{"time_utc":"2026-10-20T09:02:10Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC1","record_id":12004,"event_id":4624,"user":"LAB\\mira","logon_type":3,"source_ip":"192.0.2.44","status":null,"sub_status":null}
{"time_utc":"2026-10-20T09:01:20Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC1","record_id":12002,"event_id":4625,"user":"LAB\\mira","logon_type":3,"source_ip":"192.0.2.44","status":"0xC000006D","sub_status":"0xC000006A"}
{"time_utc":"2026-10-20T09:02:20Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC2","record_id":12002,"event_id":4624,"user":"LAB\\svc-backup","logon_type":3,"source_ip":"192.0.2.80","status":null,"sub_status":null}
{"time_utc":"2026-10-20T09:01:00Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC1","record_id":12001,"event_id":4625,"user":"LAB\\mira","logon_type":3,"source_ip":"192.0.2.44","status":"0xC000006D","sub_status":"0xC000006A"}
{"time_utc":"2026-10-20T09:02:30Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC1","record_id":12005,"event_id":4624,"user":"LAB\\mira","logon_type":2,"source_ip":null,"status":null,"sub_status":null}
{"time_utc":"2026-10-20T09:01:10Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC2","record_id":12001,"event_id":4625,"user":"LAB\\backup","logon_type":3,"source_ip":"192.0.2.80","status":"0xC000006D","sub_status":"0xC0000064"}
{"time_utc":"2026-10-20T09:01:40Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC1","record_id":12003,"event_id":4625,"user":"LAB\\mira","logon_type":3,"source_ip":"192.0.2.44","status":"0xC000006D","sub_status":"0xC000006A"}
{"time_utc":"2026-10-20T09:01:20Z","provider":"Microsoft-Windows-Security-Auditing","channel":"Security","computer":"LAB-PC1","record_id":12002,"event_id":4625,"user":"LAB\\mira","logon_type":3,"source_ip":"192.0.2.44","status":"0xC000006D","sub_status":"0xC000006A"}