>0</Task>
+    # <Keywords>0x80000000000000</Keywords>
+    # <TimeCreated SystemTime="2020-04-14 15:35:05.9153410" />
+    # <EventRecordID>32628</EventRecordID>
+    # <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
+    # <Computer>My-Laptop123.domain.local</Computer>
+    # <Security />
+  # </System>
+    # <EventData>
+      #<Data>Connecting to mdgegtwy1.acme.com.</Data>
+        # <Binary></Binary>
+        # </EventData>
     # </Event>
diff --git a/...rosoft-DriverFrameworks-UserMode_2100.map → ...rosoft-DriverFrameworks-UserMode_2100.map b/...rosoft-DriverFrameworks-UserMode_2100.map → ...rosoft-DriverFrameworks-UserMode_2100.map
diff --git a/evtx/Maps/Microsoft-Windows-AppID_4004.map → ...rational_Microsoft-Windows-AppID_4004.map b/evtx/Maps/Microsoft-Windows-AppID_4004.map → ...rational_Microsoft-Windows-AppID_4004.map
diff --git a/...ft-Windows-AppLocker-EXE_and_DLL_8002.map → ...-DLL_Microsoft-Windows-AppLocker_8002.map b/...ft-Windows-AppLocker-EXE_and_DLL_8002.map → ...-DLL_Microsoft-Windows-AppLocker_8002.map
diff --git a/...ft-Windows-AppLocker-EXE_and_DLL_8004.map → ...-DLL_Microsoft-Windows-AppLocker_8004.map b/...ft-Windows-AppLocker-EXE_and_DLL_8004.map → ...-DLL_Microsoft-Windows-AppLocker_8004.map
diff --git a/...Windows-AppLocker-MSI_and_Script_8005.map → ...ript_Microsoft-Windows-AppLocker_8005.map b/...Windows-AppLocker-MSI_and_Script_8005.map → ...ript_Microsoft-Windows-AppLocker_8005.map
diff --git a/...Windows-AppLocker-MSI_and_Script_8007.map → ...ript_Microsoft-Windows-AppLocker_8007.map b/...Windows-AppLocker-MSI_and_Script_8007.map → ...ript_Microsoft-Windows-AppLocker_8007.map
diff --git a/...ndows-AppLocker-PackagedApp-Exec_8020.map → ...tion_Microsoft-Windows-AppLocker_8020.map b/...ndows-AppLocker-PackagedApp-Exec_8020.map → ...tion_Microsoft-Windows-AppLocker_8020.map
diff --git a/...tion-Experience_Program-Telemetry_500.map → ...ft-Windows-Application-Experience_500.map b/...tion-Experience_Program-Telemetry_500.map → ...ft-Windows-Application-Experience_500.map
diff --git a/...tion-Experience_Program-Telemetry_505.map → ...ft-Windows-Application-Experience_505.map b/...tion-Experience_Program-Telemetry_505.map → ...ft-Windows-Application-Experience_505.map
diff --git a/...ft-Windows-Bits-Client_Operational_59.map → ...onal_Microsoft-Windows-Bits-Client_59.map b/...ft-Windows-Bits-Client_Operational_59.map → ...onal_Microsoft-Windows-Bits-Client_59.map
diff --git a/...agnostics-Performance_Operational_100.map → ...t-Windows-Diagnostics-Performance_100.map b/...agnostics-Performance_Operational_100.map → ...t-Windows-Diagnostics-Performance_100.map
diff --git a/...agnostics-Performance_Operational_200.map → ...t-Windows-Diagnostics-Performance_200.map b/...agnostics-Performance_Operational_200.map → ...t-Windows-Diagnostics-Performance_200.map
diff --git a/...soft-Windows-Hyper-V-VMMS-Admin_13002.map → ...icrosoft-Windows-Hyper-V-Worker_13002.map b/...soft-Windows-Hyper-V-VMMS-Admin_13002.map → ...icrosoft-Windows-Hyper-V-Worker_13002.map
diff --git a/...ft-Windows-Hyper-V-Worker-Admin_18500.map → ...icrosoft-Windows-Hyper-V-Worker_18500.map b/...ft-Windows-Hyper-V-Worker-Admin_18500.map → ...icrosoft-Windows-Hyper-V-Worker_18500.map
diff --git a/...ft-Windows-Hyper-V-Worker-Admin_18502.map → ...icrosoft-Windows-Hyper-V-Worker_18502.map b/...ft-Windows-Hyper-V-Worker-Admin_18502.map → ...icrosoft-Windows-Hyper-V-Worker_18502.map
diff --git a/...ft-Windows-Hyper-V-Worker-Admin_18508.map → ...icrosoft-Windows-Hyper-V-Worker_18508.map b/...ft-Windows-Hyper-V-Worker-Admin_18508.map → ...icrosoft-Windows-Hyper-V-Worker_18508.map
diff --git a/...ft-Windows-Hyper-V-Worker-Admin_18514.map → ...icrosoft-Windows-Hyper-V-Worker_18514.map b/...ft-Windows-Hyper-V-Worker-Admin_18514.map → ...icrosoft-Windows-Hyper-V-Worker_18514.map
diff --git a/...dows-NetworkProfile_Operational_10000.map → ...icrosoft-Windows-NetworkProfile_10000.map b/...dows-NetworkProfile_Operational_10000.map → ...icrosoft-Windows-NetworkProfile_10000.map
diff --git a/...dows-NetworkProfile_Operational_10001.map → ...icrosoft-Windows-NetworkProfile_10001.map b/...dows-NetworkProfile_Operational_10001.map → ...icrosoft-Windows-NetworkProfile_10001.map
