How can we retrieve the key in the eventlog's eventdata?

Such as this:

EventData SubjectUserSid S-1-5-18 SubjectUserName ADMIN-PC$ SubjectDomainName WORKGROUP SubjectLogonId 0x3e7 NewProcessId 0x6e8 NewProcessName C:\Windows\System32\csrss.exe TokenElevationType %%1936 ProcessId 0xc50 CommandLine

I can only get the value, no the keys/labels:

Event Category: 13313 Time Generated: 09/03/18 15:54:24 Source Name: Microsoft-Windows-Security-Auditing Event ID: 4689 Event Type: 8 Computer Name: admin-PC Record Number: 233775 Sid: None TimeWritten: 09/03/18 15:54:24

Event Data:<<<< S-1-5-18 ADMIN-PC$ WORKGROUP 0x3e7 0x0 0x12fc C:\Windows\System32\taskeng.exe

Any help is appriciated.

tjguk / wmi

How can we retrieve the key in the eventlog's eventdata? #5

I can only get the value, no the keys/labels: