<ViewerConfig><QueryConfig><QueryParams><Simple><Channel>Application,Security,Setup,System,ForwardedEvents,DNS Server,Internet Explorer,Microsoft-AppV-Client/Admin,Microsoft-AppV-Client/Operational,Microsoft-AppV-Client/Virtual Applications,Microsoft-ServerCore-ShellLauncher/Admin,Microsoft-System-Diagnostics-DiagnosticInvoker/Operational,Microsoft-User Experience Virtualization-Agent Driver/Operational,Microsoft-User Experience Virtualization-App Agent/Operational,Microsoft-User Experience Virtualization-IPC/Operational,Microsoft-User Experience Virtualization-SQM Uploader/Operational,Microsoft-Windows-AAD/Operational,Microsoft-Windows-All-User-Install-Agent/Admin,Microsoft-Windows-AllJoyn/Operational,Microsoft-Windows-AppHost/Admin,Microsoft-Windows-AppID/Operational,Microsoft-Windows-ApplicabilityEngine/Operational,Microsoft-Windows-Application Server-Applications/Operational,Microsoft-Windows-Application Server-Applications/Admin,Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant,Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter,Microsoft-Windows-Application-Experience/Program-Inventory,Microsoft-Windows-Application-Experience/Program-Telemetry,Microsoft-Windows-Application-Experience/Steps-Recorder,Microsoft-Windows-AppLocker/EXE and DLL,Microsoft-Windows-AppLocker/MSI and Script,Microsoft-Windows-AppLocker/Packaged app-Deployment,Microsoft-Windows-AppLocker/Packaged app-Execution,Microsoft-Windows-AppModel-Runtime/Admin,Microsoft-Windows-AppReadiness/Admin,Microsoft-Windows-AppReadiness/Operational,Microsoft-Windows-TWinUI/Operational,Microsoft-Windows-CoreApplication/Operational,Microsoft-Windows-AppXDeployment/Operational,Microsoft-Windows-AppXDeploymentServer/Operational,Microsoft-Windows-AppXDeploymentServer/Restricted,Microsoft-Windows-AppxPackaging/Operational,Microsoft-Windows-ASN1/Operational,Microsoft-Windows-Storage-ATAPort/Admin,Microsoft-Windows-Storage-ATAPort/Operational,Microsoft-Windows-Audio/CaptureMonitor,Microsoft-Windows-Audio/GlitchDetection,Microsoft-Windows-Audio/Informational,Microsoft-Windows-Audio/Operational,Microsoft-Windows-Audio/PlaybackManager,Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController,Microsoft-Windows-Authentication/ProtectedUser-Client,Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController,Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController,Microsoft-Windows-Authentication User Interface/Operational,Microsoft-Windows-BackgroundTaskInfrastructure/Operational,Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational,Microsoft-Windows-Backup,Microsoft-Windows-Base-Filtering-Engine-Connections/Operational,Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational,Microsoft-Windows-BestPractices/Operational,Microsoft-Windows-Biometrics/Operational,Microsoft-Windows-Bits-Client/Analytic,Microsoft-Windows-Bits-Client/Operational,Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational,Microsoft-Windows-Bluetooth-Bthmini/Operational,Microsoft-Windows-Bluetooth-MTPEnum/Operational,Microsoft-Windows-Bluetooth-Policy/Operational,Microsoft-Windows-BranchCacheSMB/Operational,Microsoft-Windows-Regsvr32/Operational,Microsoft-Windows-CAPI2/Operational,Microsoft-Windows-CCFFilter/Operational,Microsoft-Windows-CertificateServices-Deployment/Operational,Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational,Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational,Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational,Microsoft-Windows-CertPoleEng/Operational,Microsoft-Windows-Cleanmgr/Diagnostic,Microsoft-Client-Licensing-Platform/Admin,Microsoft-Windows-CloudStore/Debug,Microsoft-Windows-CloudStore/Operational,Microsoft-Windows-ClusterAwareUpdating/Admin,Microsoft-Windows-ClusterAwareUpdating-Management/Admin,Microsoft-Windows-CodeIntegrity/Operational,Microsoft-Windows-Compat-Appraiser/Operational,Microsoft-Windows-Containers-BindFlt/Operational,Microsoft-Windows-Containers-Wcifs/Operational,Microsoft-Windows-CorruptedFileRecovery-Client/Operational,Microsoft-Windows-CorruptedFileRecovery-Server/Operational,Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc,Microsoft-Windows-Crypto-DPAPI/Debug,Microsoft-Windows-Crypto-DPAPI/Operational,Microsoft-Windows-Crypto-NCrypt/CertInUse,Microsoft-Windows-Crypto-NCrypt/Operational,Microsoft-Windows-DAL-Provider/Operational,Microsoft-Windows-DataIntegrityScan/Admin,Microsoft-Windows-DataIntegrityScan/CrashRecovery,Microsoft-Windows-DateTimeControlPanel/Operational,Microsoft-Windows-DSC/Admin,Microsoft-Windows-DSC/Operational,Microsoft-Windows-DeviceGuard/Operational,Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin,Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot,Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational,Microsoft-Windows-Devices-Background/Operational,Microsoft-Windows-DeviceSetupManager/Admin,Microsoft-Windows-DeviceSetupManager/Operational,Microsoft-Windows-DeviceSync/Operational,Microsoft-Windows-DeviceUpdateAgent/Operational,Microsoft-Windows-Dhcp-Client/Admin,Microsoft-Windows-Dhcp-Client/Operational,Microsoft-Windows-Dhcpv6-Client/Operational,Microsoft-Windows-Dhcpv6-Client/Admin,Microsoft-Windows-Diagnosis-DPS/Operational,Microsoft-Windows-Diagnosis-PCW/Operational,Microsoft-Windows-Diagnosis-PLA/Operational,Microsoft-Windows-Diagnosis-Scheduled/Operational,Microsoft-Windows-Diagnosis-Scripted/Admin,Microsoft-Windows-Diagnosis-Scripted/Operational,Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational,Microsoft-Windows-Diagnostics-Networking/Operational,Microsoft-Windows-DirectoryServices-Deployment/Operational,Microsoft-Windows-Storage-Disk/Admin,Microsoft-Windows-Storage-Disk/Operational,Microsoft-Windows-DiskDiagnostic/Operational,Microsoft-Windows-DiskDiagnosticDataCollector/Operational,Microsoft-Windows-DiskDiagnosticResolver/Operational,Microsoft-Windows-DisplayColorCalibration/Operational,Microsoft-Windows-DNS-Client/Operational,Microsoft-Windows-DNSServer/Audit,Microsoft-Windows-DriverFrameworks-UserMode/Operational,Microsoft-Windows-DxgKrnl-Admin,Microsoft-Windows-DxgKrnl-Operational,Microsoft-Windows-EapHost/Operational,Microsoft-Windows-EapMethods-RasChap/Operational,Microsoft-Windows-EapMethods-RasTls/Operational,Microsoft-Windows-EapMethods-Sim/Operational,Microsoft-Windows-EapMethods-Ttls/Operational,Microsoft-Windows-EDP-Application-Learning/Admin,Microsoft-Windows-EDP-Audit-Regular/Admin,Microsoft-Windows-EDP-Audit-TCB/Admin,Microsoft-Windows-EnhancedStorage-EhStorClass/Operational,Microsoft-Windows-EnrollmentPolicyWebService/Admin,Microsoft-Windows-EnrollmentWebService/Admin,Microsoft-Windows-ESE/Operational,Microsoft-Windows-EventCollector/Operational,Microsoft-Windows-Forwarding/Operational,Microsoft-Windows-FailoverClustering/ClusterSetDiagnostic,Microsoft-Windows-FailoverClustering/Diagnostic,Microsoft-Windows-FailoverClustering/DiagnosticVerbose,Microsoft-Windows-FailoverClustering/Operational,Microsoft-Windows-FailoverClustering-CsvFs/Operational,Microsoft-Windows-FailoverClustering-Manager/Admin,Microsoft-Windows-FailoverClustering-Manager/Diagnostic,Microsoft-Windows-FailoverClustering-Manager/Tracing,Microsoft-Windows-FailoverClustering-NetFt/Operational,Microsoft-Windows-FailoverClustering-NetFt/Verbose,Microsoft-Windows-FailoverClustering-Clusport/Operational,Microsoft-Windows-FailoverClustering-ClusBflt/Connectivity,Microsoft-Windows-FailoverClustering-ClusBflt/Management,Microsoft-Windows-FailoverClustering-ClusBflt/Operational,Microsoft-Windows-FailoverClustering-WMIProvider/Admin,Microsoft-Windows-Fault-Tolerant-Heap/Operational,Microsoft-Windows-FeatureConfiguration/Operational,Microsoft-Windows-FederationServices-Deployment/Operational,Microsoft-Windows-FileServices-ServerManager-EventProvider/Admin,Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational,Microsoft-Windows-FileShareShadowCopyProvider/Operational,Microsoft-Windows-FMS/Operational,Microsoft-Windows-Folder Redirection/Operational,Microsoft-Windows-GenericRoaming/Admin,Microsoft-Windows-glcnd/Admin,Microsoft-Windows-GroupPolicy/Operational,Microsoft-Windows-Health/Diagnostic,Microsoft-Windows-Health/HealthAgent,Microsoft-Windows-Health/Operational,Microsoft-Windows-HelloForBusiness/Operational,Microsoft-Windows-Help/Operational,Microsoft-Windows-HomeGroup Control Panel/Operational,Microsoft-Windows-HttpService/Log,Microsoft-Windows-HttpService/Trace,Microsoft-Windows-Hyper-V-Guest-Drivers/Admin,Microsoft-Windows-Hyper-V-Guest-Drivers/Operational,Microsoft-Windows-Hyper-V-High-Availability-Admin,Microsoft-Windows-Hyper-V-Hypervisor-Admin,Microsoft-Windows-Hyper-V-Hypervisor-Operational,Microsoft-Windows-Hyper-V-Shared-VHDX/Operational,Microsoft-Windows-Hyper-V-Shared-VHDX/Reservation,Microsoft-Windows-IdCtrls/Operational,Microsoft-Windows-International-RegionalOptionsControlPanel/Operational,Microsoft-Windows-Iphlpsvc/Operational,Microsoft-Windows-iSCSITarget-Service/Admin,Microsoft-Windows-iSCSITarget-Service/Operational,Microsoft-Windows-iSCSITarget-VDSProvider/Admin,Microsoft-Windows-iSCSITarget-VDSProvider/Operational,Microsoft-Windows-iSCSITarget-VSSProvider/Admin,Microsoft-Windows-iSCSITarget-VSSProvider/Operational,Microsoft-Windows-KdsSvc/Operational,Microsoft-Windows-Kerberos-KdcProxy/Operational,Microsoft-Windows-Kernel-ApphelpCache/Operational,Microsoft-Windows-Kernel-Boot/Operational,Microsoft-Windows-Kernel-Cache/Operational,Microsoft-Windows-Kernel-CPU-Starvation/Operational,Microsoft-Windows-Kernel-Dump/Operational,Microsoft-Windows-Kernel-EventTracing/Admin,Microsoft-Windows-Kernel-IO/Operational,Microsoft-Windows-Kernel-LiveDump/Operational,Microsoft-Windows-Kernel-PnP/Configuration,Microsoft-Windows-Kernel-PnP/Device Management,Microsoft-Windows-Kernel-PnP/Driver Watchdog,Microsoft-Windows-Kernel-Power/Thermal-Operational,Microsoft-Windows-Kernel-ShimEngine/Operational,Microsoft-Windows-Kernel-StoreMgr/Operational,Microsoft-Windows-Kernel-WDI/Operational,Microsoft-Windows-Kernel-WHEA/Errors,Microsoft-Windows-Kernel-WHEA/Operational,Microsoft-Windows-Known Folders API Service,Microsoft-Windows-LanguagePackSetup/Operational,Microsoft-Windows-LAPS/Operational,Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational,Microsoft-Windows-LiveId/Operational,Microsoft-Windows-LSA/Operational,Microsoft-Management-UI/Admin,Microsoft-Windows-ManagementTools-RegistryProvider/Operational,Microsoft-Windows-ManagementTools-TaskManagerProvider/Operational,Microsoft-Windows-MediaFoundation-Performance/SARStreamResource,Microsoft-Windows-MemoryDiagnostics-Results/Debug,Microsoft-Windows-MiStreamProvider/Operational,SMSApi,Microsoft-Windows-Mprddm/Operational,Microsoft-Windows-MsLbfoProvider/Operational,Microsoft-Windows-MSPaint/Admin,Microsoft-Windows-MUI/Admin,Microsoft-Windows-MUI/Operational,Microsoft-Windows-Ncasvc/Operational,Microsoft-Windows-NCSI/Operational,Microsoft-Windows-NDIS/Operational,Microsoft-Windows-NdisImPlatform/Operational,Microsoft-Windows-NetworkProfile/Operational,Microsoft-Windows-NetworkProvider/Operational,Microsoft-Windows-NlaSvc/Operational,Microsoft-Windows-Ntfs/Operational,Microsoft-Windows-Ntfs/WHC,Microsoft-Windows-NTLM/Operational,Microsoft-Windows-OfflineFiles/Operational,Microsoft-Windows-OneX/Operational,Microsoft-Windows-OOBE-Machine-DUI/Operational,Microsoft-Windows-OtpCredentialProvider/Operational,Microsoft-Windows-Partition/Diagnostic,Microsoft-Windows-PerceptionRuntime/Operational,Microsoft-Windows-PerceptionSensorDataService/Operational,Microsoft-Windows-PersistentMemory-Nvdimm/Operational,Microsoft-Windows-PersistentMemory-PmemDisk/Operational,Microsoft-Windows-PersistentMemory-ScmBus/Certification,Microsoft-Windows-PersistentMemory-ScmBus/Operational,Microsoft-Windows-Policy/Operational,Microsoft-Windows-PowerShell/Admin,Microsoft-Windows-PowerShell/Operational,Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational,Microsoft-Windows-NetworkLocationWizard/Operational,Microsoft-Windows-PrintBRM/Admin,Microsoft-Windows-PrintService/Admin,Microsoft-Windows-PrintService/Operational,Microsoft-Windows-Privacy-Auditing/Operational,Microsoft-Windows-Program-Compatibility-Assistant/Analytic,Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade,Microsoft-Windows-Proximity-Common/Diagnostic,Microsoft-Windows-PushNotification-Platform/Admin,Microsoft-Windows-PushNotification-Platform/Operational,Microsoft-Rdms-UI/Admin,Microsoft-Rdms-UI/Operational,Microsoft-Windows-ReadyBoost/Operational,Microsoft-Windows-ReFS/Operational,Microsoft-Windows-RemoteApp and Desktop Connections/Admin,Microsoft-Windows-RemoteApp and Desktop Connections/Operational,Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin,Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational,Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational,Microsoft-Windows-Remotefs-Rdbss/Operational,Microsoft-Windows-Resource-Exhaustion-Detector/Operational,Microsoft-Windows-Resource-Exhaustion-Resolver/Operational,Microsoft-Windows-RestartManager/Operational,Microsoft-Windows-ResumeKeyFilter/Operational,Microsoft-Windows-RasAgileVpn/Operational,Microsoft-Windows-RRAS/Operational,Microsoft-Windows-SDDC-Management/Admin,Microsoft-Windows-SDDC-Management/Operational,Microsoft-Windows-Security-Adminless/Operational,Microsoft-Windows-Security-Audit-Configuration-Client/Operational,Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational,Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational,Microsoft-Windows-Kerberos/Operational,Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational,Microsoft-Windows-Security-Mitigations/KernelMode,Microsoft-Windows-Security-Mitigations/UserMode,Microsoft-Windows-Security-Netlogon/Operational,Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational,Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter,Microsoft-Windows-Security-UserConsentVerifier/Audit,Microsoft-Windows-SecurityMitigationsBroker/Admin,Microsoft-Windows-SecurityMitigationsBroker/Operational,Microsoft-Windows-SENSE/Operational,Microsoft-Windows-SenseIR/Operational,Microsoft-Windows-ServerManager-ConfigureSMRemoting/Operational,Microsoft-Windows-ServerManager-DeploymentProvider/Operational,Microsoft-Windows-ServerManager-MgmtProvider/Operational,Microsoft-Windows-ServerManager-MultiMachine/Admin,Microsoft-Windows-ServerManager-MultiMachine/Operational,Microsoft-Windows-ServiceReportingApi/Debug,Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter,Microsoft-Windows-Shell-Core/ActionCenter,Microsoft-Windows-Shell-Core/AppDefaults,Microsoft-Windows-Shell-Core/LogonTasksChannel,Microsoft-Windows-Shell-Core/Operational,Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational,Microsoft-Windows-SilProvider/Operational,Microsoft-Windows-SmartCard-Audit/Authentication,Microsoft-Windows-SmartCard-DeviceEnum/Operational,Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin,Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational,Microsoft-Windows-SmartScreen/Debug,Microsoft-Windows-SmbClient/Audit,Microsoft-Windows-SmbClient/Connectivity,Microsoft-Windows-SMBClient/Operational,Microsoft-Windows-SmbClient/Security,Microsoft-Windows-SMBDirect/Admin,Microsoft-Windows-SMBServer/Audit,Microsoft-Windows-SMBServer/Connectivity,Microsoft-Windows-SMBServer/Operational,Microsoft-Windows-SMBServer/Security,Microsoft-Windows-SMBWitnessClient/Admin,Microsoft-Windows-SMBWitnessClient/Informational,Microsoft-Windows-SMBWitnessServer/Admin,Microsoft-Windows-StateRepository/Operational,Microsoft-Windows-StateRepository/Restricted,Microsoft-Windows-Storage-Tiering/Admin,Microsoft-Windows-StorageManagement/Operational,Microsoft-Windows-StorageManagement-PartUtil/Operational,Microsoft-Windows-StorageSettings/Diagnostic,Microsoft-Windows-StorageSpaces-Api/Operational,Microsoft-Windows-StorageSpaces-Driver/Diagnostic,Microsoft-Windows-StorageSpaces-Driver/Operational,Microsoft-Windows-StorageSpaces-ManagementAgent/WHC,Microsoft-Windows-StorageSpaces-Parser/Diagnostic,Microsoft-Windows-StorageSpaces-Parser/Operational,Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic,Microsoft-Windows-StorageSpaces-SpaceManager/Operational,Microsoft-Windows-Storage-ClassPnP/Admin,Microsoft-Windows-Storage-ClassPnP/Operational,Microsoft-Windows-Store/Operational,Microsoft-Windows-Storage-Storport/Admin,Microsoft-Windows-Storage-Storport/Health,Microsoft-Windows-Storage-Storport/Operational,Microsoft-Windows-Storsvc/Diagnostic,Microsoft-Windows-SystemDataArchiver/Diagnostic,Microsoft-Windows-SystemSettingsThreshold/Operational,Microsoft-Windows-TaskScheduler/Maintenance,Microsoft-Windows-TaskScheduler/Operational,Microsoft-Windows-TCPIP/Operational,Microsoft-Windows-TerminalServices-RDPClient/Operational,Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin,Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational,Microsoft-Windows-TerminalServices-LocalSessionManager/Admin,Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,Microsoft-Windows-TerminalServices-PnPDevices/Admin,Microsoft-Windows-TerminalServices-PnPDevices/Operational,Microsoft-Windows-TerminalServices-Printers/Admin,Microsoft-Windows-TerminalServices-Printers/Operational,Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin,Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational,Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin,Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational,Microsoft-Windows-TerminalServices-SessionBroker-Client/Admin,Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational,Microsoft-Windows-Time-Service/Operational,Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational,Microsoft-Windows-TZSync/Operational,Microsoft-Windows-TZUtil/Operational,Microsoft-Windows-UAC/Operational,Microsoft-Windows-UAC-FileVirtualization/Operational,Microsoft-Windows-SearchUI/Operational,Microsoft-Windows-UniversalTelemetryClient/Operational,Microsoft-Windows-User Control Panel/Operational,Microsoft-Windows-User Device Registration/Admin,Microsoft-Windows-User Profile