31017.xml

 <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-SMBClient" Guid="{988c59c5-0a1c-45b6-a555-0c62276e327d}" /> 
  <EventID>31017</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x200000000000080</Keywords> 
  <TimeCreated SystemTime="2021-06-30T11:01:31.025306200Z" /> 
  <EventRecordID>104</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="4660" /> 
  <Channel>Microsoft-Windows-SmbClient/Security</Channel> 
  <Computer>WOLF-359.enterprise.local</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="UserNameLength">0</Data> 
  <Data Name="UserName" /> 
  <Data Name="ServerNameLength">14</Data> 
  <Data Name="ServerName">\172.31.30.112</Data> 
  </EventData>
  </Event>