Channel

A logical event stream. Defaults: Application, System, Security, Setup, ForwardedEvents. Per-product channels live under Microsoft-Windows-* (e.g. Microsoft-Windows-Sysmon/Operational). On disk each channel is one .evtx file under C:\Windows\System32\winevt\Logs.