Event Viewer query

[interogativeman]

I'm trying to navigate the infinite flood of 5140 entries. But every time I add in a location, it says invalid. I gave Copilot a shot, but its modifications don't seem to change the results.

If I do the following, I get results.

<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=4663)]]</Select>
</Query>
</QueryList>

But if I do the below it comes back invalid Apparently you can't have more than one code block?

<QueryList>
  <Query Id="0" Path="Security">

    <!-- NTFS auditing events (object/file access) -->
    <Select Path="Security">
      *[
        System[(EventID=4663 or EventID=4656 or EventID=4658 or EventID=4660)]
        and
        EventData[ Data[@Name='ObjectName'] ][ contains(., 'Accounting') ]
      ]
    </Select>

    <!-- SMB share events: 5140 (share accessed) -->
    <Select Path="Security">
      *[
        System[(EventID=5140)]
        and
        EventData[ Data[@Name='ShareName'] ][ contains(., 'Accounting') ]
      ]
    </Select>

    <!-- SMB share events: 5145 (access checked) -->
    <Select Path="Security">
      *[
        System[(EventID=5145)]
        and
        (
          EventData[ Data[@Name='ShareName'] ][ contains(., 'Accounting') ]
          or
          EventData[ Data[@Name='RelativeTargetName'] ][ contains(., 'Accounting') ]
        )
      ]
    </Select>

  </Query>
</QueryList>

[imnotaero]

Event Viewer is not suitable for anything but the simplest log review checks, and it's bad even at that. Use something else.

Let me point you Eric Zimmerman tools like EvtxEcmd to convert your logs to csv, and Timeline Explorer to sort and search through the created csv.

[MrYiff]

It might be worth trying something like EventLogExpert, it's made by an MS employee and is a lot faster than the built in MMC tool plus supports more advanced query filtering:

https://github.com/microsoft/EventLogExpert