drop security evtx csv · timeline admin$ ipc$ c$ share access · 5140 5145 events · correlate source ips · runs locally
drop security evtx csv (5140 / 5145)