## Description:

This processor is used listen to Windows Event Log events. It has a success output that will contain an XML representation of the event.

## Output XML Example:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager"/>
        <EventID Qualifiers="16384">7036</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8080000000000000</Keywords>
        <TimeCreated SystemTime="2016-06-10T22:28:53.905233700Z"/>
        <EventRecordID>34153</EventRecordID>
        <Correlation/>
        <Execution ProcessID="684" ThreadID="3504"/>
        <Channel>System</Channel>
        <Computer>WIN-O05CNUCF16M.hdf.local</Computer>
        <Security/>
      </System>
      <EventData>
        <Data Name="param1">Smart Card Device Enumeration Service</Data>
        <Data Name="param2">running</Data>
        <Binary>5300630044006500760069006300650045006E0075006D002F0034000000</Binary>
      </EventData>
    </Event>

## Permissions:

Your Windows User must have permissions to read the given Event Log. This can be achieved through the following steps (Windows 2008 and newer):

1. Open a command prompt as your user. Enter the command: wmic useraccount get name,sid
2. Note the SID of the user or group you'd like to allow to read a given channel
3. Open a command prompt as Administrator. enter the command: wevtutil gl CHANNEL_NAME
4. Take the channelAccess Attribute starting with O:BAG, copy it into a text editor, and add (A;;0x1;;;YOUR_SID_FROM_BEFORE) to the end
5. Take that text and run the following command in your admin prompt (see below for example): wevtutil sl CHANNEL_NAME /ca:TEXT_FROM_PREVIOUS_STEP

The following command is the exact one I used to add read access to the Security log for my user. (You can see all the possible channels with: wevtutil el):

wevtutil sl Security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-21-3589080292-3448680409-2446571098-1001)

These steps were adapted from this guide.