<ValueQueries> <Value name="User">Event/EventData/Data[@Name='TargetUserName']</Value> <Value name="Computer">Event/EventData/Data[@Name='TargetDomainName']</Value> </ValueQueries>