I was just looking at these events the other day - they are relatively new so I think they didn't quite get mapped 100%. As curtis said if you can submit what you're seeing in the event log and what you're seeing in LEM, we should be able to make them match relatively quickly. (Best is a .evtx sample so we can cross-reference directly.)
↧