From 83b02310e447eb9910649ff48ae9435d7cd6abb8 Mon Sep 17 00:00:00 2001 From: clement rouault Date: Wed, 28 Apr 2021 13:54:22 +0200 Subject: [PATCH] Added some doc in eventlog xpath usage --- windows/winobject/event_log.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/winobject/event_log.py b/windows/winobject/event_log.py index 7072264..6293413 100644 --- a/windows/winobject/event_log.py +++ b/windows/winobject/event_log.py @@ -453,6 +453,9 @@ class EvtChannel(object): List all events with an EventID of 2006: ``Event/System[EventID=2006]`` + List all event with a given EventID while searching for a specific field value (Sysmon for the test here) + ``Event/System[EventID=3] and Event/EventData/Data[@Name='DestinationIp'] and Event/EventData[Data='10.0.0.2']`` + :rtype: :class:`EvtQuery` """ if ids and filter: