CIFS Audit: evt file tags identifier

[arsalankhan]

Hi Team,

We’re trying to parse the evt files and it looks like NetApp (7 mode) doesn’t follow the Microsoft standard and just call the fields “Data”. ?

Would anyone please explain to me each tag in the following attached picture under data ? Thanks in advance.

[Jeff_Yao]

hope this helps

https://library.netapp.com/ecmdocs/ECMP1196993/html/GUID-47BBCD0B-B197-474C-8053-23CF791EE723.html

thanks