How can you extract specific fields like TargetUserName or IpAddress from Event ID 4624 logs using EventLogSession?
The article recommends converting log entries to XML format using `eventData.ToXml()`, then parsing the XML to extract fields by fixed offset positions. For example, `data[4]` gives TargetUserSid and `data[18]` gives IpAddress. Filtering criteria include a minimum length check on these fields to isolate valid login events. This approach is detailed in the EventLogSession implementation section.
XML parsingTargetUserNameIpAddressEventLogSessiondomain user login