Windows event logEvent ID 1
6 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 1
6 channels
- Microsoft-Windows-Sysmon/OperationalProcess creationMicrosoft-Windows-Sysmon%4Operational.evtx
- SystemThe system time was changed / Sleep/wake eventsSystem.evtx
- ApplicationCarbon Black Defense / Cylance alert / An attempt to exploit a known vulnerability detectedApplication.evtx
- OpenSSH/AdminSSH critical errorOpenSSH%4Admin.evtx
- Microsoft-Windows-VHDMP-OperationalA VHD has been createdMicrosoft-Windows-VHDMP-Operational.evtx
- Microsoft-Windows-VHDMP/OperationalA VHD has been createdMicrosoft-Windows-VHDMP%4Operational.evtx