def METHOD_NAME(aggregator, dd_run_check, new_check, instance):
    instance['tag_sid'] = True
    instance['start'] = 'oldest'
    instance['path'] = 'System'
    instance['query'] = "*[System[Provider[@Name='Microsoft-Windows-Kernel-Boot']]]"
    del instance['filters']
    check = new_check(instance)
    dd_run_check(check)
    assert any(
        'sid:NT AUTHORITY\\SYSTEM' in event['tags'] for event in aggregator.events
    ), 'Unable to find any expected `sid` tags'  # no cov