def get_events(headers, data):
    """ Build a list of dictionaries that have the detail and what that detail "contains".

    Args:
        headers (list): Headers for these type of events (Provides the order and expected output)
        data (dict): Event data to lookup

    Returns:
        list: list of dictionary objects that maps the data to what is contained.
    """

    # Map header names to what is contained in each.
    contains_map = {
        'source_addr': ['ip'],
        'destination_ip': ['ip'],
        'username': ['user name'],
        'process_table_id': ['threatresponse process table id'],
        'process_name': ['file path', 'file name'],
        'process_id': ['pid'],
        'process_command_line': ['file name'],
        'file': ['file path'],
        'domain': ['domain'],
        'ImageLoaded': ['file path', 'file name'],
        'Hashes': ['md5']
    }

    events = []
    for event in data:
        event_details = []
        for head in headers:
            data = event.get(head, None)
            event_details.append({
                'data': data,
                'contains': contains_map.get(head, None) if data else None
            })
        events.append(event_details)

    return events