Added some doc in eventlog xpath usage

2026-06-08 14:31:45 +00:00 · 2021-04-28 13:54:22 +02:00
parent 542eb33aa6
commit 83b02310e4
1 changed files with 3 additions and 0 deletions
@@ -453,6 +453,9 @@ class EvtChannel(object):
            List all events with an EventID of 2006:
                ``Event/System[EventID=2006]``

+            List all event with a given EventID while searching for a specific field value (Sysmon for the test here)
+                ``Event/System[EventID=3] and Event/EventData/Data[@Name='DestinationIp'] and Event/EventData[Data='10.0.0.2']``
+
        :rtype: :class:`EvtQuery`
        """
        if ids and filter: