I pulled _raw (Show Source) for the events in my screenshot and the "TaskCategory" value matches the table output, no "Task" field to be found though. I also checked the text-based versions of logs on the generating host and the "TaskCategory" values for the original events track with what I would expect them to be, so the issue seems to be between the UF and Indexer.
11/21/2025 08:28:19 AM LogName=Security EventCode=4689 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291156 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=A process has exited. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Process Information: Process ID: 0x714 Process Name: C:\Windows\System32\svchost.exe Exit Status: 0x0
11/21/2025 08:28:19 AM LogName=Security EventCode=4688 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291155 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=A new process has been created. Creator Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Target Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2728 New Process Name: C:\Windows\System32\svchost.exe Token Elevation Type: TokenElevationTypeDefault (1) Mandatory Label: Mandatory Label\System Mandatory Level Creator Process ID: 0x338 Creator Process Name: C:\Windows\System32\services.exe Process Command Line: ...[truncated for brevity]
11/21/2025 08:28:19 AM LogName=Security EventCode=4672 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291153 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=Special privileges assigned to new logon. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
11/21/2025 08:28:19 AM LogName=Security EventCode=4670 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291154 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=Permissions on an object were changed. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Object: Object Server: Security Object Type: Token Object Name: - Handle ID: 0x860 Process: Process ID: 0x338 Process Name: C:\Windows\System32\services.exe Permissions Change: Original Security Descriptor: D:(A;;GA;;;SY)(A;;RCGXGR;;;BA) New Security Descriptor: D:(A;;GA;;;SY)(A;;RC;;;OW)(A;;GA;;;NT SERVICE\gpsvc)
11/21/2025 08:28:19 AM LogName=Security EventCode=4627 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291152 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=Group membership information. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Type: 5 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Event in sequence: 1 of 1 Group Membership: BUILTIN\Administrators Everyone NT AUTHORITY\Authenticated Users Mandatory Label\System Mandatory Level ...[truncated for brevity]
11/21/2025 08:28:19 AM LogName=Security EventCode=4624 EventType=0 ComputerName=DESKTOP-1VBIRTE SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=291151 Keywords=Audit Success TaskCategory=Process Termination OpCode=Info Message=An account was successfully logged on. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: DESKTOP-1VBIRTE$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: No Elevated Token: Yes Impersonation Level: Impersonation New Logon: Security ID: NT AUTHORITY\SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x338 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 ...[truncated for brevity]
