Hi, Thank you for your answer. I hope that this information will help me to get more about the data collected with this TA. Regards Martin ... View more

I know this is a late response to thread, but finally got this working for myself as well. Here is a sample input: [WinEventLog://Microsoft-Windows-GroupPolicy/Operational] renderXml= True #client-side extension processing started/completed whitelist1 = EventCode=%^(4016|5016)$% #gpo download from domain controller whitelist2 = EventCode=%^(5126)$% #manual processing of GPO started/completed for user whitelist3 = EventCode=%^(4004|8004)$% #manual processing of GPO started/completed for machine whitelist4 = EventCode=%^(4005|8005)$% ... View more