winlog.channel:Security AND (event.code:4732 AND winlog.event_data.TargetSid:S\-1\-5\-32\-544)