diff --git a/...oft-Windows-Partition-Diagnostic_1006.map → ...stic_Microsoft-Windows-Partition_1006.map b/...oft-Windows-Partition-Diagnostic_1006.map → ...stic_Microsoft-Windows-Partition_1006.map
diff --git a/...t-Windows-PowerShell_Operational_4104.map → ...nal_Microsoft-Windows-PowerShell_4104.map b/...t-Windows-PowerShell_Operational_4104.map → ...nal_Microsoft-Windows-PowerShell_4104.map
diff --git a/...-Windows-PrintService_Operational_307.map → ...al_Microsoft-Windows-PrintService_307.map b/...-Windows-PrintService_Operational_307.map → ...al_Microsoft-Windows-PrintService_307.map
diff --git a/...topServices-RdpCoreTS_Operational_131.map → ...s-RemoteDesktopServices-RdpCoreTS_131.map b/...topServices-RdpCoreTS_Operational_131.map → ...s-RemoteDesktopServices-RdpCoreTS_131.map
diff --git a/...topServices-RdpCoreTS_Operational_140.map → ...s-RemoteDesktopServices-RdpCoreTS_140.map b/...topServices-RdpCoreTS_Operational_140.map → ...s-RemoteDesktopServices-RdpCoreTS_140.map
diff --git a/...ktopServices-RdpCoreTS_Operational_98.map → ...ws-RemoteDesktopServices-RdpCoreTS_98.map b/...ktopServices-RdpCoreTS_Operational_98.map → ...ws-RemoteDesktopServices-RdpCoreTS_98.map
diff --git a/...-Windows-Shell-Core_Operational_28115.map → ...al_Microsoft-Windows-Shell-Core_28115.map b/...-Windows-Shell-Core_Operational_28115.map → ...al_Microsoft-Windows-Shell-Core_28115.map
diff --git a/...t-Windows-Shell-Core_Operational_9701.map → ...nal_Microsoft-Windows-Shell-Core_9701.map b/...t-Windows-Shell-Core_Operational_9701.map → ...nal_Microsoft-Windows-Shell-Core_9701.map
diff --git a/...t-Windows-Shell-Core_Operational_9702.map → ...nal_Microsoft-Windows-Shell-Core_9702.map b/...t-Windows-Shell-Core_Operational_9702.map → ...nal_Microsoft-Windows-Shell-Core_9702.map
diff --git a/...t-Windows-Shell-Core_Operational_9703.map → ...nal_Microsoft-Windows-Shell-Core_9703.map b/...t-Windows-Shell-Core_Operational_9703.map → ...nal_Microsoft-Windows-Shell-Core_9703.map
diff --git a/...t-Windows-Shell-Core_Operational_9704.map → ...nal_Microsoft-Windows-Shell-Core_9704.map b/...t-Windows-Shell-Core_Operational_9704.map → ...nal_Microsoft-Windows-Shell-Core_9704.map
diff --git a/...t-Windows-Shell-Core_Operational_9705.map → ...nal_Microsoft-Windows-Shell-Core_9705.map b/...t-Windows-Shell-Core_Operational_9705.map → ...nal_Microsoft-Windows-Shell-Core_9705.map
diff --git a/...t-Windows-Shell-Core_Operational_9706.map → ...nal_Microsoft-Windows-Shell-Core_9706.map b/...t-Windows-Shell-Core_Operational_9706.map → ...nal_Microsoft-Windows-Shell-Core_9706.map
diff --git a/...t-Windows-Shell-Core_Operational_9707.map → ...nal_Microsoft-Windows-Shell-Core_9707.map b/...t-Windows-Shell-Core_Operational_9707.map → ...nal_Microsoft-Windows-Shell-Core_9707.map
diff --git a/...t-Windows-Shell-Core_Operational_9708.map → ...nal_Microsoft-Windows-Shell-Core_9708.map b/...t-Windows-Shell-Core_Operational_9708.map → ...nal_Microsoft-Windows-Shell-Core_9708.map
diff --git a/...t-Windows-Shell-Core_Operational_9709.map → ...nal_Microsoft-Windows-Shell-Core_9709.map b/...t-Windows-Shell-Core_Operational_9709.map → ...nal_Microsoft-Windows-Shell-Core_9709.map
diff --git a/...t-Windows-Shell-Core_Operational_9710.map → ...nal_Microsoft-Windows-Shell-Core_9710.map b/...t-Windows-Shell-Core_Operational_9710.map → ...nal_Microsoft-Windows-Shell-Core_9710.map
diff --git a/...t-Windows-Shell-Core_Operational_9711.map → ...nal_Microsoft-Windows-Shell-Core_9711.map b/...t-Windows-Shell-Core_Operational_9711.map → ...nal_Microsoft-Windows-Shell-Core_9711.map
diff --git a/...t-Windows-Shell-Core_Operational_9712.map → ...nal_Microsoft-Windows-Shell-Core_9712.map b/...t-Windows-Shell-Core_Operational_9712.map → ...nal_Microsoft-Windows-Shell-Core_9712.map
diff --git a/...icrosoft-Windows-SysMon_Operational_1.map → ...perational_Microsoft-Windows-Sysmon_1.map b/...icrosoft-Windows-SysMon_Operational_1.map → ...perational_Microsoft-Windows-Sysmon_1.map
diff --git a/...crosoft-Windows-SysMon_Operational_10.map → ...erational_Microsoft-Windows-Sysmon_10.map b/...crosoft-Windows-SysMon_Operational_10.map → ...erational_Microsoft-Windows-Sysmon_10.map
diff --git a/...crosoft-Windows-SysMon_Operational_11.map → ...erational_Microsoft-Windows-Sysmon_11.map b/...crosoft-Windows-SysMon_Operational_11.map → ...erational_Microsoft-Windows-Sysmon_11.map
