

```bash
"0CCE9210-69AE-11D9-BED3-505054503030": [
  "Security State Change",
  "System"
],
"0CCE9211-69AE-11D9-BED3-505054503030": [
  "Security System Extension",
  "System"
],
"0CCE9212-69AE-11D9-BED3-505054503030": [
  "System Integrity",
  "System"
],
"0CCE9213-69AE-11D9-BED3-505054503030": [
  "IPsec Driver",
  "System"
],
"0CCE9214-69AE-11D9-BED3-505054503030": [
  "Other System Events",
  "System"
],
"0CCE9215-69AE-11D9-BED3-505054503030": [
  "Logon",
  "Logon/Logoff"
],
"0CCE9216-69AE-11D9-BED3-505054503030": [
  "Logoff",
  "Logon/Logoff"
],
"0CCE9217-69AE-11D9-BED3-505054503030": [
  "Account Lockout",
  "Logon/Logoff"
],
"0CCE9218-69AE-11D9-BED3-505054503030": [
  "IPsec Main Mode",
  "Logon/Logoff"
],
"0CCE9219-69AE-11D9-BED3-505054503030": [
  "IPsec Quick Mode",
  "Logon/Logoff"
],
"0CCE921A-69AE-11D9-BED3-505054503030": [
  "IPsec Extended Mode",
  "Logon/Logoff"
],
"0CCE921B-69AE-11D9-BED3-505054503030": [
  "Special Logon",
  "Logon/Logoff"
],
"0CCE921C-69AE-11D9-BED3-505054503030": [
  "Other Logon/Logoff Events",
  "Logon/Logoff"
],
"0CCE9243-69AE-11D9-BED3-505054503030": [
  "Network Policy Server",
  "Logon/Logoff"
],
"0CCE9247-69AE-11D9-BED3-505054503030": [
  "User / Device Claims",
  "Logon/Logoff"
],
"0CCE921D-69AE-11D9-BED3-505054503030": [
  "File System",
  "Object Access"
],
"0CCE921E-69AE-11D9-BED3-505054503030": [
  "Registry",
  "Object Access"
],
"0CCE921F-69AE-11D9-BED3-505054503030": [
  "Kernel Object",
  "Object Access"
],
"0CCE9220-69AE-11D9-BED3-505054503030": [
  "SAM",
  "Object Access"
],
"0CCE9221-69AE-11D9-BED3-505054503030": [
  "Certification Services",
  "Object Access"
],
"0CCE9222-69AE-11D9-BED3-505054503030": [
  "Application Generated",
  "Object Access"
],
"0CCE9223-69AE-11D9-BED3-505054503030": [
  "Handle Manipulation",
  "Object Access"
],
"0CCE9224-69AE-11D9-BED3-505054503030": [
  "File Share",
  "Object Access"
],
"0CCE9225-69AE-11D9-BED3-505054503030": [
  "Filtering Platform Packet Drop",
  "Object Access"
],
"0CCE9226-69AE-11D9-BED3-505054503030": [
  "Filtering Platform Connection ",
  "Object Access"
],
"0CCE9227-69AE-11D9-BED3-505054503030": [
  "Other Object Access Events",
  "Object Access"
],
"0CCE9244-69AE-11D9-BED3-505054503030": [
  "Detailed File Share",
  "Object Access"
],
"0CCE9245-69AE-11D9-BED3-505054503030": [
  "Removable Storage",
  "Object Access"
],
"0CCE9246-69AE-11D9-BED3-505054503030": [
  "Central Policy Staging",
  "Object Access"
],
"0CCE9228-69AE-11D9-BED3-505054503030": [
  "Sensitive Privilege Use",
  "Privilege Use"
],
"0CCE9229-69AE-11D9-BED3-505054503030": [
  "Non Sensitive Privilege Use",
  "Privilege Use"
],
"0CCE922A-69AE-11D9-BED3-505054503030": [
  "Other Privilege Use Events",
  "Privilege Use"
],
"0CCE922B-69AE-11D9-BED3-505054503030": [
  "Process Creation",
  "Detailed Tracking"
],
"0CCE922C-69AE-11D9-BED3-505054503030": [
  "Process Termination",
  "Detailed Tracking"
],
"0CCE922D-69AE-11D9-BED3-505054503030": [
  "DPAPI Activity",
  "Detailed Tracking"
],
"0CCE922E-69AE-11D9-BED3-505054503030": [
  "RPC Events",
  "Detailed Tracking"
],
"0CCE9248-69AE-11D9-BED3-505054503030": [
  "Plug and Play Events",
  "Detailed Tracking"
],
"0CCE922F-69AE-11D9-BED3-505054503030": [
  "Audit Policy Change",
  "Policy Change"
],
"0CCE9230-69AE-11D9-BED3-505054503030": [
  "Authentication Policy Change",
  "Policy Change"
],
"0CCE9231-69AE-11D9-BED3-505054503030": [
  "Authorization Policy Change",
  "Policy Change"
],
"0CCE9232-69AE-11D9-BED3-505054503030": [
  "MPSSVC Rule-Level Policy Change",
  "Policy Change"
],
"0CCE9233-69AE-11D9-BED3-505054503030": [
  "Filtering Platform Policy Change",
  "Policy Change"
],
"0CCE9234-69AE-11D9-BED3-505054503030": [
  "Other Policy Change Events",
  "Policy Change"
],
"0CCE9235-69AE-11D9-BED3-505054503030": [
  "User Account Management",
  "Account Management"
],
"0CCE9236-69AE-11D9-BED3-505054503030": [
  "Computer Account Management",
  "Account Management"
],
"0CCE9237-69AE-11D9-BED3-505054503030": [
  "Security Group Management",
  "Account Management"
],
"0CCE9238-69AE-11D9-BED3-505054503030": [
  "Distribution Group Management",
  "Account Management"
],
"0CCE9239-69AE-11D9-BED3-505054503030": [
  "Application Group Management",
  "Account Management"
],
"0CCE923A-69AE-11D9-BED3-505054503030": [
  "Other Account Management Events",
  "Account Management"
],
"0CCE923B-69AE-11D9-BED3-505054503030": [
  "Directory Service Access",
  "Account Management"
],
"0CCE923C-69AE-11D9-BED3-505054503030": [
  "Directory Service Changes",
  "Account Management"
],
"0CCE923D-69AE-11D9-BED3-505054503030": [
  "Directory Service Replication",
  "Account Management"
],
"0CCE923E-69AE-11D9-BED3-505054503030": [
  "Detailed Directory Service Replication",
  "Account Management"
],
"0CCE923F-69AE-11D9-BED3-505054503030": [
  "Credential Validation",
  "Account Logon"
],
"0CCE9240-69AE-11D9-BED3-505054503030": [
  "Kerberos Service Ticket Operations",
  "Account Logon"
],
"0CCE9241-69AE-11D9-BED3-505054503030": [
  "Other Account Logon Events",
  "Account Logon"
],
"0CCE9242-69AE-11D9-BED3-505054503030": [
  "Kerberos Authentication Service",
  "Account Logon"
]

```
