Event id 10 has a different casing for the word GUID compared to the other events. The columns are cased as SourceProcessGUID and TargetProcessGUID in Event id 10 while all other events use SourceProcessGuid, TargetProcessGuid and ProcessGuid.
This results in output where columns cased in both ways exist, but only 1 contains the correct value, while the other one is empty.
This makes it annoying to compare or join event types. It might also accidently introduce false negatives because both columns exists but are empty in some cases since the differently cased column should have been used.
Event id 10 has a different casing for the word
GUIDcompared to the other events. The columns are cased asSourceProcessGUIDandTargetProcessGUIDin Event id 10 while all other events useSourceProcessGuid,TargetProcessGuidandProcessGuid.This results in output where columns cased in both ways exist, but only 1 contains the correct value, while the other one is empty.
This makes it annoying to compare or join event types. It might also accidently introduce false negatives because both columns exists but are empty in some cases since the differently cased column should have been used.
This is a breaking change !