Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	8	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1140	1668	n-h1-713301-34.cbci-713301-34.local	S-1-5-20	2/12/2022 12:02:14 AM	afc62c3e-1fa3-0000-662c-c6afa31fd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1140	1656	n-h1-713301-34.cbci-713301-34.local	S-1-5-20	2/12/2022 12:02:04 AM	afc62c3e-1fa3-0000-662c-c6afa31fd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	6	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1140	1868	n-h1-713301-34.cbci-713301-34.local	S-1-5-20	2/12/2022 12:01:43 AM	afc62c3e-1fa3-0000-662c-c6afa31fd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	5	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1140	1668	n-h1-713301-34.cbci-713301-34.local	S-1-5-20	2/12/2022 12:01:40 AM	afc62c3e-1fa3-0000-662c-c6afa31fd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	4	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1332	3900	n-h1-713301-34	S-1-5-20	2/11/2022 11:27:50 PM	ea76e909-1f9e-0003-3be9-76ea9e1fd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1392	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:32 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	2	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1524	1660	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1524	1660	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]