Question

我有以下查询 - 我希望它只报告user1＆amp; user2基于ObjectName或RelativeTargetName

但它会根据objectName或RelativeTargetName

报告所有用户

我该如何控制它？

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
   *[EventData[Data[@Name='SubjectUserName'] and (Data='user1'  or Data='user2')]]
   and
   *[EventData[Data[@Name='ObjectName'] and (Data='E:\Path\To\Folder')]]
   or
   *[EventData[Data[@Name='RelativeTargetName'] and (Data='Path\To\Folder')]]
  </Select>
  </Query>
</QueryList>

Answer 1

这有效

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
   *[EventData[Data[@Name='ObjectName'] and (Data='E:\Path\To\Folder')]] and *[EventData[Data[@Name='SubjectUserName'] and (Data='user1'  or Data='user2')]]
   or
   *[EventData[Data[@Name='RelativeTargetName'] and (Data='Path\To\Folder')]] and *[EventData[Data[@Name='SubjectUserName'] and (Data='user1' or Data='user2')]]
  </Select>
  </Query>
</QueryList>

Windows事件查看器 - ＆gt; XML - ＆gt;自定义视图

1 个答案: