<QueryList>
<Query Id=”0″>
<Select Path=”Security“>
*[EventData[Data[@Name=’SubjectUserName’] and (Data=’test9′)]]
</Select>
</Query>
</QueryList>
Example:
<QueryList>
<Query Id=”0″ Path=”Security”>
<Select Path=”Security”>
*[EventData[Data[@Name=’Workstation’] and (Data=’ClientMachineNAME’ or Data=’WorkstationName1′ or Data=’WorkstationName2′ or Data=’WorkstationName1′ or Data=’Client-PC’ or Data=’Test-PC’)]]
and
*[System[(EventID=’4776′)]]
</Select>
</Query>
</QueryList>