event-logging-v3-client-v3.2.4-WIP.xsd

<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright 2016 Crown Copyright
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
-->
<xs:schema xmlns:evt="event-logging:3"
           xmlns:xs="http://www.w3.org/2001/XMLSchema"
           targetNamespace="event-logging:3"
           elementFormDefault="qualified"
           attributeFormDefault="unqualified"
           version="3.2.4"
           id="event-logging-v3.2.4-client">
   <xs:annotation>
      <xs:documentation>This schema describes the allowed element structure for event logging. Please refer to the documentation and examples for a description of how to use this schema in addition to the descriptions given for each element within this schema.</xs:documentation>
   </xs:annotation>
   <xs:element name="Event">
      <xs:annotation>
         <xs:documentation>A single event that has occurred and been recorded.</xs:documentation>
      </xs:annotation>
      <xs:complexType>
         <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element name="Classification"
                        type="evt:ClassificationComplexType"
                        minOccurs="0"
                        maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>The classification for the event.</xs:documentation>
               </xs:annotation>
            </xs:element>
            <xs:element name="EventTime" minOccurs="1" maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>This element contains information about the time the event was created.</xs:documentation>
               </xs:annotation>
               <xs:complexType>
                  <xs:sequence minOccurs="1" maxOccurs="1">
                     <xs:element name="TimeCreated"
                                 type="evt:DateTimeSimpleType"
                                 minOccurs="1"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>This element contains information about the time the event was created.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="TimeSource"
                                 type="evt:DeviceComplexType"
                                 minOccurs="0"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>This is an optional element to be used to indicate the time source that the event creation time has been synchronised with. In most circumstances it is assumed that the event time has been synchronised with the corporate time service where the generating device resides so the inclusion of this element is not required.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                  </xs:sequence>
               </xs:complexType>
            </xs:element>
            <xs:element name="EventSource" minOccurs="1" maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>This element details where the event came from, i.e. what generator created the event and on what device.</xs:documentation>
               </xs:annotation>
               <xs:complexType>
                  <xs:sequence minOccurs="1" maxOccurs="1">
                     <xs:element name="System"
                                 type="evt:SystemComplexType"
                                 minOccurs="1"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>The system that generated the event. This is not the same as the generator as the generator is merely the application or component that created the event, e.g. auditd. The system describes the higher level project/service or capability that uses the generator as a component, e.g. 'Payroll System'.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="Generator" type="xs:string" minOccurs="1" maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>The thing that generated the event. This could be the name of an application, service or OS entity. Multiple devices may host the same generator, e.g. many copies of the same OS. The event type within the event description will describe an event that is unique to the generator, i.e. the generator is treated as a namespace for event type ids.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:choice minOccurs="1" maxOccurs="1">
                        <xs:sequence minOccurs="1" maxOccurs="1">
                           <xs:element name="Device"
                                       type="evt:DeviceComplexType"
                                       minOccurs="1"
                                       maxOccurs="1">
                              <xs:annotation>
                                 <xs:documentation>A description of the device that the event generator is hosted upon.</xs:documentation>
                              </xs:annotation>
                           </xs:element>
                           <xs:element name="Client"
                                       type="evt:DeviceComplexType"
                                       minOccurs="0"
                                       maxOccurs="1">
                              <xs:annotation>
                                 <xs:documentation>In situations where an event has been created as a result of an interaction with a client device, the client should be recorded. This will be the case for web applications that are responding to input from users with active sessions. All authentication events that originate from a connected client should populate this element.</xs:documentation>
                              </xs:annotation>
                           </xs:element>
                           <xs:element name="Server"
                                       type="evt:DeviceComplexType"
                                       minOccurs="0"
                                       maxOccurs="1">
                              <xs:annotation>
                                 <xs:documentation>In situations where an event has been created as a result of an interaction with a server device, the server should be recorded.</xs:documentation>
                              </xs:annotation>
                           </xs:element>
                        </xs:sequence>
                        <xs:sequence minOccurs="1" maxOccurs="1">
                           <xs:element name="Door" minOccurs="1" maxOccurs="1">
                              <xs:annotation>
                                 <xs:documentation>Physical access events are generated by doors. This element describes the type of door that created the event.</xs:documentation>
                              </xs:annotation>
                              <xs:complexType>
                                 <xs:sequence minOccurs="1" maxOccurs="1">
                                    <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
                                       <xs:annotation>
                                          <xs:documentation>The site-wide name/identifier for the door.</xs:documentation>
                                       </xs:annotation>
                                    </xs:element>
                                    <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
                                       <xs:annotation>
                                          <xs:documentation>A user readable description of the door.</xs:documentation>
                                       </xs:annotation>
                                    </xs:element>
                                    <xs:element name="Location"
                                                type="evt:LocationComplexType"
                                                minOccurs="1"
                                                maxOccurs="1">
                                       <xs:annotation>
                                          <xs:documentation>Describes the geographic location of the device.</xs:documentation>
                                       </xs:annotation>
                                    </xs:element>
                                    <xs:element name="SingleEntry"
                                                type="xs:boolean"
                                                minOccurs="1"
                                                maxOccurs="1">
                                       <xs:annotation>
                                          <xs:documentation>It is assumed that doors only allow for a single authenticated person to enter at a time, e.g. in the case of turnstiles. Where single entry is true this element can be omitted as this is expected by default.</xs:documentation>
                                       </xs:annotation>
                                    </xs:element>
                                    <xs:element name="RemoveAll" type="xs:boolean" minOccurs="1" maxOccurs="1">
                                       <xs:annotation>
                                          <xs:documentation>This element is used to tell us to remove all access zones from the list of currently accesible zones for a user before adding a new one. This is the case whenever a user moves from one zone to another and loses all possible access to the zones they were previously in, i.e. they would need to re-authenticate to regain access rather than just pass back through the door. If not specified this element is considered to be true as most movement through a door removes access to previously accessible zones.</xs:documentation>
                                       </xs:annotation>
                                    </xs:element>
                                    <xs:element name="AddAccess" minOccurs="1" maxOccurs="1">
                                       <xs:annotation>
                                          <xs:documentation>A list of access zones that have been added by this event assuming it is successful.</xs:documentation>
                                       </xs:annotation>
                                       <xs:complexType>
                                          <xs:sequence minOccurs="1" maxOccurs="1">
                                             <xs:element name="AccessZone"
                                                         type="xs:string"
                                                         minOccurs="1"
                                                         maxOccurs="unbounded">
                                                <xs:annotation>
                                                   <xs:documentation>An area within a building that is accessible only via an authenticated access method, e.g. a turnstile or door with an access control system.</xs:documentation>
                                                </xs:annotation>
                                             </xs:element>
                                          </xs:sequence>
                                       </xs:complexType>
                                    </xs:element>
                                 </xs:sequence>
                              </xs:complexType>
                           </xs:element>
                        </xs:sequence>
                     </xs:choice>
                     <xs:element name="User"
                                 type="evt:UserComplexType"
                                 minOccurs="0"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>Where events are created as a result of a user action or within the context of a user account, the user should be recorded. To achieve this it may be necessary to map the user identifier in an application to a common user identifier when populating this element. Where an identifier exists that is unique across the organisation, such as a distinguished name (User DN) from a certificate authority or directory service, then this should be used in the &lt;Id&gt; element in preference to any other user identifier.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="RunAs"
                                 type="evt:UserComplexType"
                                 minOccurs="0"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>In some cases an account may switch to another account in order to run a process or perform a privileged action, e.g. use of sudo. Where this happens the &lt;User&gt; element should still refer to the real user and this element should indicate what the temporary user was when the event was created, e.g. root. This is also often used when a system user (processing account) executes scheduled jobs on behalf of the real user that scheduled the job. Where an identifier exists that is unique across the organisation, such as a distinguished name (User DN) from a certificate authority or directory service, then this should be used in the &lt;Id&gt; element in preference to any other user identifier.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="Interactive"
                                 type="xs:boolean"
                                 minOccurs="0"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>Indicates whether the event was produced as a result of direct interaction, i.e. user was directly responsible for the event being created and was present at the time it was created. This element will be false where an event may have been created after the user was present, e.g. where scheduled processing is performed or an action has been queued for execution later, as is the case when some form of asynchronous processing is used. All interactive events must provide the Id for the user. Can be omitted if true as this is the default.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="Data"
                                 type="evt:DataComplexType"
                                 minOccurs="0"
                                 maxOccurs="unbounded">
                        <xs:annotation>
                           <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                  </xs:sequence>
               </xs:complexType>
            </xs:element>
            <xs:element name="EventDetail" minOccurs="1" maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>This element describes the details of the event, i.e. what happened.</xs:documentation>
               </xs:annotation>
               <xs:complexType>
                  <xs:sequence minOccurs="1" maxOccurs="1">
