Here’s a bunch of sample sysmon events and the schema you can expect in version 6: https://gist.github.com/williballenthin/f693b1c2f3d95cb8f8e17b5f7f26031d