8002,8003,8004 are not described correctly in the RecommendedEvents files.
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker
8002 - allowed to run
8003 - would be blocked if enforcement was on
8004 - was blocked
8006 Would be blocked if Enforcement On Microsoft-Windows-AppLocker/MSI and Script
8007 Was Blocked Warning Microsoft-Windows-AppLocker/MSI and Script
8002,8003,8004 are not described correctly in the RecommendedEvents files.
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker
8002 - allowed to run
8003 - would be blocked if enforcement was on
8004 - was blocked
8006 Would be blocked if Enforcement On Microsoft-Windows-AppLocker/MSI and Script
8007 Was Blocked Warning Microsoft-Windows-AppLocker/MSI and Script