Event: $(eventID)
Path: $(eventAttemptedPath)
Provider: $(eventProvider)
Time: $(eventTime)
UserID: $(eventUserID)
SAFER
S-1-5-4
LeastPrivilege
Stefan Kanthak
2011-04-27T12:34:56.6789
Display a message box to the interactive user when 'SAFER' writes an entry to the event log
https://skanthak.hier-im-netz.de/SAFER.html
0.8.15
true
false
false
false
true
PT1H
false
false
true
Queue
7
false
false
false
false
false
false
true
<QueryList><Query Id="0" Path="Application"><Select Path="Application">Event[System[Provider[@Name="Microsoft-Windows-SoftwareRestrictionPolicies"]]]</Select></Query></QueryList>
Event/UserData/Path/AttemptedPath
Event/System/Channel
Event/System/Computer
Event/System/Correlation
Event/System/EventID
Event/System/Keywords
Event/System/Level
Event/System/Opcode
Event/System/Execution/@ProcessID
Event/System/Provider/@Name
Event/System/EventRecordID
Event/System/Task
Event/System/Execution/@ThreadID
Event/System/TimeCreated/@SystemTime
Event/System/Security/@UserID
Event/System/Version