<ViewerConfig><QueryConfig><QueryParams><UserQuery /></QueryParams><QueryNode><Name>NAP</Name><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft-Windows-NetworkAccessProtection']]]</Select><Select Path="System">*[System[Provider[@Name='Microsoft-Windows-MSSHAV-SHA']]]</Select><Select Path="System">*[System[Provider[@Name='Dhcp_QEC']]]</Select><Select Path="System">*[System[Provider[@Name='Microsoft-Windows-NAPIPSecEnf']]]</Select></Query></QueryList></QueryNode></QueryConfig><ResultsConfig><Columns><Column Name="Level" Type="System.String" Path="Event/System/Level" Visible="">222</Column><Column Name="Keywords" Type="System.String" Path="Event/System/Keywords" /><Column Name="Date and Time" Type="System.DateTime" Path="Event/System/TimeCreated/@SystemTime" Visible="">272</Column><Column Name="Source" Type="System.String" Path="Event/System/Provider/@Name" Visible="">272</Column><Column Name="Event ID" Type="System.UInt32" Path="Event/System/EventID" Visible="">182</Column><Column Name="Task Category" Type="System.String" Path="Event/System/Task" Visible="">185</Column><Column Name="User" Type="System.String" Path="Event/System/Security/@UserID" /><Column Name="Operational Code" Type="System.String" Path="Event/System/Opcode" /><Column Name="Log" Type="System.String" Path="Event/System/Channel" /><Column Name="Computer" Type="System.String" Path="Event/System/Computer" /><Column Name="Process ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessID" /><Column Name="Thread ID" Type="System.UInt32" Path="Event/System/Execution/@ThreadID" /><Column Name="Processor ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessorID" /><Column Name="Session ID" Type="System.UInt32" Path="Event/System/Execution/@SessionID" /><Column Name="Kernel Time" Type="System.UInt32" Path="Event/System/Execution/@KernelTime" /><Column Name="User Time" Type="System.UInt32" Path="Event/System/Execution/@UserTime" /><Column Name="Processor Time" Type="System.UInt32" Path="Event/System/Execution/@ProcessorTime" /><Column Name="Correlation Id" Type="System.Guid" Path="Event/System/Correlation/@ActivityID" /><Column Name="Relative Correlation Id" Type="System.Guid" Path="Event/System/Correlation/@RelatedActivityID" /><Column Name="Event Source Name" Type="System.String" Path="Event/System/Provider/@EventSourceName" /></Columns></ResultsConfig></ViewerConfig>