diff --git a/...crosoft-Windows-SysMon_Operational_12.map → ...erational_Microsoft-Windows-Sysmon_12.map b/...crosoft-Windows-SysMon_Operational_12.map → ...erational_Microsoft-Windows-Sysmon_12.map
diff --git a/...crosoft-Windows-SysMon_Operational_13.map → ...erational_Microsoft-Windows-Sysmon_13.map b/...crosoft-Windows-SysMon_Operational_13.map → ...erational_Microsoft-Windows-Sysmon_13.map
diff --git a/...crosoft-Windows-SysMon_Operational_14.map → ...erational_Microsoft-Windows-Sysmon_14.map b/...crosoft-Windows-SysMon_Operational_14.map → ...erational_Microsoft-Windows-Sysmon_14.map
diff --git a/...crosoft-Windows-SysMon_Operational_15.map → ...erational_Microsoft-Windows-Sysmon_15.map b/...crosoft-Windows-SysMon_Operational_15.map → ...erational_Microsoft-Windows-Sysmon_15.map
diff --git a/...crosoft-Windows-SysMon_Operational_16.map → ...erational_Microsoft-Windows-Sysmon_16.map b/...crosoft-Windows-SysMon_Operational_16.map → ...erational_Microsoft-Windows-Sysmon_16.map
diff --git a/...crosoft-Windows-SysMon_Operational_17.map → ...erational_Microsoft-Windows-Sysmon_17.map b/...crosoft-Windows-SysMon_Operational_17.map → ...erational_Microsoft-Windows-Sysmon_17.map
diff --git a/...crosoft-Windows-SysMon_Operational_18.map → ...erational_Microsoft-Windows-Sysmon_18.map b/...crosoft-Windows-SysMon_Operational_18.map → ...erational_Microsoft-Windows-Sysmon_18.map
diff --git a/...crosoft-Windows-SysMon_Operational_19.map → ...erational_Microsoft-Windows-Sysmon_19.map b/...crosoft-Windows-SysMon_Operational_19.map → ...erational_Microsoft-Windows-Sysmon_19.map
diff --git a/...icrosoft-Windows-SysMon_Operational_2.map → ...perational_Microsoft-Windows-Sysmon_2.map b/...icrosoft-Windows-SysMon_Operational_2.map → ...perational_Microsoft-Windows-Sysmon_2.map
diff --git a/...crosoft-Windows-SysMon_Operational_20.map → ...erational_Microsoft-Windows-Sysmon_20.map b/...crosoft-Windows-SysMon_Operational_20.map → ...erational_Microsoft-Windows-Sysmon_20.map
diff --git a/...crosoft-Windows-SysMon_Operational_21.map → ...erational_Microsoft-Windows-Sysmon_21.map b/...crosoft-Windows-SysMon_Operational_21.map → ...erational_Microsoft-Windows-Sysmon_21.map
diff --git a/...crosoft-Windows-SysMon_Operational_22.map → ...erational_Microsoft-Windows-Sysmon_22.map b/...crosoft-Windows-SysMon_Operational_22.map → ...erational_Microsoft-Windows-Sysmon_22.map
diff --git a/...crosoft-Windows-SysMon_Operational_23.map → ...erational_Microsoft-Windows-Sysmon_23.map b/...crosoft-Windows-SysMon_Operational_23.map → ...erational_Microsoft-Windows-Sysmon_23.map
diff --git a/...icrosoft-Windows-SysMon_Operational_3.map → ...perational_Microsoft-Windows-Sysmon_3.map b/...icrosoft-Windows-SysMon_Operational_3.map → ...perational_Microsoft-Windows-Sysmon_3.map
diff --git a/...icrosoft-Windows-SysMon_Operational_4.map → ...perational_Microsoft-Windows-Sysmon_4.map b/...icrosoft-Windows-SysMon_Operational_4.map → ...perational_Microsoft-Windows-Sysmon_4.map
diff --git a/...icrosoft-Windows-SysMon_Operational_5.map → ...perational_Microsoft-Windows-Sysmon_5.map b/...icrosoft-Windows-SysMon_Operational_5.map → ...perational_Microsoft-Windows-Sysmon_5.map
diff --git a/...icrosoft-Windows-SysMon_Operational_6.map → ...perational_Microsoft-Windows-Sysmon_6.map b/...icrosoft-Windows-SysMon_Operational_6.map → ...perational_Microsoft-Windows-Sysmon_6.map
diff --git a/...icrosoft-Windows-SysMon_Operational_7.map → ...perational_Microsoft-Windows-Sysmon_7.map b/...icrosoft-Windows-SysMon_Operational_7.map → ...perational_Microsoft-Windows-Sysmon_7.map
diff --git a/...icrosoft-Windows-SysMon_Operational_8.map → ...perational_Microsoft-Windows-Sysmon_8.map b/...icrosoft-Windows-SysMon_Operational_8.map → ...perational_Microsoft-Windows-Sysmon_8.map
diff --git a/...icrosoft-Windows-SysMon_Operational_9.map → ...perational_Microsoft-Windows-Sysmon_9.map b/...icrosoft-Windows-SysMon_Operational_9.map → ...perational_Microsoft-Windows-Sysmon_9.map
diff --git a/...Windows-TaskScheduler_Operational_100.map → ...l_Microsoft-Windows-TaskScheduler_100.map b/...Windows-TaskScheduler_Operational_100.map → ...l_Microsoft-Windows-TaskScheduler_100.map
diff --git a/...Windows-TaskScheduler_Operational_102.map → ...l_Microsoft-Windows-TaskScheduler_102.map b/...Windows-TaskScheduler_Operational_102.map → ...l_Microsoft-Windows-TaskScheduler_102.map
diff --git a/...Windows-TaskScheduler_Operational_106.map → ...l_Microsoft-Windows-TaskScheduler_106.map b/...Windows-TaskScheduler_Operational_106.map → ...l_Microsoft-Windows-TaskScheduler_106.map
diff --git a/...Windows-TaskScheduler_Operational_119.map → ...l_Microsoft-Windows-TaskScheduler_119.map b/...Windows-TaskScheduler_Operational_119.map → ...l_Microsoft-Windows-TaskScheduler_119.map
diff --git a/...Windows-TaskScheduler_Operational_140.map → ...l_Microsoft-Windows-TaskScheduler_140.map b/...Windows-TaskScheduler_Operational_140.map → ...l_Microsoft-Windows-TaskScheduler_140.map
diff --git a/...Windows-TaskScheduler_Operational_141.map → ...l_Microsoft-Windows-TaskScheduler_141.map b/...Windows-TaskScheduler_Operational_141.map → ...l_Microsoft-Windows-TaskScheduler_141.map
diff --git a/...Windows-TaskScheduler_Operational_200.map → ...l_Microsoft-Windows-TaskScheduler_200.map b/...Windows-TaskScheduler_Operational_200.map → ...l_Microsoft-Windows-TaskScheduler_200.map
diff --git a/...Windows-TaskScheduler_Operational_201.map → ...l_Microsoft-Windows-TaskScheduler_201.map b/...Windows-TaskScheduler_Operational_201.map → ...l_Microsoft-Windows-TaskScheduler_201.map
diff --git a/...es-LocalSessionManager_Operational_21.map → ...rminalServices-LocalSessionManager_21.map b/...es-LocalSessionManager_Operational_21.map → ...rminalServices-LocalSessionManager_21.map
diff --git a/...es-LocalSessionManager_Operational_22.map → ...rminalServices-LocalSessionManager_22.map b/...es-LocalSessionManager_Operational_22.map → ...rminalServices-LocalSessionManager_22.map
diff --git a/...es-LocalSessionManager_Operational_23.map → ...rminalServices-LocalSessionManager_23.map b/...es-LocalSessionManager_Operational_23.map → ...rminalServices-LocalSessionManager_23.map
diff --git a/...es-LocalSessionManager_Operational_24.map → ...rminalServices-LocalSessionManager_24.map b/...es-LocalSessionManager_Operational_24.map → ...rminalServices-LocalSessionManager_24.map
diff --git a/...es-LocalSessionManager_Operational_25.map → ...rminalServices-LocalSessionManager_25.map b/...es-LocalSessionManager_Operational_25.map → ...rminalServices-LocalSessionManager_25.map
diff --git a/...es-LocalSessionManager_Operational_39.map → ...rminalServices-LocalSessionManager_39.map b/...es-LocalSessionManager_Operational_39.map → ...rminalServices-LocalSessionManager_39.map
diff --git a/...es-LocalSessionManager_Operational_40.map → ...rminalServices-LocalSessionManager_40.map b/...es-LocalSessionManager_Operational_40.map → ...rminalServices-LocalSessionManager_40.map
diff --git a/...alServices-RDPClient_Operational_1024.map → ...rminalServices-ClientActiveXCore_1024.map b/...alServices-RDPClient_Operational_1024.map → ...rminalServices-ClientActiveXCore_1024.map
diff --git a/...alServices-RDPClient_Operational_1025.map → ...rminalServices-ClientActiveXCore_1025.map b/...alServices-RDPClient_Operational_1025.map → ...rminalServices-ClientActiveXCore_1025.map
diff --git a/...alServices-RDPClient_Operational_1026.map → ...rminalServices-ClientActiveXCore_1026.map b/...alServices-RDPClient_Operational_1026.map → ...rminalServices-ClientActiveXCore_1026.map
diff --git a/...alServices-RDPClient_Operational_1027.map → ...rminalServices-ClientActiveXCore_1027.map b/...alServices-RDPClient_Operational_1027.map → ...rminalServices-ClientActiveXCore_1027.map
diff --git a/...alServices-RDPClient_Operational_1029.map → ...rminalServices-ClientActiveXCore_1029.map b/...alServices-RDPClient_Operational_1029.map → ...rminalServices-ClientActiveXCore_1029.map
diff --git a/...alServices-RDPClient_Operational_1102.map → ...rminalServices-ClientActiveXCore_1102.map b/...alServices-RDPClient_Operational_1102.map → ...rminalServices-ClientActiveXCore_1102.map
diff --git a/...alServices-RDPClient_Operational_1103.map → ...rminalServices-ClientActiveXCore_1103.map b/...alServices-RDPClient_Operational_1103.map → ...rminalServices-ClientActiveXCore_1103.map
