windows_event_audit_policy_changed

SCHEMA

audit_policy_changes	string	Changes that were made.
category	string	The name of auditing Category which subcategory was changed.
description	string	Plugin description text
eventid	int	The Windows event ID
provider_name	string	The Windows event provider
source	string	The Windows event source
subcategory	string	The name of auditing Subcategory which was changed.
subject_domain	string	The domain or computer name for the account that reported the logon
subject_username	string	The account that reported the logon

-- windows_event_audit_policy_changed INFO
SELECT 
   -- Device ID DETAILS
   meta_hostname, meta_ip_address, 

   -- Query Details
   query_name, audit_policy_changes, category, description, eventid,
   provider_name, source, subcategory, subject_domain, subject_username,

   -- Decoration 
   meta_boot_time, meta_eid, meta_endpoint_type, 
   meta_ip_mask, meta_mac_address, meta_os_name, meta_os_platform, meta_os_type,
   meta_os_version, meta_public_ip, meta_query_pack_version, meta_username,

   --- Generic
   calendar_time, counter, epoch, host_identifier, numerics
   osquery_action, unix_time,

   -- Data Lake
   customer_id, endpoint_id, upload_size

FROM xdr_data
WHERE query_name = 'windows_event_audit_policy_changed'

Can someone test this for me?

Karl_Ackerman