                     <xs:element name="TypeId" type="xs:string" minOccurs="1" maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>A name/code/ID to uniquely identify the logical event type within the service providing the events. E.g a Windows eventId (i.e representing 'Failed logon', 'Chane password attempt', etc.) or for application logging: SaveRecord, ViewUserRecord, ViewSearchResults, etc. The granularity will depend on the application. Typically the number of unique TypeIds will be in the 10s. Note, the values of the TypeId are not meant to be globally consistent, they will only be relevant within that service providing the events.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>Some human readable descriptive text for the event type.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="Classification"
                                 type="evt:ClassificationComplexType"
                                 minOccurs="0"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>Use of this element is deprecated and Event/Classification should be used instead</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:element name="Purpose"
                                 type="evt:PurposeComplexType"
                                 minOccurs="0"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>The purpose/justification assigned to this event for user actions that are required to be justified for reasons of corporate policy, e.g. transferring data to removable media, viewing personnel records or making a high value payment.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                     <xs:choice minOccurs="1" maxOccurs="1">
                        <xs:element name="Authenticate" type="AuthenticateType" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Used to record authentication events such as logon and logoff. All authentication events that originate from a client device should record details of the client device in the event source.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Authorise" type="AuthoriseType" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to account management such as adding and removing user and system accounts.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Search"
                                    type="evt:SearchComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Any events related to searching for data should use this element.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Copy"
                                    type="evt:CopyComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to copying data should use this element.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Move"
                                    type="evt:MoveComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to moving data should use this element.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Create"
                                    type="evt:ObjectOutcomeComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to creating data should use this element.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="View"
                                    type="evt:ObjectOutcomeComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to viewing data should use this element. Note that viewing data is subtly different from reading data. This event is to be used when data is displayed to an end user and not for data read by an application.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Import"
                                    type="evt:ImportComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to importing data should use this element. An import could include any batch insert of data from an external source or uploading a file.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Export"
                                    type="evt:ExportComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to exporting data should use this element. An export could include activities such as downloading data from an application or generating a report.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Update" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to updating data should use this element.</xs:documentation>
                           </xs:annotation>
                           <xs:complexType>
                              <xs:sequence minOccurs="1" maxOccurs="1">
                                 <xs:element name="Before"
                                             type="evt:MultiObjectComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Describes the state of one or more object properties before it was changed.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="After"
                                             type="evt:MultiObjectComplexType"
                                             minOccurs="1"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Describes the state of one or more object properties after it was changed.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Outcome"
                                             type="evt:OutcomeComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Data"
                                             type="evt:DataComplexType"
                                             minOccurs="0"
                                             maxOccurs="unbounded">
                                    <xs:annotation>
                                       <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                              </xs:sequence>
                           </xs:complexType>
                        </xs:element>
                        <xs:element name="Delete"
                                    type="evt:ObjectOutcomeComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to deleting data should use this element.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Process" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Whenever processes such as applications or services are started, stopped etc, this should be recorded in this element. It also covers the running of batch processes or jobs.</xs:documentation>
                           </xs:annotation>
                           <xs:complexType>
                              <xs:sequence minOccurs="1" maxOccurs="1">
                                 <xs:element name="Action"
                                             type="evt:ProcessActionSimpleType"
                                             minOccurs="1"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The action that the process event is capturing, e.g. Startup, Shutdown.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Type"
                                             type="evt:ProcessTypeSimpleType"
                                             minOccurs="1"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The type of process, e.g. Application, OS, Service.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Command" type="xs:string" minOccurs="1" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The name of the process.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Arguments" type="xs:string" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The process command arguments/parameters.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="ProcessId" type="xs:string" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The system identifier for the process.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="ThreadId"
                                             type="xs:positiveInteger"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The thread identifier for the process.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The rule that was triggered when this process event happened.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Input"
                                             type="evt:MultiObjectComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Any objects used as input to the process.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Output"
                                             type="evt:MultiObjectComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Any objects output by the process</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Outcome"
                                             type="evt:OutcomeComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Data"
                                             type="evt:DataComplexType"
                                             minOccurs="0"
                                             maxOccurs="unbounded">
                                    <xs:annotation>
                                       <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                              </xs:sequence>
                           </xs:complexType>
                        </xs:element>
                        <xs:element name="Print" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>All events related to printing should use this element.</xs:documentation>
                           </xs:annotation>
                           <xs:complexType>
                              <xs:sequence minOccurs="1" maxOccurs="1">
                                 <xs:element name="Action"
                                             type="evt:PrintActionSimpleType"
                                             minOccurs="1"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The print action that was performed, e.g. CreateJob.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="PrintJob" minOccurs="1" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Describes the print job that the event relates to.</xs:documentation>
                                    </xs:annotation>
                                    <xs:complexType>
                                       <xs:sequence minOccurs="1" maxOccurs="1">
                                          <xs:element name="Document"
                                                      type="evt:DocumentComplexType"
                                                      minOccurs="1"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>Describes the document being printed.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Pages"
                                                      type="xs:nonNegativeInteger"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The number of pages being printed.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Size"
                                                      type="xs:nonNegativeInteger"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The size of the print job in bytes.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Submitted"
                                                      type="evt:DateTimeSimpleType"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The time that the print job was submitted.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                       </xs:sequence>
                                    </xs:complexType>
                                 </xs:element>
                                 <xs:element name="PrintSettings" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The printer settings that are to be used for the print job.</xs:documentation>
                                    </xs:annotation>
                                    <xs:complexType>
                                       <xs:sequence minOccurs="1" maxOccurs="1">
                                          <xs:element name="PaperSize" type="xs:string" minOccurs="0" maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The paper size, e.g. A4.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Orientation"
                                                      type="evt:PrintSettingsOrientationSimpleType"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The paper orientation, e.g. Portrait, Landscape.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Colour" type="xs:boolean" minOccurs="0" maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>True if printing in colour. Most printing is performed in black and white so this defaults to false and can therefore be omitted if printing in black and white.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="DeviceFonts"
                                                      type="xs:boolean"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>True if fonts are to be used on the printing device. Using device fonts reduces the size of the print job as no font information needs to be supplied to the printer. However, using device fonts will result in different output on different printers. Most print jobs will not use device fonts so this defaults to false and can therefore be omitted if device fonts are not being used.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Data"
                                                      type="evt:DataComplexType"
                                                      minOccurs="0"
                                                      maxOccurs="unbounded">
                                             <xs:annotation>
                                                <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                       </xs:sequence>
                                    </xs:complexType>
                                 </xs:element>
                                 <xs:element name="Printer"
                                             type="evt:DeviceComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Describes the printer to use for the print job.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Outcome"
                                             type="evt:OutcomeComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Data"
                                             type="evt:DataComplexType"
                                             minOccurs="0"
                                             maxOccurs="unbounded">
                                    <xs:annotation>
                                       <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                              </xs:sequence>
                           </xs:complexType>
                        </xs:element>
                        <xs:element name="Install"
                                    type="evt:InstallComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Details about installation of either hardware or software.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Uninstall"
                                    type="evt:InstallComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Details about removal of either hardware or software.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Network" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Any events related to network traffic, filtering or access should be recorded using this element.</xs:documentation>