diff --git a/...oteConnectionManager_Operational_1149.map → ...Services-RemoteConnectionManager_1149.map b/...oteConnectionManager_Operational_1149.map → ...Services-RemoteConnectionManager_1149.map
diff --git a/...moteConnectionManager_Operational_261.map → ...lServices-RemoteConnectionManager_261.map b/...moteConnectionManager_Operational_261.map → ...lServices-RemoteConnectionManager_261.map
diff --git a/...Microsoft-Windows-VHDMP-Operational_2.map → ...Operational_Microsoft-Windows-VHDMP_2.map b/...Microsoft-Windows-VHDMP-Operational_2.map → ...Operational_Microsoft-Windows-VHDMP_2.map
diff --git a/...dows-WLAN-AutoConfig_Operational_8000.map → ...icrosoft-Windows-WLAN-AutoConfig_8000.map b/...dows-WLAN-AutoConfig_Operational_8000.map → ...icrosoft-Windows-WLAN-AutoConfig_8000.map
diff --git a/...dows-WLAN-AutoConfig_Operational_8001.map → ...icrosoft-Windows-WLAN-AutoConfig_8001.map b/...dows-WLAN-AutoConfig_Operational_8001.map → ...icrosoft-Windows-WLAN-AutoConfig_8001.map
diff --git a/...dows-WLAN-AutoConfig_Operational_8002.map → ...icrosoft-Windows-WLAN-AutoConfig_8002.map b/...dows-WLAN-AutoConfig_Operational_8002.map → ...icrosoft-Windows-WLAN-AutoConfig_8002.map
diff --git a/...dows-WLAN-AutoConfig_Operational_8003.map → ...icrosoft-Windows-WLAN-AutoConfig_8003.map b/...dows-WLAN-AutoConfig_Operational_8003.map → ...icrosoft-Windows-WLAN-AutoConfig_8003.map
diff --git a/...Windows-WMI-Activity_Operational_5857.map → ...l_Microsoft-Windows-WMI-Activity_5857.map b/...Windows-WMI-Activity_Operational_5857.map → ...l_Microsoft-Windows-WMI-Activity_5857.map
diff --git a/...Windows-WMI-Activity_Operational_5860.map → ...l_Microsoft-Windows-WMI-Activity_5860.map b/...Windows-WMI-Activity_Operational_5860.map → ...l_Microsoft-Windows-WMI-Activity_5860.map
diff --git a/...Windows-WMI-Activity_Operational_5861.map → ...l_Microsoft-Windows-WMI-Activity_5861.map b/...Windows-WMI-Activity_Operational_5861.map → ...l_Microsoft-Windows-WMI-Activity_5861.map
diff --git a/evtx/Maps/Microsoft-Windows-WinRM_169.map → ...erational_Microsoft-Windows-WinRM_169.map b/evtx/Maps/Microsoft-Windows-WinRM_169.map → ...erational_Microsoft-Windows-WinRM_169.map
diff --git a/evtx/Maps/WindowsDefender_1000.map → ...crosoft-Windows-Windows Defender_1000.map b/evtx/Maps/WindowsDefender_1000.map → ...crosoft-Windows-Windows Defender_1000.map
diff --git a/evtx/Maps/WindowsDefender_1001.map → ...crosoft-Windows-Windows Defender_1001.map b/evtx/Maps/WindowsDefender_1001.map → ...crosoft-Windows-Windows Defender_1001.map
diff --git a/evtx/Maps/WindowsDefender_1002.map → ...crosoft-Windows-Windows Defender_1002.map b/evtx/Maps/WindowsDefender_1002.map → ...crosoft-Windows-Windows Defender_1002.map
diff --git a/evtx/Maps/WindowsDefender_1003.map → ...crosoft-Windows-Windows Defender_1003.map b/evtx/Maps/WindowsDefender_1003.map → ...crosoft-Windows-Windows Defender_1003.map
diff --git a/evtx/Maps/WindowsDefender_1004.map → ...crosoft-Windows-Windows Defender_1004.map b/evtx/Maps/WindowsDefender_1004.map → ...crosoft-Windows-Windows Defender_1004.map
diff --git a/evtx/Maps/WindowsDefender_1005.map → ...crosoft-Windows-Windows Defender_1005.map b/evtx/Maps/WindowsDefender_1005.map → ...crosoft-Windows-Windows Defender_1005.map
diff --git a/evtx/Maps/WindowsDefender_1006.map → ...crosoft-Windows-Windows Defender_1006.map b/evtx/Maps/WindowsDefender_1006.map → ...crosoft-Windows-Windows Defender_1006.map
diff --git a/evtx/Maps/WindowsDefender_1008.map → ...crosoft-Windows-Windows Defender_1008.map b/evtx/Maps/WindowsDefender_1008.map → ...crosoft-Windows-Windows Defender_1008.map
diff --git a/evtx/Maps/WindowsDefender_1011.map → ...crosoft-Windows-Windows Defender_1011.map b/evtx/Maps/WindowsDefender_1011.map → ...crosoft-Windows-Windows Defender_1011.map
diff --git a/evtx/Maps/WindowsDefender_1013.map → ...crosoft-Windows-Windows Defender_1013.map b/evtx/Maps/WindowsDefender_1013.map → ...crosoft-Windows-Windows Defender_1013.map
diff --git a/evtx/Maps/WindowsDefender_1116.map → ...crosoft-Windows-Windows Defender_1116.map b/evtx/Maps/WindowsDefender_1116.map → ...crosoft-Windows-Windows Defender_1116.map
diff --git a/evtx/Maps/WindowsDefender_1117.map → ...crosoft-Windows-Windows Defender_1117.map b/evtx/Maps/WindowsDefender_1117.map → ...crosoft-Windows-Windows Defender_1117.map
