winlog.channel:Security AND event.code:1102
