This processor is used listen to Windows Event Log events. It has a success output that will contain an XML representation of the event.

Output XML Example:

<Event xmlns="">
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager"/>
    <EventID Qualifiers="16384">7036</EventID>
    <TimeCreated SystemTime="2016-06-10T22:28:53.905233700Z"/>
    <Execution ProcessID="684" ThreadID="3504"/>
    <Data Name="param1">Smart Card Device Enumeration Service</Data>
    <Data Name="param2">running</Data>


Your Windows User must have permissions to read the given Event Log. This can be achieved through the following steps (Windows 2008 and newer):

  1. Open a command prompt as your user. Enter the command: wmic useraccount get name,sid
  2. Note the SID of the user or group you'd like to allow to read a given channel
  3. Open a command prompt as Administrator. enter the command: wevtutil gl CHANNEL_NAME
  4. Take the channelAccess Attribute starting with O:BAG, copy it into a text editor, and add (A;;0x1;;;YOUR_SID_FROM_BEFORE) to the end
  5. Take that text and run the following command in your admin prompt (see below for example): wevtutil sl CHANNEL_NAME /ca:TEXT_FROM_PREVIOUS_STEP

The following command is the exact one I used to add read access to the Security log for my user. (You can see all the possible channels with: wevtutil el):

wevtutil sl Security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-21-3589080292-3448680409-2446571098-1001)

These steps were adapted from this guide.