diff --git a/evtx/Maps/WindowsDefender_1150.map → ...crosoft-Windows-Windows Defender_1150.map b/evtx/Maps/WindowsDefender_1150.map → ...crosoft-Windows-Windows Defender_1150.map
diff --git a/evtx/Maps/WindowsDefender_5000.map → ...crosoft-Windows-Windows Defender_5000.map b/evtx/Maps/WindowsDefender_5000.map → ...crosoft-Windows-Windows Defender_5000.map
diff --git a/evtx/Maps/WindowsDefender_5001.map → ...crosoft-Windows-Windows Defender_5001.map b/evtx/Maps/WindowsDefender_5001.map → ...crosoft-Windows-Windows Defender_5001.map
diff --git a/evtx/Maps/WindowsDefender_5007.map → ...crosoft-Windows-Windows Defender_5007.map b/evtx/Maps/WindowsDefender_5007.map → ...crosoft-Windows-Windows Defender_5007.map
diff --git a/..._Firewall_With_Advanced_Security_2004.map → ...-Firewall-With-Advanced-Security_2004.map b/..._Firewall_With_Advanced_Security_2004.map → ...-Firewall-With-Advanced-Security_2004.map
diff --git a/evtx/Maps/OAlerts_300.map → ...Alerts_Microsoft-Office-16-Alerts_300.map b/evtx/Maps/OAlerts_300.map → ...Alerts_Microsoft-Office-16-Alerts_300.map
diff --git a/evtx/Maps/OpenSSH_4.map → evtx/Maps/OpenSSH-Operational_OpenSSH_4.map b/evtx/Maps/OpenSSH_4.map → evtx/Maps/OpenSSH-Operational_OpenSSH_4.map
diff --git a/evtx/Maps/Security_1100.map → ...urity_Microsoft-Windows-Eventlog_1100.map b/evtx/Maps/Security_1100.map → ...urity_Microsoft-Windows-Eventlog_1100.map
diff --git a/evtx/Maps/Security_1102.map → ...urity_Microsoft-Windows-Eventlog_1102.map b/evtx/Maps/Security_1102.map → ...urity_Microsoft-Windows-Eventlog_1102.map
diff --git a/evtx/Maps/Security_4608.map → ...rosoft-Windows-Security-Auditing_4608.map b/evtx/Maps/Security_4608.map → ...rosoft-Windows-Security-Auditing_4608.map
diff --git a/evtx/Maps/Security_4616.map → ...rosoft-Windows-Security-Auditing_4616.map b/evtx/Maps/Security_4616.map → ...rosoft-Windows-Security-Auditing_4616.map
diff --git a/evtx/Maps/Security_4624.map → ...rosoft-Windows-Security-Auditing_4624.map b/evtx/Maps/Security_4624.map → ...rosoft-Windows-Security-Auditing_4624.map
diff --git a/evtx/Maps/Security_4625.map → ...rosoft-Windows-Security-Auditing_4625.map b/evtx/Maps/Security_4625.map → ...rosoft-Windows-Security-Auditing_4625.map
diff --git a/evtx/Maps/Security_4634.map → ...rosoft-Windows-Security-Auditing_4634.map b/evtx/Maps/Security_4634.map → ...rosoft-Windows-Security-Auditing_4634.map
diff --git a/evtx/Maps/Security_4647.map → ...rosoft-Windows-Security-Auditing_4647.map b/evtx/Maps/Security_4647.map → ...rosoft-Windows-Security-Auditing_4647.map
diff --git a/evtx/Maps/Security_4648.map → ...rosoft-Windows-Security-Auditing_4648.map b/evtx/Maps/Security_4648.map → ...rosoft-Windows-Security-Auditing_4648.map
diff --git a/evtx/Maps/Security_4657.map → ...rosoft-Windows-Security-Auditing_4657.map b/evtx/Maps/Security_4657.map → ...rosoft-Windows-Security-Auditing_4657.map
diff --git a/evtx/Maps/Security_4661.map → ...rosoft-Windows-Security-Auditing_4661.map b/evtx/Maps/Security_4661.map → ...rosoft-Windows-Security-Auditing_4661.map
diff --git a/evtx/Maps/Security_4662.map → ...rosoft-Windows-Security-Auditing_4662.map b/evtx/Maps/Security_4662.map → ...rosoft-Windows-Security-Auditing_4662.map
diff --git a/evtx/Maps/Security_4663.map → ...rosoft-Windows-Security-Auditing_4663.map b/evtx/Maps/Security_4663.map → ...rosoft-Windows-Security-Auditing_4663.map
diff --git a/evtx/Maps/Security_4672.map → ...rosoft-Windows-Security-Auditing_4672.map b/evtx/Maps/Security_4672.map → ...rosoft-Windows-Security-Auditing_4672.map
diff --git a/evtx/Maps/Security_4688.map → ...rosoft-Windows-Security-Auditing_4688.map b/evtx/Maps/Security_4688.map → ...rosoft-Windows-Security-Auditing_4688.map
diff --git a/evtx/Maps/Security_4697.map → ...rosoft-Windows-Security-Auditing_4697.map b/evtx/Maps/Security_4697.map → ...rosoft-Windows-Security-Auditing_4697.map
diff --git a/evtx/Maps/Security_4698.map → ...rosoft-Windows-Security-Auditing_4698.map b/evtx/Maps/Security_4698.map → ...rosoft-Windows-Security-Auditing_4698.map
diff --git a/evtx/Maps/Security_4699.map → ...rosoft-Windows-Security-Auditing_4699.map b/evtx/Maps/Security_4699.map → ...rosoft-Windows-Security-Auditing_4699.map