Service/Operational,Microsoft-Windows-User-Loader/Operational,Microsoft-Windows-UserPnp/ActionCenter,Microsoft-Windows-UserPnp/DeviceInstall,Microsoft-Windows-VDRVROOT/Operational,Microsoft-Windows-VerifyHardwareSecurity/Admin,Microsoft-Windows-VerifyHardwareSecurity/Operational,Microsoft-Windows-VHDMP-Operational,Microsoft-Windows-VolumeSnapshot-Driver/Operational,Windows Networking Vpn Plugin Platform/Operational,Windows Networking Vpn Plugin Platform/OperationalVerbose,Microsoft-Windows-VPN-Client/Operational,Microsoft-Windows-Wcmsvc/Operational,Microsoft-Windows-WebAuth/Operational,Microsoft-Windows-WebAuthN/Operational,Microsoft-Windows-WebIO-NDF/Diagnostic,Microsoft-Windows-WEPHOSTSVC/Operational,Microsoft-Windows-WER-PayloadHealth/Operational,Microsoft-Windows-IKE/Operational,Microsoft-Windows-VPN/Operational,Microsoft-Windows-WFP/Operational,Microsoft-Windows-Win32k/Operational,Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Defender/WHC,Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity,Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose,Microsoft-Windows-Windows Firewall With Advanced Security/Firewall,Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose,Microsoft-Windows-Windows Firewall With Advanced Security/FirewallDiagnostics,Network Isolation Operational,Microsoft-Windows-WinRM/Operational,Microsoft-Windows-WindowsColorSystem/Operational,Microsoft-Windows-WindowsSystemAssessmentTool/Operational,Microsoft-Windows-WindowsUIImmersive/Operational,Microsoft-Windows-WindowsUpdateClient/Operational,Microsoft-Windows-WinINet-Config/ProxyConfigChanged,Microsoft-Windows-WinHTTP-NDF/Diagnostic,Microsoft-Windows-WinHttp/Operational,Microsoft-Windows-WinINet-Capture/Analytic,Microsoft-Windows-WinINet/Operational,Microsoft-Windows-Winlogon/Operational,Microsoft-Windows-WinNat/Oper,Microsoft-Windows-Winsock-WS2HELP/Operational,Microsoft-Windows-Winsock-NameResolution/Operational,Microsoft-Windows-Winsock-AFD/Operational,Microsoft-Windows-Wired-AutoConfig/Operational,Microsoft-Windows-WMI-Activity/Operational,Microsoft-Windows-WMPNSS-Service/Operational,Microsoft-Windows-Wordpad/Admin,Microsoft-Windows-Workplace Join/Admin,Microsoft-Windows-WPD-ClassInstaller/Operational,Microsoft-Windows-WPD-CompositeClassDriver/Operational,Microsoft-Windows-WPD-MTPClassDriver/Operational,OpenSSH/Admin,OpenSSH/Operational,Windows PowerShell,Key Management Service,HardwareEvents</Channel><RelativeTimeInfo>6</RelativeTimeInfo><ToDate>638548419609990000</ToDate><FromDate>638548419000000000</FromDate><BySource>False</BySource></Simple></QueryParams><QueryNode><Name>EV-2024000</Name><QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Security">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Setup">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="System">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="ForwardedEvents">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="DNS Server">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Internet Explorer">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-AppV-Client/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-AppV-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-AppV-Client/Virtual Applications">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-ServerCore-ShellLauncher/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-System-Diagnostics-DiagnosticInvoker/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-User Experience Virtualization-Agent Driver/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-User Experience Virtualization-App Agent/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-User Experience Virtualization-IPC/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-User Experience Virtualization-SQM Uploader/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AAD/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-All-User-Install-Agent/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AllJoyn/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppHost/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppID/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ApplicabilityEngine/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Application Server-Applications/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Application Server-Applications/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Application-Experience/Program-Inventory">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Application-Experience/Program-Telemetry">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Application-Experience/Steps-Recorder">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppLocker/MSI and Script">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppLocker/Packaged app-Deployment">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppLocker/Packaged app-Execution">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppModel-Runtime/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppReadiness/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppReadiness/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TWinUI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CoreApplication/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppXDeployment/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppXDeploymentServer/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppXDeploymentServer/Restricted">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-AppxPackaging/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ASN1/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-ATAPort/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-ATAPort/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Audio/CaptureMonitor">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Audio/GlitchDetection">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Audio/Informational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Audio/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Audio/PlaybackManager">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Authentication/ProtectedUser-Client">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Authentication