search

palantir / windows-event-forwarding

A repository for using windows event forwarding for incident detection and response
Other
1.22k stars 268 forks source link

character encoding problems with some files #24

Closed patrickg2525 closed 6 years ago

patrickg2525 commented 6 years ago

I'm noticing some character encoding (or otherwise corrupted) issues with the Account-Management.xml file. For example... <Select Path="Security">*[System[(EventID &gt;=4780 and EventID &lt;=4782)]]</Select> Should be ... <Select Path="Security">*[System[(EventID >=4780 and EventID <=4782)]]</Select>

I've just started looking into this repository, so not sure if it occurs elsewhere.

This has been a great help getting started with WEF though - thanks!

clong commented 6 years ago

Hey @patrickg2525 - it may long wrong, but this formatting is actually completely supported by XPath. Sorry if it makes it a bit harder to read, but it should work just fine.

patrickg2525 commented 5 years ago

thanks for the reply - yes, everything is working fine!