Software-Restriction-Policies.xml

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>Software-Restriction-Policies</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>SRP Logs from within the Application log</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>Custom</ConfigurationMode>
  <Delivery Mode="Push">
    <Batching>
      <MaxItems>1</MaxItems>
      <MaxLatencyTime>300000</MaxLatencyTime>
    </Batching>
    <PushSettings>
      <Heartbeat Interval="1800000"/>
    </PushSettings>
  </Delivery>
  <Query><![CDATA[
    <QueryList>
      <Query Id="0" Path="Application">
        <!-- 865: SRP - Blocked by default disallow rule -->
        <!-- 866: SRP - Blocked by path rule -->
        <!-- 867: SRP - Blocked by publisher rule -->
        <!-- 868: SRP - Blocked by hash or zone rule -->
        <!-- 882: SRP - Blocked, but no UI acknowledgement shown -->
        <!-- Event ID descriptions thanks to Application Whitelisting using Software Restriction Policies by IAD 
             http://www.isssource.com/wp-content/uploads/2012/02/ISSSource-Application_Whitelisting_Using_SRP.pdf -->
        <Select Path="Application">*[Application[Provider[@Name='Microsoft-Windows-SoftwareRestrictionPolicies'] and (EventID=865 or EventID=866 or EventID=867 or EventID=868 or EventID=882)]]</Select>
      </Query>
    </QueryList>]]></Query>
  <ReadExistingEvents>true</ReadExistingEvents>
  <TransportName>http</TransportName>
  <ContentFormat>RenderedText</ContentFormat>
  <Locale Language="en-US"/>
  <LogFile>WEC6-Software-Restriction-Policies</LogFile>
  <AllowedSourceNonDomainComputers/>
  <AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)(A;;GA;;;DD)</AllowedSourceDomainComputers>
</Subscription>