Did the Windows signature IDs change between Windows 2008 and 2012?
According to this document: McAfee KnowledgeBase - Windows Event ID to Nitro Signature ID translation the signature can end either with 0 or 1 depending on the revision. In my environment all signatures end with 0. Is there another revision out there or is that it? Can it change in the future?
I am asking because I am concerned that my queries will stop working if the sig id changes?