Elastic Windows Event Explorer
Publisher - Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
Event IDs
0
1
17
18
19
20