``` wevutil cl Application wevtutil qe Security /f:xml > *.xml "wevtutil epl" AND ("Security *.evt*" OR "Application *.evt*") ```