                           </xs:annotation>
                           <xs:complexType>
                              <xs:choice minOccurs="1" maxOccurs="1">
                                 <xs:element name="Bind"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Connect"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Open"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Close"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Send"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Receive"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Listen"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Permit"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Deny"
                                             type="evt:NetworkComplexType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                              </xs:choice>
                           </xs:complexType>
                        </xs:element>
                        <xs:element name="AntiMalware" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Used for all anti-malware related events.</xs:documentation>
                           </xs:annotation>
                           <xs:complexType>
                              <xs:sequence minOccurs="1" maxOccurs="1">
                                 <xs:choice minOccurs="1" maxOccurs="1">
                                    <xs:element name="StartScan"
                                                type="evt:AntiMalwareComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="StopScan"
                                                type="evt:AntiMalwareComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="Admin"
                                                type="evt:AntiMalwareComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="Quarantine"
                                                type="evt:AntiMalwareThreatComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="Report"
                                                type="evt:AntiMalwareComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="Email"
                                                type="evt:AntiMalwareComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="Delete"
                                                type="evt:AntiMalwareThreatComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="ScanEngineUpdated"
                                                type="evt:AntiMalwareComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                    <xs:element name="SignaturesUpdated"
                                                type="evt:AntiMalwareComplexType"
                                                minOccurs="1"
                                                maxOccurs="1"/>
                                 </xs:choice>
                                 <xs:element name="Outcome"
                                             type="evt:OutcomeComplexType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Data"
                                             type="evt:DataComplexType"
                                             minOccurs="0"
                                             maxOccurs="unbounded">
                                    <xs:annotation>
                                       <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                              </xs:sequence>
                           </xs:complexType>
                        </xs:element>
                        <xs:element name="Alert" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>An alert event according to the system producing the event, e.g. an event raised when an anti-malware system finds malware.</xs:documentation>
                           </xs:annotation>
                           <xs:complexType>
                              <xs:sequence minOccurs="1" maxOccurs="1">
                                 <xs:element name="Type"
                                             type="evt:AlertTypeSimpleType"
                                             minOccurs="1"
                                             maxOccurs="1"/>
                                 <xs:element name="Severity"
                                             type="evt:AlertSeveritySimpleType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The severity of the alert.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Priority"
                                             type="evt:AlertPrioritySimpleType"
                                             minOccurs="0"
                                             maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The priority of the alert.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Subject" type="xs:string" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The name of the event or rule that fired or vulnerability or malware that has been scanned for or found.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>The descriptive message for the alert.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                                 <xs:element name="IDS" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Information about an IDS generated event.</xs:documentation>
                                    </xs:annotation>
                                    <xs:complexType>
                                       <xs:sequence minOccurs="1" maxOccurs="1">
                                          <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The type of IDS event or rule that fired.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Source"
                                                      type="evt:NetworkSrcDstComplexType"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The source network device involved in the IDS event.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Destination"
                                                      type="evt:NetworkSrcDstComplexType"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The destination network device involved in the IDS event.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Payload"
                                                      type="evt:MultiObjectComplexType"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>Details about the payload being transmitted between the source and destination devices.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                       </xs:sequence>
                                    </xs:complexType>
                                 </xs:element>
                                 <xs:element name="Malware"
                                             type="evt:AntiMalwareThreatComplexType"
                                             minOccurs="0"
                                             maxOccurs="1"/>
                                 <xs:element name="Network"
                                             type="evt:BaseNetworkComplexType"
                                             minOccurs="0"
                                             maxOccurs="1"/>
                                 <xs:element name="Change" minOccurs="0" maxOccurs="1">
                                    <xs:annotation>
                                       <xs:documentation>Any events to do with monitoring the status of files should use this element.</xs:documentation>
                                    </xs:annotation>
                                    <xs:complexType>
                                       <xs:sequence minOccurs="1" maxOccurs="1">
                                          <xs:element name="Action"
                                                      type="evt:ChangeActionSimpleType"
                                                      minOccurs="1"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The action performed by the file monitor, e.g. StartScan, StopScan.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Before"
                                                      type="evt:MultiObjectComplexType"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>Describes the last known state of the file before it was altered.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="After"
                                                      type="evt:MultiObjectComplexType"
                                                      minOccurs="0"
                                                      maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>Describes the new state of the file now it has changed.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                          <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
                                             <xs:annotation>
                                                <xs:documentation>The file monitoring rule that was fired to generate this event.</xs:documentation>
                                             </xs:annotation>
                                          </xs:element>
                                       </xs:sequence>
                                    </xs:complexType>
                                 </xs:element>
                                 <xs:element name="Data"
                                             type="evt:DataComplexType"
                                             minOccurs="0"
                                             maxOccurs="unbounded">
                                    <xs:annotation>
                                       <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                              </xs:sequence>
                           </xs:complexType>
                        </xs:element>
                        <xs:element name="Send"
                                    type="evt:SendReceiveComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Used for send events that are at a higher level than a network/send event, e.g. sending an email</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Receive"
                                    type="evt:SendReceiveComplexType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>Used for receive events that are at a higher level than a network/receive event, e.g. receiving an email</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Unknown" minOccurs="1" maxOccurs="1">
                           <xs:complexType>
                              <xs:sequence minOccurs="1" maxOccurs="1">
                                 <xs:element name="Data"
                                             type="evt:DataComplexType"
                                             minOccurs="0"
                                             maxOccurs="unbounded">
                                    <xs:annotation>
                                       <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                                    </xs:annotation>
                                 </xs:element>
                              </xs:sequence>
                           </xs:complexType>
                        </xs:element>
                     </xs:choice>
                  </xs:sequence>
               </xs:complexType>
            </xs:element>
            <xs:element name="EventChain" minOccurs="0" maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>This element can be used to create relationships between different events. One or more events can belong to an activity and the activity can be related to a parent activity and other siblings.</xs:documentation>
               </xs:annotation>
               <xs:complexType>
                  <xs:sequence minOccurs="1" maxOccurs="1">
                     <xs:element name="Activity"
                                 type="evt:ActivityComplexType"
                                 minOccurs="1"
                                 maxOccurs="1">
                        <xs:annotation>
                           <xs:documentation>The activity that this event is related to.</xs:documentation>
                        </xs:annotation>
                     </xs:element>
                  </xs:sequence>
               </xs:complexType>
            </xs:element>
            <xs:element name="Data"
                        type="evt:DataComplexType"
                        minOccurs="0"
                        maxOccurs="unbounded">
               <xs:annotation>
                  <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit. Can also be used for appending data about the event after it has been received or processed, e.g. for recording details relating to the processing of the event such as the feed name.</xs:documentation>
               </xs:annotation>
            </xs:element>
         </xs:sequence>
      </xs:complexType>
   </xs:element>
   <xs:element name="Events">
      <xs:annotation>
         <xs:documentation>The root element that contains multiple Event elements.</xs:documentation>
      </xs:annotation>
      <xs:complexType>
         <xs:sequence minOccurs="1" maxOccurs="1">
            <xs:element ref="evt:Event" minOccurs="0" maxOccurs="unbounded"/>
         </xs:sequence>
         <xs:attribute name="Version" type="evt:VersionSimpleType" use="required"/>
      </xs:complexType>
   </xs:element>
   <xs:group name="AdvancedQueryOperatorGroup">
      <xs:choice>
         <xs:element name="Term"
                     type="evt:TermComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>A list of fields to be AND together.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="And" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>All of the enclosed fields are to be treated as being AND together.</xs:documentation>
            </xs:annotation>
            <xs:complexType>
               <xs:complexContent>
                  <xs:extension base="evt:BaseAdvancedQueryOperatorComplexType"/>
               </xs:complexContent>
            </xs:complexType>
         </xs:element>
         <xs:element name="Or" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>All of the enclosed fields are to be treated as being OR together.</xs:documentation>
            </xs:annotation>
            <xs:complexType>
               <xs:complexContent>
                  <xs:extension base="evt:BaseAdvancedQueryOperatorComplexType"/>
               </xs:complexContent>
            </xs:complexType>
         </xs:element>
