Skip to content

Instantly share code, notes, and snippets.

@qwjyh

qwjyh/eventvwr_filter_XML.xml

Last active August 30, 2022 11:30
Show Gist options
  • Save qwjyh/56404dea7f52f179d69a8e03ae8f058a to your computer and use it in GitHub Desktop.
Save qwjyh/56404dea7f52f179d69a8e03ae8f058a to your computer and use it in GitHub Desktop.
Download ZIP
Raw
eventvwr_filter_XML.xml
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Security">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="System">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Dell">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Intel-GFX-Info/Application">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Intel-GFX-Info/System">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="IntelAudioServiceLog">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Internet Explorer">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-All-User-Install-Agent/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-AppHost/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Application Server-Applications/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-AppModel-Runtime/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-AppReadiness/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Storage-ATAPort/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Client-Licensing-Platform/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-DataIntegrityScan/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-DataIntegrityScan/CrashRecovery">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-DSC/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-DeviceSetupManager/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Dhcp-Client/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Dhcpv6-Client/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Diagnosis-Scripted/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Storage-Disk/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-DxgKrnl-Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-EDP-Application-Learning/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-EDP-Audit-Regular/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-EDP-Audit-TCB/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-GenericRoaming/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Host-Network-Service-Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Hyper-V-Compute-Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Hyper-V-Guest-Drivers/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Hyper-V-Hypervisor-Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Hyper-V-StorageVSP-Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Hyper-V-VID-Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Hyper-V-Worker-Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Kernel-EventTracing/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-MUI/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-PowerShell/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-PrintService/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-PushNotification-Platform/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-RemoteApp and Desktop Connections/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-RemoteAssistance/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-RetailDemo/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-SecurityMitigationsBroker/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-SMBWitnessClient/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Storage-Tiering/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Storage-ClassPnP/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Storage-Storport/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-PnPDevices/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-Printers/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Troubleshooting-Recommended/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-User Device Registration/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-VerifyHardwareSecurity/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-WindowsBackup/ActionCenter">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-Workplace Join/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="OAlerts">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="OneApp_IGCC">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="OpenSSH/Admin">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="USER_ESRV_SVC_QUEENCREEK">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Visual Studio">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Windows PowerShell">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Key Management Service">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="HardwareEvents">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
</Query>
</QueryList>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment