/The following line is not needed for Configuration Manager hardware inventory modifcations
#pragma namespace("\\\\.\\root\\cimv2\\sms")

//------------------------------- Data Class ------------------------------------
//The following line is not needed for Configuration Manager hardware inventory modifcations
#pragma namespace("\\\\.\\root\\cimv2")

[Union, 
ViewSources{"Select * FROM Win32_NTLogEvent WHERE LogFile = 'System' AND EventCode = 4377"},
ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,provider("MS_VIEW_INSTANCE_PROVIDER")]

Class NTLogEvent
{
     [PropertySources("LogFile"), Key] string LogFile;
     [PropertySources("RecordNumber"), Key] UINT32 Recordnumber;
     [PropertySources("Message")] String Message;
     [PropertySources("TimeGenerated")] DateTime TimeGenerated;
};

//-------------------------- Reporting Class-----------------------------------
//The following line is not needed for Configuration Manager hardware inventory modifcations
#pragma namespace("\\\\.\\root\\CIMV2\\SMS")

[SMS_Report(TRUE), 
SMS_Group_Name("Installed Updates"),
SMS_Class_ID("MICROSOFT|Win32_NTLogEvent|1.0") ]

Class NTLogEvent: SMS_Class_Template
{
     [SMS_Report(TRUE), Key] String LogFile;
     [SMS_Report(TRUE), Key] UINT32 RecordNumber;
     [SMS_Report(True)] String Message;
     [SMS_Report(True)] DateTime TimeGenerated;
};