User Interface/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-BackgroundTaskInfrastructure/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Backup">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Base-Filtering-Engine-Connections/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-BestPractices/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Biometrics/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Bits-Client/Analytic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Bits-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Bluetooth-Bthmini/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Bluetooth-MTPEnum/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Bluetooth-Policy/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-BranchCacheSMB/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Regsvr32/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CAPI2/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CCFFilter/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CertificateServices-Deployment/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CertPoleEng/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Cleanmgr/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Client-Licensing-Platform/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CloudStore/Debug">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CloudStore/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ClusterAwareUpdating/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ClusterAwareUpdating-Management/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CodeIntegrity/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Compat-Appraiser/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Containers-BindFlt/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Containers-Wcifs/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CorruptedFileRecovery-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-CorruptedFileRecovery-Server/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Crypto-DPAPI/Debug">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Crypto-DPAPI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Crypto-NCrypt/CertInUse">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Crypto-NCrypt/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DAL-Provider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DataIntegrityScan/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DataIntegrityScan/CrashRecovery">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DateTimeControlPanel/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DSC/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DSC/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceGuard/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Devices-Background/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceSetupManager/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceSetupManager/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceSync/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DeviceUpdateAgent/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Dhcp-Client/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Dhcp-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Dhcpv6-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Dhcpv6-Client/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnosis-DPS/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnosis-PCW/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnosis-PLA/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnosis-Scheduled/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnosis-Scripted/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnosis-Scripted/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Diagnostics-Networking/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DirectoryServices-Deployment/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-Disk/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-Disk/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DiskDiagnostic/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DiskDiagnosticDataCollector/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DiskDiagnosticResolver/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DisplayColorCalibration/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DNS-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DNSServer/Audit">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DxgKrnl-Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-DxgKrnl-Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EapHost/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EapMethods-RasChap/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EapMethods-RasTls/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EapMethods-Sim/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EapMethods-Ttls/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EDP-Application-Learning/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EDP-Audit-Regular/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EDP-Audit-TCB/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EnhancedStorage-EhStorClass/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EnrollmentPolicyWebService/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EnrollmentWebService/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ESE/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-EventCollector/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Forwarding/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering/ClusterSetDiagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering/DiagnosticVerbose">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-CsvFs/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-Manager/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-Manager/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-Manager/Tracing">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