Add files via upload

SoftwareUpdateClientTelemetry.sql

@@ -9,7 +9,7 @@ json_extract(events_persisted.payload,'$.time') as 'UTC TimeStamp',
 -- Timestamp from json payload
 datetime((timestamp - 116444736000000000)/10000000, 'unixepoch','localtime') as 'Local TimeStamp',
 producers.producer_id_text as Producer,
-json_extract(events_persisted.payload,'$.data.EventInstanceID') as 'EventInstanceID',
+
 json_extract(events_persisted.payload,'$.ext.utc.seq') as 'seq',
 -- Actions
 replace(full_event_name,'SoftwareUpdateClientTelemetry.','') as 'Event',
@@ -18,8 +18,12 @@ json_extract(events_persisted.payload,'$.data.CallerApplicationName') as 'Caller
 json_extract(events_persisted.payload,'$.data.NumberOfApplicableUpdates') as 'NrOfApplicableUpdates',
 json_extract(events_persisted.payload,'$.data.IntentPFNs') as 'IntentPFNs',
 coalesce(json_extract(events_persisted.payload,'$.data.HostName'),json_extract(events_persisted.payload,'$.data.ServiceUrl')) as 'HostName',
+json_extract(events_persisted.payload,'$.data.EventInstanceID') as 'EventInstanceID',
 json_extract(events_persisted.payload,'$.ext.utc.pgName') as 'pgName',
-json_extract(events_persisted.payload,'$.ext.utc.loggingBinary') as 'loggingBinary'
+json_extract(events_persisted.payload,'$.ext.utc.loggingBinary') as 'loggingBinary',
+-- user
+trim(json_extract(events_persisted.payload,'$.ext.user.localId'),'m:') as 'UserId',
+events_persisted.sid as 'User SID'
 
 FROM events_persisted
 join producers on producers.producer_id = events_persisted.producer_id

VirtualDesktop.sql

@@ -0,0 +1,32 @@
+-- Diagnostic Microsoft.WebBrowser
+-- from C:\ProgramData\Microsoft\Diagnosis\EventTranscript\EventTranscript.db
+-- For more info visit https://github.com/rathbuna/EventTranscript.db-Research
+
+
+SELECT
+
+--Timestamp from db field
+json_extract(events_persisted.payload,'$.time') as 'UTC TimeStamp',
+-- Timestamp from json payload
+datetime((timestamp - 116444736000000000)/10000000, 'unixepoch','localtime') as 'Local TimeStamp',
+
+json_extract(events_persisted.payload,'$.ext.utc.seq') as 'seq',
+replace(replace(replace(events_persisted.full_event_name,'Microsoft-Windows-Desktop-Shell-Windowing.',''),'VirtualDesktop',''),'Microsoft.Windows.Shell.Switcher.','') as 'Event',
+json_extract(events_persisted.payload,'$.ext.metadata.f.desktopId') as 'desktopId',
+coalesce(json_extract(events_persisted.payload,'$.data.newDesktopId'),json_extract(events_persisted.payload,'$.data.desktopId')) as 'Current DesktopId',
+json_extract(events_persisted.payload,'$.data.oldDesktopId') as 'Old DesktopId',
+json_extract(events_persisted.payload,'$.data.destroyedDesktopId') as 'Destroyed DesktopId',
+json_extract(events_persisted.payload,'$.data.fallbackDesktopId') as 'Fallback DesktopId',
+case json_extract(events_persisted.payload,'$.data.isActiveDesktop') 
+when 1 then 'Yes'
+end as 'isActiveDesktop',
+
+logging_binary_name,
+-- user
+trim(json_extract(events_persisted.payload,'$.ext.user.localId'),'m:') as 'UserId',
+events_persisted.sid as 'User SID'
+
+
+from events_persisted 
+where events_persisted.full_event_name like ('%VirtualDesktop%')
+order by events_persisted.timestamp desc