diff --git a/evtx/Maps/Security_4700.map → ...rosoft-Windows-Security-Auditing_4700.map b/evtx/Maps/Security_4700.map → ...rosoft-Windows-Security-Auditing_4700.map
diff --git a/evtx/Maps/Security_4701.map → ...rosoft-Windows-Security-Auditing_4701.map b/evtx/Maps/Security_4701.map → ...rosoft-Windows-Security-Auditing_4701.map
diff --git a/evtx/Maps/Security_4702.map → ...rosoft-Windows-Security-Auditing_4702.map b/evtx/Maps/Security_4702.map → ...rosoft-Windows-Security-Auditing_4702.map
diff --git a/evtx/Maps/Security_4719.map → ...rosoft-Windows-Security-Auditing_4719.map b/evtx/Maps/Security_4719.map → ...rosoft-Windows-Security-Auditing_4719.map
diff --git a/evtx/Maps/Security_4720.map → ...rosoft-Windows-Security-Auditing_4720.map b/evtx/Maps/Security_4720.map → ...rosoft-Windows-Security-Auditing_4720.map
diff --git a/evtx/Maps/Security_4722.map → ...rosoft-Windows-Security-Auditing_4722.map b/evtx/Maps/Security_4722.map → ...rosoft-Windows-Security-Auditing_4722.map
diff --git a/evtx/Maps/Security_4723.map → ...rosoft-Windows-Security-Auditing_4723.map b/evtx/Maps/Security_4723.map → ...rosoft-Windows-Security-Auditing_4723.map
diff --git a/evtx/Maps/Security_4724.map → ...rosoft-Windows-Security-Auditing_4724.map b/evtx/Maps/Security_4724.map → ...rosoft-Windows-Security-Auditing_4724.map
diff --git a/evtx/Maps/Security_4725.map → ...rosoft-Windows-Security-Auditing_4725.map b/evtx/Maps/Security_4725.map → ...rosoft-Windows-Security-Auditing_4725.map
diff --git a/evtx/Maps/Security_4726.map → ...rosoft-Windows-Security-Auditing_4726.map b/evtx/Maps/Security_4726.map → ...rosoft-Windows-Security-Auditing_4726.map
diff --git a/evtx/Maps/Security_4738.map → ...rosoft-Windows-Security-Auditing_4738.map b/evtx/Maps/Security_4738.map → ...rosoft-Windows-Security-Auditing_4738.map
diff --git a/evtx/Maps/Security_4740.map → ...rosoft-Windows-Security-Auditing_4740.map b/evtx/Maps/Security_4740.map → ...rosoft-Windows-Security-Auditing_4740.map
diff --git a/evtx/Maps/Security_4742.map → ...rosoft-Windows-Security-Auditing_4742.map b/evtx/Maps/Security_4742.map → ...rosoft-Windows-Security-Auditing_4742.map
diff --git a/evtx/Maps/Security_4768.map → ...rosoft-Windows-Security-Auditing_4768.map b/evtx/Maps/Security_4768.map → ...rosoft-Windows-Security-Auditing_4768.map
diff --git a/evtx/Maps/Security_4769.map → ...rosoft-Windows-Security-Auditing_4769.map b/evtx/Maps/Security_4769.map → ...rosoft-Windows-Security-Auditing_4769.map
diff --git a/evtx/Maps/Security_4776.map → ...rosoft-Windows-Security-Auditing_4776.map b/evtx/Maps/Security_4776.map → ...rosoft-Windows-Security-Auditing_4776.map
diff --git a/evtx/Maps/Security_4778.map → ...rosoft-Windows-Security-Auditing_4778.map b/evtx/Maps/Security_4778.map → ...rosoft-Windows-Security-Auditing_4778.map
diff --git a/evtx/Maps/Security_4779.map → ...rosoft-Windows-Security-Auditing_4779.map b/evtx/Maps/Security_4779.map → ...rosoft-Windows-Security-Auditing_4779.map
diff --git a/evtx/Maps/Security_4798.map → ...rosoft-Windows-Security-Auditing_4798.map b/evtx/Maps/Security_4798.map → ...rosoft-Windows-Security-Auditing_4798.map
diff --git a/evtx/Maps/Security_4799.map → ...rosoft-Windows-Security-Auditing_4799.map b/evtx/Maps/Security_4799.map → ...rosoft-Windows-Security-Auditing_4799.map
@@ -1,5 +1,5 @@
 Author: Andrew Rathbun
-Description:  A security-enabled local group membership was enumerated 
+Description: A security-enabled local group membership was enumerated 
 EventId: 4799
 Channel: Security
 Provider: Microsoft-Windows-Security-Auditing

diff --git a/evtx/Maps/Security_4800.map → ...rosoft-Windows-Security-Auditing_4800.map b/evtx/Maps/Security_4800.map → ...rosoft-Windows-Security-Auditing_4800.map
diff --git a/evtx/Maps/Security_4801.map → ...rosoft-Windows-Security-Auditing_4801.map b/evtx/Maps/Security_4801.map → ...rosoft-Windows-Security-Auditing_4801.map
diff --git a/evtx/Maps/Security_4802.map → ...rosoft-Windows-Security-Auditing_4802.map b/evtx/Maps/Security_4802.map → ...rosoft-Windows-Security-Auditing_4802.map
diff --git a/evtx/Maps/Security_4803.map → ...rosoft-Windows-Security-Auditing_4803.map b/evtx/Maps/Security_4803.map → ...rosoft-Windows-Security-Auditing_4803.map
