Security eventchannel yes Event/System[EventID != 5145 and EventID != 5156] 10s Security eventchannel Event[System/EventID = 4624 and (EventData/Data[@Name='LogonType'] = 2 or EventData/Data[@Name='LogonType'] = 10)] Microsoft-Windows-PowerShell/Operational eventchannel Microsoft-Windows-Windows Defender/Operational eventchannel Microsoft-Windows-Windows Firewall With Advanced Security/Firewall eventchannel