<ViewerConfig><QueryConfig><QueryParams><Simple><Channel>Application,Security,System,HardwareEvents,Internet Explorer,Microsoft-Windows-All-User-Install-Agent/Admin,Microsoft-Windows-AppHost/Admin,Microsoft-Windows-Application Server-Applications/Admin,Microsoft-Windows-AppModel-Runtime/Admin,Microsoft-Windows-AppReadiness/Admin,Microsoft-Windows-AssignedAccessBroker/Admin,Microsoft-Windows-Storage-ATAPort/Admin,Microsoft-Client-Licensing-Platform/Admin,Microsoft-Windows-DataIntegrityScan/Admin,Microsoft-Windows-DataIntegrityScan/CrashRecovery,Microsoft-Windows-DSC/Admin,Microsoft-Windows-DeviceSetupManager/Admin,Microsoft-Windows-Dhcp-Client/Admin,Microsoft-Windows-DhcpNap/Admin,Microsoft-Windows-Dhcpv6-Client/Admin,Microsoft-Windows-Diagnosis-Scripted/Admin,Microsoft-Windows-Storage-Disk/Admin,Microsoft-Windows-EDP-Audit-Regular/Admin,Microsoft-Windows-EDP-Audit-TCB/Admin,Microsoft-Windows-GenericRoaming/Admin,Microsoft-Windows-Hyper-V-Guest-Drivers/Admin,Microsoft-Windows-Kernel-EventTracing/Admin,Microsoft-Windows-Mobile-Broadband-Experience-SmsRouter/Admin,Microsoft-Windows-MUI/Admin,Microsoft-Windows-PowerShell/Admin,Microsoft-Windows-PrintService/Admin,Microsoft-Windows-PushNotification-Platform/Admin,Microsoft-Windows-RemoteApp and Desktop Connections/Admin,Microsoft-Windows-RemoteAssistance/Admin,Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin,Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin,Microsoft-Windows-RetailDemo/Admin,Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin,Microsoft-Windows-SMBWitnessClient/Admin,WitnessClientAdmin,Microsoft-Windows-Storage-ClassPnP/Admin,Microsoft-WS-Licensing/Admin,Microsoft-Windows-Storage-Storport/Admin,Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin,Microsoft-Windows-TerminalServices-LocalSessionManager/Admin,Microsoft-Windows-TerminalServices-PnPDevices/Admin,Microsoft-Windows-TerminalServices-Printers/Admin,Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin,Microsoft-Windows-User Device Registration/Admin,Microsoft-Windows-VerifyHardwareSecurity/Admin,Microsoft-Windows-WindowsBackup/ActionCenter,Microsoft-Windows-Workplace Join/Admin,OAlerts,Key Management Service,Windows PowerShell</Channel><Level>1,2,3</Level></Simple></QueryParams><QueryNode><Name>Beheergebeurtenissen</Name><Description>Gebeurtenissen Kritiek, Fout en Waarschuwing uit alle beheerlogboeken</Description><QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Security">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="System">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="HardwareEvents">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Internet Explorer">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-All-User-Install-Agent/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-AppHost/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Application Server-Applications/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-AppModel-Runtime/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-AppReadiness/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-AssignedAccessBroker/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Storage-ATAPort/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Client-Licensing-Platform/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-DataIntegrityScan/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-DataIntegrityScan/CrashRecovery">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-DSC/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-DeviceSetupManager/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Dhcp-Client/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-DhcpNap/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Dhcpv6-Client/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Diagnosis-Scripted/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Storage-Disk/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-EDP-Audit-Regular/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-EDP-Audit-TCB/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-GenericRoaming/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Hyper-V-Guest-Drivers/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Kernel-EventTracing/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Mobile-Broadband-Experience-SmsRouter/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-MUI/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-PowerShell/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-PrintService/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-PushNotification-Platform/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-RemoteApp and Desktop Connections/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-RemoteAssistance/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-RetailDemo/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-SMBWitnessClient/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="WitnessClientAdmin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Storage-ClassPnP/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-WS-Licensing/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Storage-Storport/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-TerminalServices-PnPDevices/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-TerminalServices-Printers/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-User Device Registration/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-VerifyHardwareSecurity/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-WindowsBackup/ActionCenter">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Workplace Join/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="OAlerts">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Key Management Service">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Windows PowerShell">*[System[Level=1  or Level=2 or Level=3]]</Select></Query></QueryList></QueryNode></QueryConfig><ResultsConfig><Columns><Column Name="Niveau" Type="System.String" Path="Event/System/Level" Visible="">174</Column><Column Name="Trefwoorden" Type="System.String" Path="Event/System/Keywords">70</Column><Column Name="Datum en tijd" Type="System.DateTime" Path="Event/System/TimeCreated/@SystemTime" Visible="">224</Column><Column Name="Bron" Type="System.String" Path="Event/System/Provider/@Name" Visible="">134</Column><Column Name="Gebeurtenis-id" Type="System.UInt32" Path="Event/System/EventID" Visible="">134</Column><Column Name="Taakcategorie" Type="System.String" Path="Event/System/Task" Visible="">137</Column><Column Name="Gebruiker" Type="System.String" Path="Event/System/Security/@UserID">50</Column><Column Name="Operationele code" Type="System.String" Path="Event/System/Opcode">110</Column><Column Name="Logboek" Type="System.String" Path="Event/System/Channel">80</Column><Column Name="Computer" Type="System.String" Path="Event/System/Computer">170</Column><Column Name="Proces-id" Type="System.UInt32" Path="Event/System/Execution/@ProcessID">70</Column><Column Name="Thread-id" Type="System.UInt32" Path="Event/System/Execution/@ThreadID">70</Column><Column Name="Processor-id" Type="System.UInt32" Path="Event/System/Execution/@ProcessorID">90</Column><Column Name="Sessie-id" Type="System.UInt32" Path="Event/System/Execution/@SessionID">70</Column><Column Name="Kerneltijd" Type="System.UInt32" Path="Event/System/Execution/@KernelTime">80</Column><Column Name="Tijd in gebruikersmodus" Type="System.UInt32" Path="Event/System/Execution/@UserTime">70</Column><Column Name="Processortijd" Type="System.UInt32" Path="Event/System/Execution/@ProcessorTime">100</Column><Column Name="Correlatie-id" Type="System.Guid" Path="Event/System/Correlation/@ActivityID">85</Column><Column Name="Relatieve correlatie-id" Type="System.Guid" Path="Event/System/Correlation/@RelatedActivityID">140</Column><Column Name="Naam van gebeurtenisbron" Type="System.String" Path="Event/System/Provider/@EventSourceName">140</Column></Columns></ResultsConfig></ViewerConfig>