Windows event logEvent ID 17
3 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 17
3 channels
- Microsoft-Windows-Sysmon/OperationalPipeEvent (Pipe Created)Microsoft-Windows-Sysmon%4Operational.evtx
- ApplicationCarbon Black DefenseApplication.evtx
- Microsoft-Windows-Application-Experience/Program-Compatibility-AssistantPath of executed programMicrosoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx