add advanced policy for ETW security events

Author: AsuNa-jp

reference/security/defend-advanced-settings.md

@@ -957,20 +957,19 @@ Advanced settings are not recommended for most users. Use them only if you have
 `windows.advanced.events.image_load.disable_origin_info_collection`
 :   Added in 8.19.0.
 
-    *If set to true, image load events exclude dll.origin_url, dll.origin_referrer_url, and dll.Ext.windows.zone_identifier. These fields normally show where the loaded DLL was downloaded from, using information taken from the file's Mark of the Web. Default: `false`*
+    *If set to true, image load events exclude dll.origin_url, dll.origin_referrer_url, and dll.Ext.windows.zone_identifier. These fields normally show where the loaded DLL was downloaded from, using information taken from the file's Mark of the Web. Default: `false`.*
 
 `windows.advanced.events.process.disable_origin_info_collection`
 :   Added in 8.19.0.
 
-    *If set to true, process events exclude process.origin_url, process.origin_referrer_url, and process.Ext.windows.zone_identifier. These fields normally show where the process's executable file was downloaded from, using information taken from the file's Mark of the Web. Default: `false`*
+    *If set to true, process events exclude process.origin_url, process.origin_referrer_url, and process.Ext.windows.zone_identifier. These fields normally show where the process's executable file was downloaded from, using information taken from the file's Mark of the Web. Default: `false`.*
 
 `windows.advanced.events.file.disable_origin_info_collection`
 :   Added in 8.19.0.
 
     *If set to true, file events exclude file origin details: file.origin_url, file.origin_referrer_url, and file.Ext.windows.zone_identifier. These fields show the details of file's Mark of the Web. Default: `false`*
 
+`windows.advanced.events.security.provider_etw`
+:   Added in 8.19.0.
 
-
-
-
-
+    *Controls whether Microsoft-Windows-Security-Auditing ETW provider is enabled for security events collection. Set to false to disable the provider. Default: `true`.*