-NetFt/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-NetFt/Verbose">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-Clusport/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-ClusBflt/Connectivity">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-ClusBflt/Management">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-ClusBflt/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FailoverClustering-WMIProvider/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Fault-Tolerant-Heap/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FeatureConfiguration/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FederationServices-Deployment/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FileServices-ServerManager-EventProvider/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FileShareShadowCopyProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-FMS/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Folder Redirection/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-GenericRoaming/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-glcnd/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-GroupPolicy/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Health/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Health/HealthAgent">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Health/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-HelloForBusiness/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Help/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-HomeGroup Control Panel/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-HttpService/Log">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-HttpService/Trace">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Hyper-V-Guest-Drivers/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Hyper-V-Guest-Drivers/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Hyper-V-High-Availability-Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Hyper-V-Hypervisor-Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Hyper-V-Hypervisor-Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Hyper-V-Shared-VHDX/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Hyper-V-Shared-VHDX/Reservation">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-IdCtrls/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-International-RegionalOptionsControlPanel/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Iphlpsvc/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-iSCSITarget-Service/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-iSCSITarget-Service/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-iSCSITarget-VDSProvider/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-iSCSITarget-VDSProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-iSCSITarget-VSSProvider/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-iSCSITarget-VSSProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-KdsSvc/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kerberos-KdcProxy/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-ApphelpCache/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-Boot/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-Cache/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-CPU-Starvation/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-Dump/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-EventTracing/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-IO/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-LiveDump/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-PnP/Configuration">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-PnP/Device Management">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-PnP/Driver Watchdog">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-Power/Thermal-Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-ShimEngine/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-StoreMgr/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-WDI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-WHEA/Errors">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kernel-WHEA/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Known Folders API Service">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-LanguagePackSetup/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-LAPS/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-LiveId/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-LSA/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Management-UI/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ManagementTools-RegistryProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ManagementTools-TaskManagerProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-MediaFoundation-Performance/SARStreamResource">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-MemoryDiagnostics-Results/Debug">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-MiStreamProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="SMSApi">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Mprddm/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-MsLbfoProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-MSPaint/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-MUI/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-MUI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Ncasvc/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NCSI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NDIS/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NdisImPlatform/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NetworkProfile/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NetworkProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NlaSvc/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Ntfs/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Ntfs/WHC">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NTLM/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-OfflineFiles/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