Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	8	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1152	1688	n-h1-843834-10.cbci-843834-10.local	S-1-5-20	8/10/2022 5:42:04 PM	60f3243f-ace0-0000-6d24-f360e0acd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1152	1928	n-h1-843834-10.cbci-843834-10.local	S-1-5-20	8/10/2022 5:41:54 PM	60f3243f-ace0-0000-6d24-f360e0acd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	6	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1152	1684	n-h1-843834-10.cbci-843834-10.local	S-1-5-20	8/10/2022 5:41:25 PM	60f3243f-ace0-0000-6d24-f360e0acd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	5	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1152	1348	n-h1-843834-10.cbci-843834-10.local	S-1-5-20	8/10/2022 5:41:23 PM	60f3243f-ace0-0000-6d24-f360e0acd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	4	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1304	1968	n-h1-843834-10	S-1-5-20	8/10/2022 4:39:06 PM	a19d860b-acd7-0001-2786-9da1d7acd801		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1392	1532	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:32 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	2	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1524	1660	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Subscription policy has changed. Forwarder is adjusting its subscriptions according to the subscription manager(s) in the updated policy.	106	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-Forwarding	699e309c-e782-4400-98c8-e21d162d7b7b	Microsoft-Windows-Forwarding/Operational	1524	1660	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:17 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-forwarding/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]