Add DeviceDisabled rule

Sources/EventViewerX/Enums/NamedEvents.cs

@@ -218,6 +218,11 @@ public enum NamedEvents {
         /// </summary>
         DeviceRecognized,
 
+        /// <summary>
+        /// Device was disabled
+        /// </summary>
+        DeviceDisabled,
+
         /// <summary>
         /// Object deleted
         /// </summary>

Sources/EventViewerX/Rules/Windows/DeviceDisabled.cs

@@ -0,0 +1,38 @@
+namespace EventViewerX.Rules.Windows;
+
+/// <summary>
+/// Device was disabled
+/// 6420: A device was disabled.
+/// </summary>
+public class DeviceDisabled : EventRuleBase {
+    public override List<int> EventIds => new() { 6420 };
+    public override string LogName => "Security";
+    public override NamedEvents NamedEvent => NamedEvents.DeviceDisabled;
+
+    public override bool CanHandle(EventObject eventObject) {
+        // Simple rule - always handle if event ID and log name match
+        return true;
+    }
+
+    public string Computer;
+    public string DeviceId;
+    public string DeviceName;
+    public string ClassId;
+    public string ClassName;
+    public string Reason;
+    public string Who;
+    public DateTime When;
+
+    public DeviceDisabled(EventObject eventObject) : base(eventObject) {
+        _eventObject = eventObject;
+        Type = "DeviceDisabled";
+        Computer = _eventObject.ComputerName;
+        DeviceId = _eventObject.GetValueFromDataDictionary("DeviceId");
+        DeviceName = _eventObject.GetValueFromDataDictionary("DeviceDescription", "DeviceName");
+        ClassId = _eventObject.GetValueFromDataDictionary("ClassId");
+        ClassName = _eventObject.GetValueFromDataDictionary("ClassName");
+        Reason = _eventObject.GetValueFromDataDictionary("Reason");
+        Who = _eventObject.GetValueFromDataDictionary("SubjectUserName", "SubjectDomainName", "\\", reverseOrder: true);
+        When = _eventObject.TimeCreated;
+    }
+}