-OneX/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-OOBE-Machine-DUI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-OtpCredentialProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Partition/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PerceptionRuntime/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PerceptionSensorDataService/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PersistentMemory-Nvdimm/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PersistentMemory-PmemDisk/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PersistentMemory-ScmBus/Certification">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PersistentMemory-ScmBus/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Policy/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PowerShell/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PowerShell/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-NetworkLocationWizard/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PrintBRM/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PrintService/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PrintService/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Privacy-Auditing/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Program-Compatibility-Assistant/Analytic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Proximity-Common/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PushNotification-Platform/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-PushNotification-Platform/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Rdms-UI/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Rdms-UI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ReadyBoost/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ReFS/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RemoteApp and Desktop Connections/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RemoteApp and Desktop Connections/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Remotefs-Rdbss/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Resource-Exhaustion-Detector/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Resource-Exhaustion-Resolver/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RestartManager/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ResumeKeyFilter/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RasAgileVpn/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-RRAS/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SDDC-Management/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SDDC-Management/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-Adminless/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-Audit-Configuration-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Kerberos/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-Mitigations/KernelMode">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-Mitigations/UserMode">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-Netlogon/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Security-UserConsentVerifier/Audit">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SecurityMitigationsBroker/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SecurityMitigationsBroker/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SENSE/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SenseIR/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ServerManager-ConfigureSMRemoting/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ServerManager-DeploymentProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ServerManager-MgmtProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ServerManager-MultiMachine/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ServerManager-MultiMachine/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ServiceReportingApi/Debug">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Shell-Core/ActionCenter">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Shell-Core/AppDefaults">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Shell-Core/LogonTasksChannel">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Shell-Core/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SilProvider/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmartCard-Audit/Authentication">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmartCard-DeviceEnum/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmartScreen/Debug">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmbClient/Audit">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmbClient/Connectivity">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBClient/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SmbClient/Security">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBDirect/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBServer/Audit">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBServer/Connectivity">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBServer/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBServer/Security">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBWitnessClient/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBWitnessClient/Informational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SMBWitnessServer/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StateRepository/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StateRepository/Restricted">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-Tiering/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageManagement/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageManagement-PartUtil/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSettings/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-Api/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-Driver/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-Driver/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-ManagementAgent/WHC">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-Parser/