         <xs:element name="Not" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The enclosed structure operators and terms are negated.</xs:documentation>
            </xs:annotation>
            <xs:complexType>
               <xs:complexContent>
                  <xs:extension base="evt:BaseAdvancedQueryOperatorComplexType"/>
               </xs:complexContent>
            </xs:complexType>
         </xs:element>
      </xs:choice>
   </xs:group>
   <xs:group name="BaseObjectGroup">
      <xs:sequence>
         <xs:element name="Type" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Classification"
                     type="evt:ClassificationComplexType"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="State" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Groups"
                     type="evt:GroupsComplexType"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Permissions" minOccurs="0" maxOccurs="1">
            <xs:complexType>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="Permission" minOccurs="1" maxOccurs="unbounded">
                     <xs:complexType>
                        <xs:sequence minOccurs="1" maxOccurs="1">
                           <xs:choice minOccurs="1" maxOccurs="1">
                              <xs:element name="User"
                                          type="evt:UserComplexType"
                                          minOccurs="1"
                                          maxOccurs="1"/>
                              <xs:element name="Group"
                                          type="evt:GroupComplexType"
                                          minOccurs="1"
                                          maxOccurs="1"/>
                           </xs:choice>
                           <xs:element name="Allow"
                                       type="evt:PermissionAttributeSimpleType"
                                       minOccurs="0"
                                       maxOccurs="unbounded"/>
                           <xs:element name="Deny"
                                       type="evt:PermissionAttributeSimpleType"
                                       minOccurs="0"
                                       maxOccurs="unbounded"/>
                        </xs:sequence>
                     </xs:complexType>
                  </xs:element>
               </xs:sequence>
            </xs:complexType>
         </xs:element>
      </xs:sequence>
   </xs:group>
   <xs:group name="CriteriaExtensionGroup">
      <xs:sequence>
         <xs:element name="DataSources" minOccurs="0" maxOccurs="1">
            <xs:complexType>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="DataSource"
                              type="xs:string"
                              minOccurs="1"
                              maxOccurs="unbounded"/>
               </xs:sequence>
            </xs:complexType>
         </xs:element>
         <xs:element name="Query"
                     type="evt:QueryComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Structure used to describe the query associated with a search event.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="ResultPage" minOccurs="0" maxOccurs="1">
            <xs:complexType>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="TotalPages"
                              type="xs:nonNegativeInteger"
                              minOccurs="0"
                              maxOccurs="1"/>
                  <xs:element name="PerPage"
                              type="xs:nonNegativeInteger"
                              minOccurs="0"
                              maxOccurs="1"/>
                  <xs:element name="PageNumber"
                              type="xs:nonNegativeInteger"
                              minOccurs="0"
                              maxOccurs="1"/>
                  <xs:element name="From"
                              type="xs:nonNegativeInteger"
                              minOccurs="0"
                              maxOccurs="1"/>
                  <xs:element name="To"
                              type="xs:nonNegativeInteger"
                              minOccurs="0"
                              maxOccurs="1"/>
               </xs:sequence>
            </xs:complexType>
         </xs:element>
         <xs:element name="TotalResults"
                     type="xs:nonNegativeInteger"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Results"
                     type="evt:MultiObjectComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Structure used to describe the search results associated with a search event.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:group>
   <xs:complexType name="ActivityComplexType">
      <xs:annotation>
         <xs:documentation>Type that describes an activity used to create relationships between events.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Id" type="xs:string" minOccurs="1" maxOccurs="1"/>
         <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>A descriptive name for the activity.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Parent"
                     type="evt:ActivityComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The parent activity if there is one.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="AntiMalwareComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseAntiMalwareComplexType"/>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="AntiMalwareThreatComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseAntiMalwareComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Threat" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>Describes the threat if one has been found.</xs:documentation>
                  </xs:annotation>
                  <xs:complexType>
                     <xs:sequence minOccurs="1" maxOccurs="1">
                        <xs:element name="Category"
                                    type="evt:ThreatCategorySimpleType"
                                    minOccurs="1"
                                    maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>The category of the threat, e.g. Worm, Virus, etc.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                        <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
                           <xs:annotation>
                              <xs:documentation>The name of the threat, e.g. a virus name.</xs:documentation>
                           </xs:annotation>
                        </xs:element>
                     </xs:sequence>
                  </xs:complexType>
               </xs:element>
               <xs:element name="Infected"
                           type="evt:MultiObjectComplexType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>Describes the infected item if one has been found.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="AnyContentComplexType" mixed="true">
      <xs:annotation>
         <xs:documentation>This type is used to contain any content conforming to an agreed format/specification that is defined outside of this XML Schema.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:any minOccurs="0" processContents="lax"/>
      </xs:sequence>
      <xs:attribute name="ContentType" type="xs:string">
         <xs:annotation>
            <xs:documentation>String to describe the format type and specification of the content, e.g. JSON or XML. The valid values are defined outside of this XML Schema.</xs:documentation>
         </xs:annotation>
      </xs:attribute>
      <xs:attribute name="Version" type="xs:string">
         <xs:annotation>
            <xs:documentation>Defines the version of data structure specification.</xs:documentation>
         </xs:annotation>
      </xs:attribute>
   </xs:complexType>
   <xs:complexType name="AssociationComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Objects"
                           type="evt:MultiObjectComplexType"
                           minOccurs="1"
                           maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="AuthenticateOutcomeComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseOutcomeComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Reason"
                           type="evt:AuthenticateOutcomeReasonSimpleType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>An enumeration used to describe the reason why authentication failed.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="BannerComplexType">
      <xs:annotation>
         <xs:documentation>Structure used to describe a banner presented to a user. Typically it displays legal information relating to the system.</xs:documentation>
      </xs:annotation>
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Message" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="BaseAdvancedQueryItemComplexType"/>
   <xs:complexType name="BaseAdvancedQueryOperatorComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseAdvancedQueryItemComplexType">
            <xs:group ref="evt:AdvancedQueryOperatorGroup"
                      minOccurs="0"
                      maxOccurs="unbounded"/>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="BaseAntiMalwareComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Product"
                     type="evt:SoftwareComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Describes the anti-malware product used.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Signature" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Describes the anti-malware signature used.</xs:documentation>
            </xs:annotation>
            <xs:complexType>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1">
                     <xs:annotation>
                        <xs:documentation>The version of the signature.</xs:documentation>
                     </xs:annotation>
                  </xs:element>
                  <xs:element name="Updated"
                              type="evt:DateTimeSimpleType"
                              minOccurs="0"
                              maxOccurs="1">
                     <xs:annotation>
                        <xs:documentation>When the signature was last updated.</xs:documentation>
                     </xs:annotation>
                  </xs:element>
               </xs:sequence>
            </xs:complexType>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="BaseChatComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="SessionId" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Room" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="From"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="To"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
               <xs:element name="Content" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="BaseFileComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Path" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The full system file path.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Created"
                           type="evt:DateTimeSimpleType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The creation time of the file.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Modified"
                           type="evt:DateTimeSimpleType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The modification time of the file.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Accessed"
                           type="evt:DateTimeSimpleType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The last access time of the file.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Size"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Media"
                           type="evt:MediaComplexType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>Optional description of the media that the file exists on or that the file is being written to.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Hash" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>A hash of the file contents.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="BaseMultiObjectComplexType">
      <xs:choice minOccurs="1" maxOccurs="unbounded">
         <xs:element name="Banner"
                     type="evt:BannerComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Chat"
                     type="evt:ChatComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Configuration"
                     type="evt:ConfigurationComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Criteria"
                     type="evt:CriteriaComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Document"
                     type="evt:DocumentComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Email"
                     type="evt:EmailComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="File"
                     type="evt:FileComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Folder"
                     type="evt:FolderComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Group"
                     type="evt:GroupComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="GroupChat"
                     type="evt:GroupChatComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Object"
                     type="evt:ObjectComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="SearchResult"
                     type="evt:SearchResultComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Shortcut"
                     type="evt:ShortcutComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="User"
                     type="evt:UserComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="VirtualSession"
                     type="evt:VirtualSessionComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="VOIP"
                     type="evt:VOIPComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Resource"
                     type="evt:ResourceComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Association"
                     type="evt:AssociationComplexType"
                     minOccurs="1"
                     maxOccurs="1"/>
      </xs:choice>
   </xs:complexType>
   <xs:complexType name="BaseNetworkComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Source"
                     type="evt:NetworkSrcDstComplexType"
                     minOccurs="1"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The source device that is attempting the network action.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Destination"
                     type="evt:NetworkSrcDstComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The destination device for the network action.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="ProcessName" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The name of the process responsible for the network action.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Payload"
                     type="evt:MultiObjectComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>If the network action is related to message transfer from one place to another then this element describes the message.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Rule" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The network boundary filter rule that was fired to generate this event.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="BaseObjectComplexType">
      <xs:group ref="evt:BaseObjectGroup" minOccurs="1" maxOccurs="1"/>
   </xs:complexType>
   <xs:complexType name="BaseOutcomeComplexType">
      <xs:annotation>
         <xs:documentation>Describes the outcome of an event whether it is successful and whether it was permitted.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Success" type="xs:boolean" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>If the outcome of an event was successful then 'true', 'false' otherwise. Can be omitted if true as this is the default. The main exception to this default would be if there were many varied Descriptions for the success criteria and such Descriptions could provide additional context to the event.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Permitted" type="xs:boolean" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>If an action was permitted then 'true', 'false' otherwise. Can be omitted if true as this is the default. The main exception to this default would be if there were many varied Descriptions for the success criteria and such Descriptions could provide additional context to the event.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="AuthService" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>A description of the authorisation service that was used to decide if the action was permitted.</xs:documentation>
            </xs:annotation>
            <xs:complexType>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
                     <xs:annotation>
                        <xs:documentation>An identitfier for the authorisation service, usually a URI string.</xs:documentation>
                     </xs:annotation>
                  </xs:element>
                  <xs:element name="CacheTimeout"
                              type="xs:positiveInteger"
                              minOccurs="0"
                              maxOccurs="1">
                     <xs:annotation>
                        <xs:documentation>The number of seconds a system is allowed to cache this authorisation before it needs to be checked again.</xs:documentation>
                     </xs:annotation>
                  </xs:element>
               </xs:sequence>
            </xs:complexType>
         </xs:element>
         <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Human readable text that describes the outcome.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="ChatComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseChatComplexType"/>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="ClassificationComplexType">
      <xs:annotation>
         <xs:documentation>Describes a classification of something, such as a document being classified as 'Commercial in Confidence'.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Text" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The full human readable text of the classification, e.g 'Commerical in Confidence'.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="ConfigurationComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="CoordinatesComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Latitude"
                     type="evt:LatitudeSimpleType"
                     minOccurs="1"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Geographic coordinate specifying the north/south position on the earth's surface, expressed as decimal degrees from the equator (0). -90 (South) to +90 (North).</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Longitude"
                     type="evt:LongitudeSimpleType"
                     minOccurs="1"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Geographic coordinate specifying the east/west position on the earth's surface, expressed as decimal degrees from the Greenwich Meridian (0). -180 (West) to +180 (East).</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>

   <xs:group name="CopyMoveGroup">
      <xs:sequence>
         <xs:element name="Source"
                     type="evt:MultiObjectComplexType"
                     minOccurs="1"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The source of the data being copied, moved imported or exported.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Destination"
                     type="evt:MultiObjectComplexType"
                     minOccurs="1"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The destination for the data being copied, moved imported or exported.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Outcome"
                     type="evt:CopyMoveOutcomeComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
       </xs:sequence>
   </xs:group>

   <xs:complexType name="CopyComplexType">
       <xs:annotation>
           <xs:documentation>Captures copy events.</xs:documentation>
       </xs:annotation>
       <xs:complexContent>
           <xs:extension base="evt:EventAction">
               <xs:sequence minOccurs="1" maxOccurs="1">
                   <xs:group ref="evt:CopyMoveGroup" minOccurs="1" maxOccurs="1"/>
               </xs:sequence>
           </xs:extension>
       </xs:complexContent>
   </xs:complexType>

   <xs:complexType name="MoveComplexType">
       <xs:annotation>
           <xs:documentation>Captures move events.</xs:documentation>
       </xs:annotation>
       <xs:complexContent>
           <xs:extension base="evt:EventAction">
               <xs:sequence minOccurs="1" maxOccurs="1">
                   <xs:group ref="evt:CopyMoveGroup" minOccurs="1" maxOccurs="1"/>
               </xs:sequence>
           </xs:extension>
       </xs:complexContent>
   </xs:complexType>

   <xs:complexType name="CopyMoveOutcomeComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseOutcomeComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Reason"
                           type="evt:CopyMoveOutcomeReasonSimpleType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>Used to explain the reson for failure, e.g. Device full.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="CriteriaComplexType">
      <xs:annotation>
         <xs:documentation>Structure used to describe a criteria used for search, view, update or delete.</xs:documentation>
      </xs:annotation>
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:group ref="evt:CriteriaExtensionGroup" minOccurs="1" maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="DataComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
      <xs:attribute name="Name" type="xs:string" use="required"/>
      <xs:attribute name="Value" type="xs:string" use="optional"/>
   </xs:complexType>
   <xs:complexType name="DeviceComplexType">
      <xs:annotation>
         <xs:documentation>Describes a device, e.g. a workstation, server or item of network infrastructure.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Identifier used to uniquely identify the device within the organisation's asset register/system. Also this can be used to identify a device that does not have HostName/IPAddress/MACAddress.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>A descriptive name of the device, e.g. 'Sun Fire X4600', 'HP LaserJet 4+'.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Classification"
                     type="evt:ClassificationComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The security classification associated with this device.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="HostName" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The network host name of the device, e.g. someserver.somenet.org.uk. Ideally this field should always contain a fully qualified DNS name of the host.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="IPAddress"
                     type="evt:IPAddressSimpleType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The network IP address of the device, e.g. 192.168.0.3. Ideally this should always be supplied.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="MACAddress"
                     type="evt:DeviceMACAddressSimpleType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The Media Access Control (MAC) address of the device.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Port"
                     type="evt:PortSimpleType"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Location"
                     type="evt:LocationComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Describes the geographic location of the device.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="DocumentComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Title" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Reference" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Path" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Created"
                           type="evt:DateTimeSimpleType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Modified"
                           type="evt:DateTimeSimpleType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Accessed"
                           type="evt:DateTimeSimpleType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Pages"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Size"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="EmailComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="From"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="To"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
               <xs:element name="Cc"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
               <xs:element name="Bcc"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
               <xs:element name="Subject" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Content" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="MimeType" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="ExportComplexType">
      <xs:annotation>
         <xs:documentation>Captures data relevant to an export operation.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Source"
                     type="evt:MultiObjectComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The source of the data being copied, moved imported or exported.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Destination"
                     type="evt:MultiObjectComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The destination for the data being copied, moved imported or exported.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Outcome"
                     type="evt:OutcomeComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="FileComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseFileComplexType"/>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="FolderComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseFileComplexType"/>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="FromComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="EmailAddress"
                     type="evt:EmailAddressSimpleType"
                     minOccurs="1"
                     maxOccurs="1"/>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="GroupChatComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseChatComplexType"/>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="GroupComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="GroupsComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Group"
                     type="evt:GroupComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded"/>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="HardwareComplexType">
      <xs:annotation>
         <xs:documentation>Used to describe a hardware item that may be added or removed from a system.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Type"
                     type="evt:HardwareTypeSimpleType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Model" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Manufacturer"
                     type="xs:string"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Capacity"
                     type="xs:positiveInteger"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="ImportComplexType">
      <xs:annotation>
         <xs:documentation>Captures data relevant to an import operation</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Source"
                     type="evt:MultiObjectComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The source of the data being copied, moved imported or exported.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Destination"
                     type="evt:MultiObjectComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The destination for the data being copied, moved imported or exported.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Outcome"
                     type="evt:OutcomeComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="InstallComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:choice minOccurs="1" maxOccurs="1">
            <xs:element name="Software"
                        type="evt:SoftwareComplexType"
                        minOccurs="1"
                        maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>Description of the software that was installed/uninstalled.</xs:documentation>
               </xs:annotation>
            </xs:element>
            <xs:element name="Hardware"
                        type="evt:HardwareComplexType"
                        minOccurs="1"
                        maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>Description of the hardware that was installed/uninstalled.</xs:documentation>
               </xs:annotation>
            </xs:element>
            <xs:element name="Media"
                        type="evt:MediaComplexType"
                        minOccurs="1"
                        maxOccurs="1">
