SH-Deployer/apps/Splunk_TA_windows/lookups/windows_audit_changes_900.csv

1	EventCode	action	change_type	object_category
2	517	cleared	audit	audit
3	1100	stopped	audit	audit
4	1102	cleared	audit	audit log
5	4720	created	AAA	user
6	4741	created	user	user
7	624	created	user	user
8	645	created	user	user
9	4722	modified	AAA	user
10	626	modified	user	user
11	4723	modified	AAA	user
12	627	modified	user	user
13	4724	modified	AAA	user
14	628	modified	user	user
15	4725	modified	AAA	user
16	629	modified	user	user
17	4726	deleted	AAA	user
18	4743	deleted	user	user
19	630	deleted	user	user
20	647	deleted	user	user
21	4738	modified	AAA	user
22	4742	modified	user	user
23	642	modified	user	user
24	646	modified	user	user
25	4740	lockout	AAA	user
26	644	modified	user	user
27	625	modified	user	user
28	671	modified	user	user
29	4767	modified	AAA	user
30	1101	success	audit	audit
31	1108	success	audit	audit
32	4719	modified	audit	audit policy
33	4717		AAA	security access
34	4718		AAA	security access
35	4727		AAA	group
36	4728		AAA	user
37	4729		AAA	user
38	4730		AAA	group
39	4731		AAA	group
40	4732	modified	AAA	user
41	4733		AAA	user
42	4734		AAA	group
43	4735		AAA	group
44	4737		AAA	group
45	4739		AAA	global group
46	4750	modified	AAA	user group
47	4753		AAA	global group
48	4754		AAA	group
49	4755		AAA	group
50	4756		AAA	user
51	4757		AAA	user
52	4758		AAA	group
53	4764		AAA	group
54	4799		AAA	group
55	4781	modified	AAA	user
56	4703	modified	AAA	user
57	4704	modified	AAA	user
58	4705	modified	AAA	user
59	4706	modified	AAA	directory service
60	4800	locked	AAA	user
61	4801	unlocked	AAA	user
62	4634	logoff	AAA	user
63	4698	created	scheduled task	scheduled task
64	4700	started	scheduled task	scheduled task
65	4701	stopped	scheduled task	scheduled task
66	4702	modified	scheduled task	scheduled task
67	4713	modified	AAA	directory service
68	4794	modified	AAA	user
69	4798	read	AAA	user
70	4744	created	AAA	user group
71	4749	created	AAA	user group
72	4759	created	AAA	user group
73	4876	read	AAA	database