diff --git a/ClipboardHistory.Service.AddItemActivity.sql b/ClipboardHistory.Service.AddItemActivity.sql new file mode 100644 index 0000000..e11ad6e --- /dev/null +++ b/ClipboardHistory.Service.AddItemActivity.sql @@ -0,0 +1,32 @@ +SELECT +json_extract(events_persisted.payload,'$.time') as 'Time', +datetime((timestamp - 116444736000000000)/10000000, 'unixepoch') as 'Payload UTC TimeStamp', +json_extract(events_persisted.payload,'$.ext.loc.tz') as 'TimeZome', +json_extract(events_persisted.payload,'$.data.Origin') as 'Origin', + + +json_extract(events_persisted.payload,'$.data.IsCurrentClipboardData') as 'IsCurrent', +producers.producer_id_text as 'Producer', +json_extract(events_persisted.payload,'$.data.SourceApplicationName') as 'SourceApplicationName', +json_extract(events_persisted.payload,'$.data.ItemDataCreationStatus') as 'CreationStatus', +json_extract(events_persisted.payload,'$.data.Formats') as 'Formats', +compressed_payload_size as 'size', + + + +json_extract(events_persisted.payload,'$.ext.user.localId') as 'UserId', +json_extract(events_persisted.payload,'$.ext.os.name') as 'OS', +json_extract(events_persisted.payload,'$.ext.device.deviceClass') as 'deviceClass', +json_extract(events_persisted.payload,'$.ext.device.localId') as 'localId', + +json_extract(events_persisted.payload,'$.ext.protocol.ticketKeys') as 'ticketKeys', +json_extract(events_persisted.payload,'$.ext.protocol.devMake') as 'Device Make', +json_extract(events_persisted.payload,'$.ext.protocol.devModel') as 'Device Model', +logging_binary_name + +from events_persisted +join producers on events_persisted.producer_id = producers.producer_id +where full_event_name is 'Microsoft.Windows.ClipboardHistory.Service.AddItemActivity' +order by timestamp desc + +