               <xs:annotation>
                  <xs:documentation>Description of the media that was installed/uninstalled.</xs:documentation>
               </xs:annotation>
            </xs:element>
         </xs:choice>
         <xs:element name="Outcome"
                     type="evt:OutcomeComplexType"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded"/>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="LocationComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Country" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Site" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:sequence minOccurs="0" maxOccurs="1">
            <xs:element name="Building" type="xs:string" minOccurs="0" maxOccurs="1"/>
            <xs:element name="Floor" type="xs:integer" minOccurs="0" maxOccurs="1"/>
            <xs:element name="Room" type="xs:string" minOccurs="0" maxOccurs="1"/>
            <xs:choice minOccurs="1" maxOccurs="1">
               <xs:element name="Desk" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="Rack" type="xs:string" minOccurs="0" maxOccurs="1"/>
                  <xs:element name="Position" type="xs:string" minOccurs="0" maxOccurs="1"/>
               </xs:sequence>
            </xs:choice>
         </xs:sequence>
         <xs:element name="TimeZone" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Timezone pair for location in RFC3339 time-numoffset format separated by a slash '/' character. The first offset is for the location's standard timezone and the second for the daylight savings timezone. For example, Bristol, UK would be +00:00/+01:00</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Coordinates"
                     type="evt:CoordinatesComplexType"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="AccessZone" type="xs:string" minOccurs="0" maxOccurs="1"/>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="MediaComplexType">
      <xs:annotation>
         <xs:documentation>Used to describe media added or removed from a computer system, or as a location for reading and writing files.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Type"
                     type="evt:MediaTypeSimpleType"
                     minOccurs="1"
                     maxOccurs="1"/>
         <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Name" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Removable" type="xs:boolean" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Indicates if this media is removable, e.g. USB storage device or soft media such as DVD.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="ReadWrite" type="xs:boolean" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Indicates if a device has read-write access. Most devices are read-write so this defaults to true and can therefore be omitted where this is the case.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Capacity"
                     type="xs:positiveInteger"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Classification"
                     type="evt:ClassificationComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The classification of the media.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="MultiObjectComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseMultiObjectComplexType"/>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="NetworkComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseNetworkComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Outcome"
                           type="evt:OutcomeComplexType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="NetworkSrcDstComplexType">
      <xs:annotation>
         <xs:documentation>Desc</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Device"
                     type="evt:DeviceComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>A device at the source or destination involved in the network activity.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Application" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The application being used by the source or destination.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="TransportProtocol"
                     type="evt:NetworkSrcDstTransportProtocolSimpleType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The transport protocol being used by the source or destination.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="ICMPType" type="xs:integer" minOccurs="0" maxOccurs="1"/>
         <xs:element name="HTTPMethod" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The HTTP method, e.g. GET, POST, DELETE, PUT etc</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="ApplicationProtocol"
                     type="xs:string"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The application protocol being used by the source or destination.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Port"
                     type="evt:PortSimpleType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The port being used by the source or destination.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="ObjectComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="ObjectOutcomeComplexType">
      <xs:annotation>
         <xs:documentation>Contains an item of data, e.g. a file, document, etc, and describes the outcome of the event as well as providing for additional event data that does not fit into the item of data element.</xs:documentation>
      </xs:annotation>
      <xs:complexContent>
         <xs:extension base="evt:BaseMultiObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Outcome"
                           type="evt:OutcomeComplexType"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="OutcomeComplexType">
      <xs:annotation>
         <xs:documentation>Describes the outcome of an event whether it is successful and whether it was permitted.</xs:documentation>
      </xs:annotation>
      <xs:complexContent>
         <xs:extension base="evt:BaseOutcomeComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="ProductComplexType">
      <xs:annotation>
         <xs:documentation>Describes a product.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The product name.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Version" type="xs:string" minOccurs="1" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The product version.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="PurposeComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Classification"
                     type="evt:ClassificationComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The classification of this task.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Subject" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>A description of the task.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Stakeholders"
                     type="xs:string"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Names of stakeholders.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Justification"
                     type="xs:string"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Business case supporting task.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="ExpectedOutcome"
                     type="xs:string"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Expected outcome from task.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Authorisations" minOccurs="0" maxOccurs="1">
            <xs:complexType>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="Auth" minOccurs="1" maxOccurs="unbounded">
                     <xs:complexType>
                        <xs:sequence minOccurs="1" maxOccurs="1">
                           <xs:element name="RefNo" type="xs:string" minOccurs="0" maxOccurs="1"/>
                           <xs:element name="Detail" type="xs:string" minOccurs="0" maxOccurs="1"/>
                        </xs:sequence>
                     </xs:complexType>
                  </xs:element>
               </xs:sequence>
            </xs:complexType>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="QueryComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Advanced" minOccurs="0" maxOccurs="1">
            <xs:complexType>
               <xs:group ref="evt:AdvancedQueryOperatorGroup"
                         minOccurs="0"
                         maxOccurs="unbounded"/>
            </xs:complexType>
         </xs:element>
         <xs:element name="Simple" minOccurs="0" maxOccurs="1">
            <xs:complexType>
               <xs:sequence minOccurs="1" maxOccurs="1">
                  <xs:element name="Include" type="xs:string" minOccurs="0" maxOccurs="1"/>
                  <xs:element name="Exclude" type="xs:string" minOccurs="0" maxOccurs="1"/>
               </xs:sequence>
            </xs:complexType>
         </xs:element>
         <xs:element name="Raw" type="xs:string" minOccurs="0" maxOccurs="1"/>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="ResourceComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Title" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The title of the resource or of the object the resource presents.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="URL" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The URL of the resource the event relates to</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Referrer" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The URL of the resource that referred to the URL of this event</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="SessionId" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The session identifier or token used to identify a session or series of related message exchanges.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="HTTPMethod" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The HTTP method, e.g. GET, POST, DELETE, PUT etc</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="HTTPVersion" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The HTTP version, e.g. 1.1</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="UserAgent" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>This is a string provided by the initiating software agent used to identify itself, its application type, operating system, software vendor or software version. This string typically appears as a field in a request message with a field header name of 'User-Agent'.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="InboundSize"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The size in bytes received, including the request and HTTP headers.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="InboundContentSize"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The size in bytes of the incoming data, EXCLUDING HTTP headers.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="InboundHeader"
                           type="xs:string"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The HTTP request header.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="OutboundSize"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The size in bytes of the outgoing data, including HTTP headers.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="OutboundContentSize"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The size in bytes of the outgoing data, EXCLUDING HTTP headers.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="OutboundHeader"
                           type="xs:string"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The HTTP response header.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="RequestTime"
                           type="xs:nonNegativeInteger"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The number of microseconds the server took to handle the request.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="ConnectionStatus"
                           type="xs:string"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The connection status of the client connection.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="InitialResponseCode"
                           type="xs:string"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The status code of the original request.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="ResponseCode"
                           type="xs:string"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The final status code of the request, after any internal redirections may have taken place.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="MimeType" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The Internet Media Type identifying the file format of the resource provided (format of request or response body). This string typically appears in the 'Content-Type' field of a Request or Response Header.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Category" type="xs:string" minOccurs="0" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The category of a web page or resource where a categorisation engine is used, e.g. News, Search Engine, Social Media, etc.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="SearchComplexType">
       <xs:annotation>
           <xs:documentation>Contains a criteria and describes the outcome of the event.</xs:documentation>
       </xs:annotation>
       <xs:complexContent>
           <xs:extension base="evt:EventAction">
               <xs:sequence minOccurs="1" maxOccurs="1">
                   <xs:group ref="evt:BaseObjectGroup" minOccurs="1" maxOccurs="1"/>
                   <xs:group ref="evt:CriteriaExtensionGroup" minOccurs="1" maxOccurs="1"/>
                   <xs:element name="Outcome"
                       type="evt:OutcomeComplexType"
                       minOccurs="0"
                       maxOccurs="1">
                       <xs:annotation>
                           <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                       </xs:annotation>
                   </xs:element>
                   <xs:element name="Data"
                       type="evt:DataComplexType"
                       minOccurs="0"
                       maxOccurs="unbounded">
                       <xs:annotation>
                           <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                       </xs:annotation>
                   </xs:element>
               </xs:sequence>
           </xs:extension>
       </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="SearchResultComplexType">
      <xs:annotation>
         <xs:documentation>Structure used to describe a search result.</xs:documentation>
