Filter Events By User Posted on October 16, 2019 by torrancejones 12345<QueryList> <Query Id="0" Path="Security"> <Select Path="Security">* [EventData[Data[@Name='subjectUsername']='Tor']]</Select> </Query> </QueryList>