{
  "_comment": "Log test request for a Sysmon Event ID 1 record. Paste a REAL event into the event field rather than a hand-written one: open Event Viewer on the endpoint, go to Applications and Services Logs > Microsoft > Windows > Sysmon > Operational, select a process-creation record, open the Details tab, choose XML View, copy it, and JSON-escape it into the event value below. A hand-written sample will decode differently from the real thing and will send you chasing a rule that never fires in production. Remove this _comment key before sending; the Content Manager forwards unknown fields to the engine.",
  "space": "test",
  "integration": "REPLACE_WITH_SYSMON_CUSTOM_INTEGRATION_UUID",
  "queue": 1,
  "location": "EventChannel",
  "trace_level": "ALL",
  "event": "REPLACE_WITH_THE_JSON_ESCAPED_SYSMON_EVENT_XML"
}