      </xs:annotation>
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Relevancy"
                           type="xs:positiveInteger"
                           minOccurs="0"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The relevancy of the search result.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="SendReceiveComplexType">
      <xs:annotation>
         <xs:documentation>Structure to describe the details of a send or receive event</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Source" minOccurs="1" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The initiator(s) of the object or resource sent or received. A initiator can be a user and/or device.</xs:documentation>
            </xs:annotation>
            <xs:complexType>
               <xs:choice minOccurs="1" maxOccurs="unbounded">
                  <xs:element name="User"
                              type="evt:UserComplexType"
                              minOccurs="1"
                              maxOccurs="1"/>
                  <xs:element name="Device"
                              type="evt:DeviceComplexType"
                              minOccurs="1"
                              maxOccurs="1"/>
               </xs:choice>
            </xs:complexType>
         </xs:element>
         <xs:element name="Destination" minOccurs="1" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The destination(s) of the object or resource sent or received. A destination can be a user and/or device.</xs:documentation>
            </xs:annotation>
            <xs:complexType>
               <xs:choice minOccurs="1" maxOccurs="unbounded">
                  <xs:element name="User"
                              type="evt:UserComplexType"
                              minOccurs="1"
                              maxOccurs="1"/>
                  <xs:element name="Device"
                              type="evt:DeviceComplexType"
                              minOccurs="1"
                              maxOccurs="1"/>
               </xs:choice>
            </xs:complexType>
         </xs:element>
         <xs:element name="Payload"
                     type="evt:MultiObjectComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>If the network action is related to message transfer from one place to another then this element describes the message.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Outcome"
                     type="evt:OutcomeComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="ShortcutComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseFileComplexType"/>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="SoftwareComplexType">
      <xs:annotation>
         <xs:documentation>Used to describe a software asset.</xs:documentation>
      </xs:annotation>
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Id" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1"/>
         <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1"/>
         <xs:element name="Manufacturer"
                     type="xs:string"
                     minOccurs="0"
                     maxOccurs="1"/>
         <xs:element name="Data"
                     type="evt:DataComplexType"
                     minOccurs="0"
                     maxOccurs="unbounded">
            <xs:annotation>
               <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="SystemComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1">
         <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The name of the system.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Description" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>An optional description of the system.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Classification"
                     type="evt:ClassificationComplexType"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>An optional classification of the overall system.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Environment" type="xs:string" minOccurs="1" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The environment describes a specific instance of a system. A system may have multiple deployment for various purposes, e.g. a development, reference or operational deployment. An instance may also be site specific e.g. a deployment at a particular data center. The way an environment is described will differ depending on the system and the way it is deployed however a good example would be REF_DC1 to indicate that the environment is a reference deployment in data center 1.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Organisation"
                     type="xs:string"
                     minOccurs="0"
                     maxOccurs="1">
            <xs:annotation>
               <xs:documentation>Describes the organisation that owns or has responsiblity for the system.</xs:documentation>
            </xs:annotation>
         </xs:element>
         <xs:element name="Version" type="xs:string" minOccurs="0" maxOccurs="1">
            <xs:annotation>
               <xs:documentation>The version of the system's software, e.g. 1.3.2</xs:documentation>
            </xs:annotation>
         </xs:element>
      </xs:sequence>
   </xs:complexType>
   <xs:complexType name="TermComplexType">
      <xs:annotation>
         <xs:documentation>Describes a field to search and what to search for using name, condition and value, e.g. Title Contains 'Fox' or Title Equals 'The Quick Brown Fox'.</xs:documentation>
      </xs:annotation>
      <xs:complexContent>
         <xs:extension base="evt:BaseAdvancedQueryItemComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Name" type="xs:string" minOccurs="1" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The name of the search field.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Condition"
                           type="evt:TermConditionSimpleType"
                           minOccurs="1"
                           maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The search condition, e.g. Contains, !Contains, Exists etc.</xs:documentation>
                  </xs:annotation>
               </xs:element>
               <xs:element name="Value" type="xs:string" minOccurs="1" maxOccurs="1">
                  <xs:annotation>
                     <xs:documentation>The value that the condition is operating on.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="UserComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="Domain" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="EmailAddress"
                           type="evt:EmailAddressSimpleType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="UserDetails"
                           type="evt:UserDetailsComplexType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="UserDetailsComplexType">
      <xs:sequence minOccurs="1" maxOccurs="1"/>
   </xs:complexType>
   <xs:complexType name="VOIPComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="PhoneNumber" type="xs:string" minOccurs="0" maxOccurs="1"/>
               <xs:element name="From"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="To"
                           type="evt:UserComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:complexType name="VirtualSessionComplexType">
      <xs:complexContent>
         <xs:extension base="evt:BaseObjectComplexType">
            <xs:sequence minOccurs="1" maxOccurs="1">
               <xs:element name="SessionState"
                           type="evt:VirtualSessionSessionStateSimpleType"
                           minOccurs="0"
                           maxOccurs="1"/>
               <xs:element name="Data"
                           type="evt:DataComplexType"
                           minOccurs="0"
                           maxOccurs="unbounded">
                  <xs:annotation>
                     <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                  </xs:annotation>
               </xs:element>
            </xs:sequence>
         </xs:extension>
      </xs:complexContent>
   </xs:complexType>
   <xs:simpleType name="AlertPrioritySimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="None"/>
         <xs:enumeration value="Low"/>
         <xs:enumeration value="Normal"/>
         <xs:enumeration value="High"/>
         <xs:enumeration value="Urgent"/>
         <xs:enumeration value="Immediate"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="AlertSeveritySimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Info"/>
         <xs:enumeration value="Minor"/>
         <xs:enumeration value="Major"/>
         <xs:enumeration value="Critical"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="AlertTypeSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Vulnerability"/>
         <xs:enumeration value="IDS"/>
         <xs:enumeration value="Malware"/>
         <xs:enumeration value="Network"/>
         <xs:enumeration value="Change"/>
         <xs:enumeration value="Error"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="AuthenticateActionSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Logon"/>
         <xs:enumeration value="Logoff"/>
         <xs:enumeration value="ChangePassword"/>
         <xs:enumeration value="ResetPassword"/>
         <xs:enumeration value="ScreenLock"/>
         <xs:enumeration value="ScreenUnlock"/>
         <xs:enumeration value="AccountLock"/>
         <xs:enumeration value="AccountUnlock"/>
         <xs:enumeration value="Reconnect"/>
         <xs:enumeration value="Disconnect"/>
         <xs:enumeration value="Connect"/>
         <xs:enumeration value="ElevatePrivilege"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="AuthenticateLogonTypeSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Interactive"/>
         <xs:enumeration value="Network"/>
         <xs:enumeration value="Batch"/>
         <xs:enumeration value="Service"/>
         <xs:enumeration value="Unlock"/>
         <xs:enumeration value="NetworkCleartext"/>
         <xs:enumeration value="NewCredentials"/>
         <xs:enumeration value="RemoteInteractive"/>
         <xs:enumeration value="CachedInteractive"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="AuthenticateOutcomeReasonSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="IncorrectUsernameOrPassword"/>
         <xs:enumeration value="IncorrectUsername"/>
         <xs:enumeration value="IncorrectPassword"/>
         <xs:enumeration value="ExpiredCertificate"/>
         <xs:enumeration value="RevokedCertificate"/>
         <xs:enumeration value="IncorrectCA"/>
         <xs:enumeration value="ExpiredCA"/>
         <xs:enumeration value="AccountLocked"/>
         <xs:enumeration value="AccountNotValidForLoginType"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="AuthorisationSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Request"/>
         <xs:enumeration value="Modify"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="ChangeActionSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="StartScan"/>
         <xs:enumeration value="StopScan"/>
         <xs:enumeration value="FileAdded"/>
         <xs:enumeration value="FileRemoved"/>
         <xs:enumeration value="FileModified"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="CopyMoveOutcomeReasonSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="DeviceFull"/>
         <xs:enumeration value="IOError"/>
         <xs:enumeration value="InvalidPath"/>
         <xs:enumeration value="PermissionDenied"/>
         <xs:enumeration value="ReadOnly"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="DateTimeSimpleType">
      <xs:annotation>
         <xs:documentation>This type constrains the date time format further so that it is always represented as 'yyyy-MM-ddThh:mm:ss.sssZ'.</xs:documentation>
      </xs:annotation>
      <xs:restriction base="xs:dateTime">
         <xs:pattern value="[\d]{4}-[\d]{2}-[\d]{2}T[\d]{2}:[\d]{2}:[\d]{2}.[\d]{3}Z"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="DeviceMACAddressSimpleType">
      <xs:restriction base="xs:string">
         <xs:pattern value="[0123456789ABCDEF]{2}(-[0123456789ABCDEF]{2}){5}"/>
         <xs:pattern value="[0123456789ABCDEF]{2}(:[0123456789ABCDEF]{2}){5}"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="EmailAddressSimpleType">
      <xs:restriction base="xs:string"/>
   </xs:simpleType>
   <xs:simpleType name="HardwareTypeSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="OpticalDrive"/>
         <xs:enumeration value="HardDisk"/>
         <xs:enumeration value="USBMassStorage"/>
         <xs:enumeration value="Printer"/>
         <xs:enumeration value="Modem"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="IPAddressSimpleType">
      <xs:restriction base="xs:string">
         <xs:pattern value="(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value="::"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,1}(:[0-9a-f]{1,4}){1,6}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,5}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,4}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,3}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,5}(:[0-9a-f]{1,4}){1,2}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,6}(:[0-9a-f]{1,4}){1,1}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,7}:"/>
         <xs:pattern value=":(:[0-9a-f]{1,4}){1,7}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}"/>
         <xs:pattern value="::(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,1}(:[0-9a-f]{1,4}){1,4}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,3}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,2}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,1}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){1,5}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value=":(:[0-9a-f]{1,4}){1,5}:(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
         <xs:pattern value="([0-9a-f]{1,4}:){6}(25[0-5]|2[0-4]\d|[0-1]?\d?\d)(\.(25[0-5]|2[0-4]\d|[0-1]?\d?\d)){3}"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="LatitudeSimpleType">
      <xs:annotation>
         <xs:documentation>Latitude from the equator in decimal degrees.</xs:documentation>
      </xs:annotation>
      <xs:restriction base="xs:decimal">
         <xs:minInclusive value="-90"/>
         <xs:maxInclusive value="90"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="LongitudeSimpleType">
      <xs:annotation>
         <xs:documentation>Longitude from the Greenwich Meridian in decimal degrees.</xs:documentation>
