Skipping UserSID in ProcessTraceData?

[david-frye]

Hi there,

In KernelTraceEventParser, UserSID is not parsed as part of ProcessTraceData, and there is a code comment saying "Skipping UserSID". I have a use case where UserSID on Process events is relevant so I would like to collect it if possible. Can UserSID be added to ProcessTraceData? Is there a reason why this is being explicitly skipped?

Thank you,

Dave