XML filter RDP logon

<QueryList>  <Query Id="0" Path="ForwardedEvents">    <Select Path="ForwardedEvents">            *[System[(EventID=4624)]            and            EventData[Data[@Name='LogonType'] and (Data='10')]            ]        </Select>  </Query></QueryList>
Read More