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-Parser/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-StorageSpaces-SpaceManager/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-ClassPnP/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-ClassPnP/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Store/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-Storport/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-Storport/Health">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storage-Storport/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Storsvc/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SystemDataArchiver/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SystemSettingsThreshold/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TaskScheduler/Maintenance">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TaskScheduler/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TCPIP/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-RDPClient/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-PnPDevices/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-PnPDevices/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-Printers/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-Printers/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-SessionBroker-Client/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Time-Service/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TZSync/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-TZUtil/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-UAC/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-UAC-FileVirtualization/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-SearchUI/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-UniversalTelemetryClient/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-User Control Panel/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-User Device Registration/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-User Profile Service/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-User-Loader/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-UserPnp/ActionCenter">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-UserPnp/DeviceInstall">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-VDRVROOT/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-VerifyHardwareSecurity/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-VerifyHardwareSecurity/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-VHDMP-Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-VolumeSnapshot-Driver/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Windows Networking Vpn Plugin Platform/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Windows Networking Vpn Plugin Platform/OperationalVerbose">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-VPN-Client/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Wcmsvc/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WebAuth/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WebAuthN/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WebIO-NDF/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WEPHOSTSVC/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WER-PayloadHealth/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-IKE/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-VPN/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WFP/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Win32k/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Windows Defender/WHC">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Windows Firewall With Advanced Security/Firewall">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Windows Firewall With Advanced Security/FirewallDiagnostics">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Network Isolation Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WinRM/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WindowsColorSystem/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WindowsSystemAssessmentTool/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WindowsUIImmersive/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WindowsUpdateClient/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WinINet-Config/ProxyConfigChanged">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WinHTTP-NDF/Diagnostic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WinHttp/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WinINet-Capture/Analytic">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WinINet/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Winlogon/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WinNat/Oper">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Winsock-WS2HELP/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Winsock-NameResolution/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Winsock-AFD/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Wired-AutoConfig/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WMI-Activity/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WMPNSS-Service/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Wordpad/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-Workplace Join/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WPD-ClassInstaller/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WPD-CompositeClassDriver/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Microsoft-Windows-WPD-MTPClassDriver/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="OpenSSH/Admin">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="OpenSSH/Operational">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Windows PowerShell">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="Key Management Service">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select><Select Path="HardwareEvents">*[System[TimeCreated[@SystemTime&gt;='2024-06-24T07:05:00.000Z' and @SystemTime&lt;='2024-06-24T07:06:00.999Z']]]</Select></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>