diff --git a/evtx/Maps/Security_5136.map → ...rosoft-Windows-Security-Auditing_5136.map b/evtx/Maps/Security_5136.map → ...rosoft-Windows-Security-Auditing_5136.map
diff --git a/evtx/Maps/Security_5140.map → ...rosoft-Windows-Security-Auditing_5140.map b/evtx/Maps/Security_5140.map → ...rosoft-Windows-Security-Auditing_5140.map
diff --git a/evtx/Maps/Security_5142.map → ...rosoft-Windows-Security-Auditing_5142.map b/evtx/Maps/Security_5142.map → ...rosoft-Windows-Security-Auditing_5142.map
diff --git a/evtx/Maps/Security_5144.map → ...rosoft-Windows-Security-Auditing_5144.map b/evtx/Maps/Security_5144.map → ...rosoft-Windows-Security-Auditing_5144.map
diff --git a/evtx/Maps/Security_5145.map → ...rosoft-Windows-Security-Auditing_5145.map b/evtx/Maps/Security_5145.map → ...rosoft-Windows-Security-Auditing_5145.map
diff --git a/evtx/Maps/Security_5156.map → ...rosoft-Windows-Security-Auditing_5156.map b/evtx/Maps/Security_5156.map → ...rosoft-Windows-Security-Auditing_5156.map
diff --git a/...ymantec-Endpoint-Protection-Client_51.map → ...ymantec-Endpoint-Protection-Client_51.map b/...ymantec-Endpoint-Protection-Client_51.map → ...ymantec-Endpoint-Protection-Client_51.map
diff --git a/evtx/Maps/System_6005.map → evtx/Maps/System_EventLog_6005.map b/evtx/Maps/System_6005.map → evtx/Maps/System_EventLog_6005.map
diff --git a/evtx/Maps/System_6006.map → evtx/Maps/System_EventLog_6006.map b/evtx/Maps/System_6006.map → evtx/Maps/System_EventLog_6006.map
diff --git a/evtx/Maps/System_6008.map → evtx/Maps/System_EventLog_6008.map b/evtx/Maps/System_6008.map → evtx/Maps/System_EventLog_6008.map
diff --git a/evtx/Maps/System_6013.map → evtx/Maps/System_EventLog_6013.map b/evtx/Maps/System_6013.map → evtx/Maps/System_EventLog_6013.map
diff --git a/evtx/Maps/System-Audit-CVE_2.map → .../System_Microsoft-Windows-Audit-CVE_2.map b/evtx/Maps/System-Audit-CVE_2.map → .../System_Microsoft-Windows-Audit-CVE_2.map
diff --git a/evtx/Maps/System_10000.map → ...ndows-DriverFrameworks-UserMode_10000.map b/evtx/Maps/System_10000.map → ...ndows-DriverFrameworks-UserMode_10000.map
@@ -3,7 +3,6 @@ Description: Device driver was installed. (Device was connected.)
 EventId: 10000
 Channel: "System"
 Provider: "Microsoft-Windows-DriverFrameworks-UserMode"
-Provider: Microsoft-Windows-DriverFrameworks-UserMode
 Maps:
   -
     Property: PayloadData1

diff --git a/evtx/Maps/System_104.map → ...ystem_Microsoft-Windows-Eventllog_104.map b/evtx/Maps/System_104.map → ...ystem_Microsoft-Windows-Eventllog_104.map
diff --git a/evtx/Maps/System_12.map → ...m_Microsoft-Windows-Kernel-General_12.map b/evtx/Maps/System_12.map → ...m_Microsoft-Windows-Kernel-General_12.map
diff --git a/evtx/Maps/System_13.map → ...m_Microsoft-Windows-Kernel-General_13.map b/evtx/Maps/System_13.map → ...m_Microsoft-Windows-Kernel-General_13.map
diff --git a/evtx/Maps/System_42.map → ...tem_Microsoft-Windows-Kernel-Power_42.map b/evtx/Maps/System_42.map → ...tem_Microsoft-Windows-Kernel-Power_42.map
diff --git a/evtx/Maps/System_1.map → ...rosoft-Windows-Power-Troubleshooter_1.map b/evtx/Maps/System_1.map → ...rosoft-Windows-Power-Troubleshooter_1.map
diff --git a/evtx/Maps/System_7034.map → ...s/System_Service-Control-Manager_7034.map b/evtx/Maps/System_7034.map → ...s/System_Service-Control-Manager_7034.map
diff --git a/evtx/Maps/System_7035.map → ...s/System_Service-Control-Manager_7035.map b/evtx/Maps/System_7035.map → ...s/System_Service-Control-Manager_7035.map
diff --git a/evtx/Maps/System_7036.map → ...s/System_Service-Control-Manager_7036.map b/evtx/Maps/System_7036.map → ...s/System_Service-Control-Manager_7036.map
diff --git a/evtx/Maps/System_7045.map → ...s/System_Service-Control-Manager_7045.map b/evtx/Maps/System_7045.map → ...s/System_Service-Control-Manager_7045.map
diff --git a/evtx/Maps/Windows_Powershell_400.map → ...aps/Windows-PowerShell_PowerShell_400.map b/evtx/Maps/Windows_Powershell_400.map → ...aps/Windows-PowerShell_PowerShell_400.map
diff --git a/evtx/Maps/Windows_Powershell_403.map → ...aps/Windows-PowerShell_PowerShell_403.map b/evtx/Maps/Windows_Powershell_403.map → ...aps/Windows-PowerShell_PowerShell_403.map
diff --git a/evtx/Maps/Windows_Powershell_600.map → ...aps/Windows-PowerShell_PowerShell_600.map b/evtx/Maps/Windows_Powershell_600.map → ...aps/Windows-PowerShell_PowerShell_600.map