      </xs:annotation>
      <xs:restriction base="xs:decimal">
         <xs:minInclusive value="-180"/>
         <xs:maxInclusive value="180"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="MediaTypeSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="HardDisk"/>
         <xs:enumeration value="USBMassStorage"/>
         <xs:enumeration value="BluRay"/>
         <xs:enumeration value="DVD"/>
         <xs:enumeration value="CD"/>
         <xs:enumeration value="FloppyDisk"/>
         <xs:enumeration value="Tape"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="NetworkSrcDstTransportProtocolSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="TCP"/>
         <xs:enumeration value="UDP"/>
         <xs:enumeration value="ICMP"/>
         <xs:enumeration value="IGMP"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="PermissionAttributeSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Author"/>
         <xs:enumeration value="Owner"/>
         <xs:enumeration value="Read"/>
         <xs:enumeration value="Write"/>
         <xs:enumeration value="Execute"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="PortSimpleType">
      <xs:restriction base="xs:int">
         <xs:minInclusive value="0"/>
         <xs:maxInclusive value="65535"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="PrintActionSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="CreateJob"/>
         <xs:enumeration value="CancelJob"/>
         <xs:enumeration value="PauseJob"/>
         <xs:enumeration value="ResumeJob"/>
         <xs:enumeration value="StartPrint"/>
         <xs:enumeration value="FinishPrint"/>
         <xs:enumeration value="CancelPrint"/>
         <xs:enumeration value="FailedPrint"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="PrintSettingsOrientationSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Portrait"/>
         <xs:enumeration value="Landscape"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="ProcessActionSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Startup"/>
         <xs:enumeration value="Shutdown"/>
         <xs:enumeration value="Execute"/>
         <xs:enumeration value="Terminate"/>
         <xs:enumeration value="ChangeDir"/>
         <xs:enumeration value="Call"/>
         <xs:enumeration value="Access"/>
         <xs:enumeration value="RequestObjectHandle"/>
         <xs:enumeration value="Register"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="ProcessTypeSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="OS"/>
         <xs:enumeration value="Service"/>
         <xs:enumeration value="Application"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="TermConditionSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Exists"/>
         <xs:enumeration value="NotExists"/>
         <xs:enumeration value="Contains"/>
         <xs:enumeration value="NotContains"/>
         <xs:enumeration value="Empty"/>
         <xs:enumeration value="NotEmpty"/>
         <xs:enumeration value="Equals"/>
         <xs:enumeration value="NotEquals"/>
         <xs:enumeration value="GreaterThan"/>
         <xs:enumeration value="GreaterThanEqualTo"/>
         <xs:enumeration value="LessThan"/>
         <xs:enumeration value="LessThanEqualTo"/>
         <xs:enumeration value="StartsWith"/>
         <xs:enumeration value="NotStartsWith"/>
         <xs:enumeration value="Regex"/>
         <xs:enumeration value="NotRegex"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="ThreatCategorySimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Virus"/>
         <xs:enumeration value="Worm"/>
         <xs:enumeration value="HackingTool"/>
         <xs:enumeration value="Spyware"/>
         <xs:enumeration value="TrojanHorse"/>
         <xs:enumeration value="Adware"/>
         <xs:enumeration value="Other"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="VersionSimpleType">
      <xs:annotation>
         <xs:documentation>Type for specifying the version numbers of XML documents that are supported by this version of the XMLSchema. A version of the schema will support XML documents conforming to its version and all past version where the major version number is the same.</xs:documentation>
      </xs:annotation>
      <xs:restriction base="xs:string">
         <xs:enumeration value="3.0.0"/>
         <xs:enumeration value="3.1.0"/>
         <xs:enumeration value="3.1.1"/>
         <xs:enumeration value="3.1.2"/>
         <xs:enumeration value="3.2.0"/>
         <xs:enumeration value="3.2.1"/>
         <xs:enumeration value="3.2.2"/>
         <xs:enumeration value="3.2.3"/>
         <xs:enumeration value="3.2.4"/>
      </xs:restriction>
   </xs:simpleType>
   <xs:simpleType name="VirtualSessionSessionStateSimpleType">
      <xs:restriction base="xs:string">
         <xs:enumeration value="Parked"/>
         <xs:enumeration value="Unparked"/>
      </xs:restriction>
   </xs:simpleType>

   <!-- Added -->
   <xs:complexType abstract="true" name="EventAction">
   </xs:complexType>

   <!-- Added -->
   <xs:complexType name="AuthenticateType">
       <xs:complexContent>
           <xs:extension base="evt:EventAction">
               <xs:sequence minOccurs="1" maxOccurs="1">
                   <xs:element name="Action"
                       type="evt:AuthenticateActionSimpleType"
                       minOccurs="1"
                       maxOccurs="1">
                       <xs:annotation>
                           <xs:documentation>The authentication action that was performed, e.g. Logon, Logoff.</xs:documentation>
                       </xs:annotation>
                   </xs:element>
                   <xs:element name="LogonType"
                       type="evt:AuthenticateLogonTypeSimpleType"
                       minOccurs="0"
                       maxOccurs="1">
                       <xs:annotation>
                           <xs:documentation>This indicates the type of logon. For example, Microsoft Windows has several logon types such as Interactive (logon to domain), RemoteInteractive (logon to remote machine), CachedInteractive (logon to local machine using cached domain information due to loss of network).</xs:documentation>
                       </xs:annotation>
                   </xs:element>
                   <xs:choice minOccurs="1" maxOccurs="1">
                       <xs:element name="User"
                           type="evt:UserComplexType"
                           minOccurs="1"
                           maxOccurs="1">
                           <xs:annotation>
                               <xs:documentation>The user who the authentication action relates to.</xs:documentation>
                           </xs:annotation>
                       </xs:element>
                       <xs:element name="Device"
                           type="evt:DeviceComplexType"
                           minOccurs="1"
                           maxOccurs="1">
                           <xs:annotation>
                               <xs:documentation>Where a device authenticates with another device, this is the device that initiates the authentication action.</xs:documentation>
                           </xs:annotation>
                       </xs:element>
                       <xs:element name="Group"
                           type="evt:GroupComplexType"
                           minOccurs="1"
                           maxOccurs="1">
                           <xs:annotation>
                               <xs:documentation>The group the authentication action relates to.</xs:documentation>
                           </xs:annotation>
                       </xs:element>
                   </xs:choice>
                   <xs:element name="Outcome"
                       type="evt:AuthenticateOutcomeComplexType"
                       minOccurs="0"
                       maxOccurs="1">
                       <xs:annotation>
                           <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                       </xs:annotation>
                   </xs:element>
                   <xs:element name="Data"
                       type="evt:DataComplexType"
                       minOccurs="0"
                       maxOccurs="unbounded">
                       <xs:annotation>
                           <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                       </xs:annotation>
                   </xs:element>
               </xs:sequence>
           </xs:extension>
       </xs:complexContent>
   </xs:complexType>


   <!-- Added -->
   <xs:group name="MultiObjectGroup">
       <!--<xs:choice minOccurs="1" maxOccurs="unbounded">-->
       <xs:choice>
           <xs:element name="Banner"
               type="evt:BannerComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Chat"
               type="evt:ChatComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Configuration"
               type="evt:ConfigurationComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Criteria"
               type="evt:CriteriaComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Document"
               type="evt:DocumentComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Email"
               type="evt:EmailComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="File"
               type="evt:FileComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Folder"
               type="evt:FolderComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Group"
               type="evt:GroupComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="GroupChat"
               type="evt:GroupChatComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Object"
               type="evt:ObjectComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="SearchResult"
               type="evt:SearchResultComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Shortcut"
               type="evt:ShortcutComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="User"
               type="evt:UserComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="VirtualSession"
               type="evt:VirtualSessionComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="VOIP"
               type="evt:VOIPComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Resource"
               type="evt:ResourceComplexType"
               minOccurs="1"
               maxOccurs="1"/>
           <xs:element name="Association"
               type="evt:AssociationComplexType"
               minOccurs="1"
               maxOccurs="1"/>
       </xs:choice>
   </xs:group>


   <!-- Added -->
   <xs:complexType name="AuthoriseType">
       <xs:complexContent>
           <xs:extension base="evt:EventAction">
               <xs:sequence minOccurs="1" maxOccurs="1">
                   <xs:group ref="evt:MultiObjectGroup" minOccurs="1" maxOccurs="unbounded"/>
                   <xs:element name="Action"
                       type="evt:AuthorisationSimpleType"
                       minOccurs="0"
                       maxOccurs="1"/>
                   <xs:element name="AddGroups" minOccurs="0" maxOccurs="1">
                       <xs:annotation>
                           <xs:documentation>A list of roles or permissions that have been added to an object.</xs:documentation>
                       </xs:annotation>
                       <xs:complexType>
                           <xs:sequence minOccurs="1" maxOccurs="1">
                               <xs:element name="Group"
                                   type="evt:GroupComplexType"
                                   minOccurs="0"
                                   maxOccurs="unbounded">
                                   <xs:annotation>
                                       <xs:documentation>A role or permission that has been added to an object.</xs:documentation>
                                   </xs:annotation>
                               </xs:element>
                           </xs:sequence>
                       </xs:complexType>
                   </xs:element>
                   <xs:element name="RemoveGroups" minOccurs="0" maxOccurs="1">
                       <xs:annotation>
                           <xs:documentation>A list of roles or permissions that have been removed from an object.</xs:documentation>
                       </xs:annotation>
                       <xs:complexType>
                           <xs:sequence minOccurs="1" maxOccurs="1">
                               <xs:element name="Group"
                                   type="evt:GroupComplexType"
                                   minOccurs="0"
                                   maxOccurs="unbounded">
                                   <xs:annotation>
                                       <xs:documentation>A role or permission that has been removed from an object.</xs:documentation>
                                   </xs:annotation>
                               </xs:element>
                           </xs:sequence>
                       </xs:complexType>
                   </xs:element>
                   <xs:element name="Outcome"
                       type="evt:OutcomeComplexType"
                       minOccurs="0"
                       maxOccurs="1">
                       <xs:annotation>
                           <xs:documentation>Used to determine if the action was successful. If omitted it is assumed that the event was successful and was permitted.</xs:documentation>
                       </xs:annotation>
                   </xs:element>
                   <xs:element name="Data"
                       type="evt:DataComplexType"
                       minOccurs="0"
                       maxOccurs="unbounded">
                       <xs:annotation>
                           <xs:documentation>Any other event data that does not fit into a schema element but may be useful for the purpose of audit.</xs:documentation>
                       </xs:annotation>
                   </xs:element>
               </xs:sequence>
               <!--<xs:complexContent>-->
                   <!--<xs:extension base="evt:BaseMultiObjectComplexType">-->

                       <!--</xs:extension>-->
                   <!--</xs:complexContent>-->
           </xs:extension>
       </xs:complexContent>
   </xs:complexType>

   <!-- https://stackoverflow.com/questions/5020313/polymorphism-in-xsd-schema-and-jaxb-classes -->

</xs:schema>
<!-- vim:set et sw=3 ts=3: -->